Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1853)
CWE-416 (1298)
CWE-862 (1187)
CWE-89 (1100)
CWE-22 (1026)
CWE-125 (885)
CWE-200 (847)
CWE-306 (839)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (689)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (532)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-64651 |
medium | 6.3 | 0.0017 | 2026-07-20 | The `@ai-sdk/harness-opencode` tool connects HarnessAgent to OpenCode through a sandboxed bridge. Pr | |
CVE-2026-55163 |
medium | 6.3 | 0.0022 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:29 | |
CVE-2026-111332 |
medium | 6.3 | 0.0035 | 2026-10-15 | OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous | |
CVE-2026-114132 |
medium | 6.3 | 0.0042 | 2026-10-21 | Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages cas | |
CVE-2026-115416 |
medium | 6.3 | 0.0027 | 2026-10-22 | Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed | |
CVE-2026-35491 |
medium | 6.1 | 0.0016 | 2026-04-07 | FTLDNS (pihole-FTL) provides an interactive API and also generates statistics for Pi-hole's Web inte | |
CVE-2026-47128 |
medium | 6.1 | 0.0013 | 2026-07-20 | nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55 | |
CVE-2026-67347 |
medium | 6.1 | 0.0051 | 2026-07-30 | Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulner | |
CVE-2026-41689 |
medium | 6.0 | 0.0018 | 2026-05-07 | Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, | |
CVE-2026-54698 |
medium | 6.0 | 0.0027 | 2026-07-07 | Hasura is an open-source product that provides users GraphQL or REST APIs. Prior to 2.49.2 and 2.45. | |
CVE-2026-48808 |
medium | 6.0 | 0.0041 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox st | |
CVE-2026-49981 |
medium | 6.0 | 0.0036 | 2026-07-14 | Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function all | |
CVE-2026-62219 |
medium | 6.0 | 0.0030 | 2026-07-17 | OpenClaw 2026.2.12 before 2026.5.26 contain an authorization bypass vulnerability in the hooks allow | |
CVE-2026-58139 |
medium | 6.0 | 0.0051 | 2026-08-03 | The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any | |
CVE-2026-71191 |
medium | 6.0 | 0.0056 | 2026-08-05 | In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers a | |
CVE-2026-71192 |
medium | 6.0 | 0.0044 | 2026-08-05 | In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control heade | |
CVE-2026-109433 |
medium | 6.0 | 0.0043 | 2026-10-19 | Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerabili | |
CVE-2026-105930 |
medium | 6.0 | 0.0045 | 2026-10-21 | When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated | |
CVE-2026-115883 |
medium | 6.0 | 0.0030 | 2026-10-23 | LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph work | |
CVE-2026-116136 |
medium | 6.0 | 0.0020 | 2026-10-25 | ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions:: | |
CVE-2026-114214 |
medium | 6.0 | 0.0025 | 2026-10-25 | Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records | |
CVE-2026-115627 |
medium | 6.0 | 0.0025 | 2026-10-25 | Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination | |
CVE-2026-115635 |
medium | 6.0 | 0.0025 | 2026-10-25 | Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tena | |
CVE-2026-10741 |
medium | 5.9 | 0.0027 | 2026-06-17 | Sonatype Nexus Repository Manager before 3.93.0 contains an authorization vulnerability in the proxy | |
CVE-2026-61643 |
medium | 5.9 | 0.0019 | 2026-07-15 | FastGPT is a knowledge-based AI application platform. From 4.14.17 until 4.15.0-beta5, an authentica | |
CVE-2026-5374 |
medium | 5.8 | 0.0021 | 2026-04-07 | An issue that allowed MCP agents to access remediation and asset information from outside of the aut | |
CVE-2026-5384 |
medium | 5.8 | 0.0021 | 2026-04-07 | An issue that could allow a credential to be updated and used for a task from outside of the authori | |
CVE-2026-55475 |
medium | 5.7 | 0.0034 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.1, the Importer API endpoint allows | |
CVE-2026-14538 |
medium | 5.7 | 0.0020 | 2026-07-31 | An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql too | |
CVE-2026-18954 |
medium | 5.7 | 0.0016 | 2026-08-05 | Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server be | |
CVE-2026-18171 |
medium | 5.7 | 0.0014 | 2026-08-12 | Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest containe | |
CVE-2026-70057 |
medium | 5.5 | 0.0032 | 2026-10-13 | Incorrect authorization in Windows Routing and Remote Access Service (RRAS) allows an authorized att | |
CVE-2026-116623 |
medium | 5.5 | 0.0039 | 2026-10-27 | A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an u | |
CVE-2026-62775 |
medium | 5.5 | 0.0035 | 2026-08-11 | Incorrect authorization in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an auth | |
CVE-2026-69971 |
medium | 5.5 | 0.0040 | 2026-10-13 | Incorrect authorization in Windows Kernel-Mode Drivers allows an authorized attacker to disclose inf | |
CVE-2026-70083 |
medium | 5.5 | 0.0032 | 2026-10-13 | Incorrect authorization in DNS Server allows an authorized attacker to perform tampering locally. | |
CVE-2026-70087 |
medium | 5.5 | 0.0032 | 2026-10-13 | Incorrect authorization in DNS Server allows an authorized attacker to bypass a security feature loc | |
CVE-2026-83764 |
medium | 5.5 | 0.0035 | 2026-10-13 | Incorrect authorization in Windows Clipboard User Service allows an authorized attacker to disclose | |
CVE-2026-84011 |
medium | 5.5 | 0.0028 | 2026-10-13 | Incorrect authorization in Windows SMB Client allows an authorized attacker to bypass a security fea | |
CVE-2026-88162 |
medium | 5.5 | 0.0028 | 2026-10-13 | Improper authorization in Windows Encrypting File System (EFS) allows an authorized attacker to perf | |
CVE-2026-48493 |
medium | 5.5 | 0.0031 | 2026-06-23 | Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only user | |
CVE-2026-15752 |
medium | 5.5 | 0.0050 | 2026-07-14 | A vulnerability was found in zhinianboke xianyu-auto-reply up to dcb445ad97816ad65299a7580ee0c8c8f92 | |
CVE-2026-16126 |
medium | 5.5 | 0.0051 | 2026-07-18 | A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function h | |
CVE-2026-16200 |
medium | 5.5 | 0.0050 | 2026-07-19 | A vulnerability has been found in zevorn rt-claw up to 0.2.0. This impacts the function claw_tool_in | |
CVE-2026-16215 |
medium | 5.5 | 0.0055 | 2026-07-19 | A security flaw has been discovered in geex-arts django-jet up to 1.0.8. This impacts an unknown fun | |
CVE-2026-19345 |
medium | 5.5 | 0.0055 | 2026-08-09 | A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part | |
CVE-2026-111738 |
medium | 5.5 | 0.0028 | 2026-10-23 | The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before ap | |
CVE-2026-111980 |
medium | 5.5 | 0.0018 | 2026-10-25 | The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capabili | |
CVE-2026-62904 |
medium | 5.4 | 0.0039 | 2026-08-28 | Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclo | |
CVE-2026-101486 |
medium | 5.4 | 0.0021 | 2026-10-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Flui |