Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1853)
CWE-416 (1298)
CWE-862 (1187)
CWE-89 (1098)
CWE-22 (1025)
CWE-125 (884)
CWE-200 (847)
CWE-306 (839)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (688)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-40191 |
medium | 6.8 | 0.0011 | 2026-04-10 | ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. | |
CVE-2026-6863 |
medium | 6.8 | 0.0024 | 2026-05-06 | Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP | |
CVE-2026-56074 |
medium | 6.8 | 0.0018 | 2026-06-18 | PraisonAI before 1.5.128 caches tool approval decisions by tool name only, not by invocation argumen | |
CVE-2026-114715 |
medium | 6.8 | 0.0034 | 2026-10-22 | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vul | |
CVE-2026-26274 |
medium | 6.6 | 0.0023 | 2026-04-21 | October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a vulnera | |
CVE-2026-65835 |
medium | 6.6 | 0.0024 | 2026-07-30 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, afte | |
CVE-2026-106456 |
medium | 6.5 | 0.0024 | 2026-10-06 | Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backsta | |
CVE-2026-106458 |
medium | 6.5 | 0.0027 | 2026-10-06 | Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backsta | |
CVE-2026-91519 |
medium | 6.5 | 0.0034 | 2026-10-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Repo | |
CVE-2026-63512 |
medium | 6.5 | 0.0073 | 2026-08-11 | Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to perform tamp | |
CVE-2026-102865 |
medium | 6.5 | 0.0088 | 2026-10-13 | Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose inf | |
CVE-2023-28325 |
medium | 6.5 | 0.0039 | 2023-05-11 | An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to mani | |
CVE-2026-42220 |
medium | 6.5 | 0.0030 | 2026-05-04 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated | |
CVE-2026-42610 |
medium | 6.5 | 0.0029 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged user (EX: Content Editor | |
CVE-2026-42883 |
medium | 6.5 | 0.0026 | 2026-05-11 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /api/librarie | |
CVE-2026-45081 |
medium | 6.5 | 0.0020 | 2026-05-27 | Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.5.0, authenticat | |
CVE-2026-47238 |
medium | 6.5 | 0.0024 | 2026-06-11 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #133, a normal auth | |
CVE-2026-42357 |
medium | 6.5 | 0.0031 | 2026-06-17 | Incorrect Authorization vulnerability allows users to access workflow instance information belonging | |
CVE-2026-54324 |
medium | 6.5 | 0.0046 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent wor | |
CVE-2026-54518 |
medium | 6.5 | 0.0035 | 2026-06-23 | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson | |
CVE-2026-44735 |
medium | 6.5 | 0.0037 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the G | |
CVE-2026-53577 |
medium | 6.5 | 0.0044 | 2026-06-26 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the previ | |
CVE-2026-32718 |
medium | 6.5 | 0.0026 | 2026-07-06 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-35211 |
medium | 6.5 | 0.0052 | 2026-07-08 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. | |
CVE-2026-58494 |
medium | 6.5 | 0.0017 | 2026-07-08 | Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi | |
CVE-2026-62147 |
medium | 6.5 | 0.0035 | 2026-07-13 | The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on so | |
CVE-2026-58408 |
medium | 6.5 | 0.0036 | 2026-07-13 | ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user | |
CVE-2026-59889 |
medium | 6.5 | 0.0035 | 2026-07-14 | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson | |
CVE-2026-47084 |
medium | 6.5 | 0.0035 | 2026-07-16 | An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypasse | |
CVE-2026-56144 |
medium | 6.5 | 0.0032 | 2026-07-21 | Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited inde | |
CVE-2026-2411 |
medium | 6.5 | 0.0018 | 2026-08-01 | Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characterist | |
CVE-2026-68930 |
medium | 6.5 | 0.0038 | 2026-08-03 | Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handle | |
CVE-2026-50749 |
medium | 6.5 | 0.0047 | 2026-08-05 | Improper Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2. | |
CVE-2026-48076 |
medium | 6.5 | 0.0033 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking pl | |
CVE-2026-64952 |
medium | 6.5 | 0.0030 | 2026-08-12 | The hunt_delete() VQL function allows deleting hunts. Velociraptor misapplied the permission check | |
CVE-2026-106492 |
medium | 6.5 | 0.0021 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @back | |
CVE-2026-110806 |
medium | 6.5 | 0.0020 | 2026-10-16 | Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an | |
CVE-2026-114131 |
medium | 6.5 | 0.0036 | 2026-10-21 | Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nux | |
CVE-2026-84917 |
medium | 6.5 | 0.0025 | 2026-10-22 | Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing. This | |
CVE-2026-114623 |
medium | 6.5 | 0.0065 | 2026-10-23 | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, | |
CVE-2026-18551 |
medium | 6.5 | 0.0022 | 2026-10-16 | Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to | |
CVE-2026-119200 |
medium | 6.5 | — | 2026-10-29 | Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves l | |
CVE-2026-118952 |
medium | 6.5 | — | 2026-10-30 | A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a | |
CVE-2026-53521 |
medium | 6.4 | 0.0027 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From | |
CVE-2026-106462 |
medium | 6.4 | 0.0017 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-co | |
CVE-2026-108360 |
medium | 6.4 | 0.0022 | 2026-10-22 | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1 | |
CVE-2026-116575 |
medium | 6.3 | 0.0011 | 2026-10-26 | Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2 | |
CVE-2026-21036 |
medium | 6.3 | 0.0009 | 2026-06-05 | Improper authorization in Samsung Internet prior to version 30.0.0.39 allows local attackers to acce | |
CVE-2026-7765 |
medium | 6.3 | 0.0019 | 2026-06-08 | Incorrect authorization in the User Messages dashboard widget in Checkmk <2.5.0p5 causes the message | |
CVE-2026-64650 |
medium | 6.3 | 0.0017 | 2026-07-20 | The `@ai-sdk/harness-opencode` tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drive |