Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1850)
CWE-416 (1298)
CWE-862 (1186)
CWE-89 (1098)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (686)
CWE-863 (644)
CWE-94 (642)
CWE-74 (600)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (471)
CWE-770 (441)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-48806 |
high | 7.1 | 0.0042 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping | |
CVE-2026-48807 |
high | 7.1 | 0.0037 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully c | |
CVE-2026-47697 |
high | 7.1 | 0.0031 | 2026-07-21 | Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organi | |
CVE-2026-61012 |
high | 7.1 | 0.0034 | 2026-07-21 | Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite (component: Internal O | |
CVE-2026-13060 |
high | 7.1 | 0.0043 | 2026-07-22 | An authenticated user with limited read privileges may be able to access documents from collections | |
CVE-2026-59678 |
high | 7.1 | 0.0016 | 2026-07-23 | An Incorrect Authorization vulnerability in Linux-Gaming PortProtonQt allows any users to mount and | |
CVE-2026-43672 |
high | 7.1 | 0.0016 | 2026-07-27 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Se | |
CVE-2026-69262 |
high | 7.1 | 0.0052 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-70471 |
high | 7.1 | 0.0041 | 2026-08-04 | Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. | |
CVE-2026-70472 |
high | 7.1 | 0.0052 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-55707 |
high | 7.1 | 0.0043 | 2026-08-05 | In OpenStack Neutron before 28.0.2, the subnetpool onboarding API does not verify ownership of the t | |
CVE-2026-72771 |
high | 7.1 | 0.0036 | 2026-08-11 | n8n versions before 2.32.1 fail to enforce the Allowed HTTP Request Domains allowlist in multiple AI | |
CVE-2026-63177 |
high | 7.1 | 0.0037 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, role-based access contro | |
CVE-2026-73499 |
high | 7.1 | 0.0066 | 2026-08-12 | etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33 | |
CVE-2026-75480 |
high | 7.1 | 0.0042 | 2026-08-17 | OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-lev | |
CVE-2026-17183 |
high | 7.1 | 0.0029 | 2026-08-19 | An authenticated user with permission to create or edit alert rules can bypass datasource query auth | |
CVE-2026-82634 |
high | 7.1 | 0.0042 | 2026-08-30 | Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpo | |
CVE-2026-113354 |
high | 7.1 | 0.0037 | 2026-10-20 | Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users wit | |
CVE-2026-114067 |
high | 7.1 | 0.0031 | 2026-10-21 | Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot- | |
CVE-2026-114391 |
high | 7.1 | 0.0030 | 2026-10-21 | ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() | |
CVE-2026-16255 |
high | 7.1 | 0.0021 | 2026-10-22 | GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.3.6, 19.4 bef | |
CVE-2026-115477 |
high | 7.1 | 0.0035 | 2026-10-23 | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13. | |
CVE-2026-115478 |
high | 7.1 | 0.0032 | 2026-10-23 | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 | |
CVE-2026-112342 |
high | 7.1 | 0.0027 | 2026-10-23 | Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_hel | |
CVE-2026-114633 |
high | 7.0 | 0.0044 | 2026-10-22 | WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Us | |
CVE-2026-102232 |
high | 7.0 | 0.0034 | 2026-10-13 | Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security f | |
CVE-2026-35555 |
high | 7.0 | 0.0015 | 2026-05-12 | PowerSYSTEM Center feature for device project groups allows an authenticated user with limited permi | |
CVE-2026-54321 |
high | 7.0 | 0.0040 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent wor | |
CVE-2026-57215 |
high | 7.0 | 0.0038 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ | |
CVE-2026-57217 |
high | 7.0 | 0.0035 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.21, 4.1.11, and 4.2.6, RabbitMQ | |
CVE-2026-18696 |
high | 7.0 | 0.0040 | 2026-08-11 | An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-de | |
CVE-2026-111812 |
high | 7.0 | 0.0036 | 2026-10-21 | Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS | |
CVE-2026-114267 |
medium | 6.9 | 0.0031 | 2026-10-21 | A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unkn | |
CVE-2026-118685 |
medium | 6.9 | 0.0019 | 2026-10-28 | ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, | |
CVE-2026-33570 |
medium | 6.9 | 0.0016 | 2026-05-12 | PowerSYSTEM Center REST API endpoint for devices allows a low privilege authenticated user to access | |
CVE-2026-50008 |
medium | 6.9 | 0.0034 | 2026-06-12 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node. | |
CVE-2026-42604 |
medium | 6.9 | 0.0040 | 2026-06-12 | Actual is a local-first personal finance tool. The `POST /openid/config` endpoint in Actual Budget's | |
CVE-2026-15541 |
medium | 6.9 | 0.0054 | 2026-07-13 | A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server. | |
CVE-2026-60087 |
medium | 6.9 | 0.0034 | 2026-07-15 | PraisonAI before 1.6.78 caches tool approval decisions by tool name only, allowing attackers to reus | |
CVE-2026-18394 |
medium | 6.9 | 0.0052 | 2026-07-31 | Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow re | |
CVE-2026-21076 |
medium | 6.9 | 0.0013 | 2026-08-10 | Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access se | |
CVE-2026-21077 |
medium | 6.9 | 0.0013 | 2026-08-10 | Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access se | |
CVE-2026-72788 |
medium | 6.9 | 0.0038 | 2026-08-12 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter | |
CVE-2026-72792 |
medium | 6.9 | 0.0032 | 2026-08-12 | SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoin | |
CVE-2026-53786 |
medium | 6.9 | 0.0040 | 2026-08-13 | rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to | |
CVE-2026-113611 |
medium | 6.9 | 0.0053 | 2026-10-20 | Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted admini | |
CVE-2026-115972 |
medium | 6.9 | 0.0028 | 2026-10-24 | A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerabil | |
CVE-2026-12664 |
medium | 6.8 | 0.0040 | 2026-10-22 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.3.6, 19.4 | |
CVE-2026-116684 |
medium | 6.8 | 0.0037 | 2026-10-27 | The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers | |
CVE-2026-5378 |
medium | 6.8 | 0.0019 | 2026-04-07 | An issue that allowed administrators to create and update users outside of their authorized organiza |