Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2660)
CWE-79 (1926)
CWE-416 (1558)
CWE-862 (1259)
CWE-122 (1130)
CWE-89 (1123)
CWE-125 (1089)
CWE-22 (1052)
CWE-306 (873)
CWE-200 (871)
CWE-20 (832)
CWE-787 (739)
CWE-78 (728)
CWE-918 (712)
CWE-863 (671)
CWE-94 (660)
CWE-74 (605)
CWE-639 (583)
CWE-400 (547)
CWE-269 (512)
CWE-119 (507)
CWE-502 (494)
CWE-287 (456)
CWE-770 (453)
CWE-121 (446)
CWE-190 (419)
CWE-362 (394)
CWE-77 (384)
CWE-476 (322)
CWE-352 (289)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-70057 |
medium | 5.5 | 0.0032 | 2026-10-13 | Incorrect authorization in Windows Routing and Remote Access Service (RRAS) allows an authorized att | |
CVE-2026-116623 |
medium | 5.5 | 0.0039 | 2026-10-27 | A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an u | |
CVE-2026-62775 |
medium | 5.5 | 0.0035 | 2026-08-11 | Incorrect authorization in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an auth | |
CVE-2026-69971 |
medium | 5.5 | 0.0040 | 2026-10-13 | Incorrect authorization in Windows Kernel-Mode Drivers allows an authorized attacker to disclose inf | |
CVE-2026-70083 |
medium | 5.5 | 0.0032 | 2026-10-13 | Incorrect authorization in DNS Server allows an authorized attacker to perform tampering locally. | |
CVE-2026-70087 |
medium | 5.5 | 0.0032 | 2026-10-13 | Incorrect authorization in DNS Server allows an authorized attacker to bypass a security feature loc | |
CVE-2026-83764 |
medium | 5.5 | 0.0034 | 2026-10-13 | Incorrect authorization in Windows Clipboard User Service allows an authorized attacker to disclose | |
CVE-2026-84011 |
medium | 5.5 | 0.0028 | 2026-10-13 | Incorrect authorization in Windows SMB Client allows an authorized attacker to bypass a security fea | |
CVE-2026-88162 |
medium | 5.5 | 0.0028 | 2026-10-13 | Improper authorization in Windows Encrypting File System (EFS) allows an authorized attacker to perf | |
CVE-2026-48493 |
medium | 5.5 | 0.0031 | 2026-06-23 | Snipe-IT is an IT asset/license management system. In versions prior to 8.6.0, a user with only user | |
CVE-2026-15752 |
medium | 5.5 | 0.0050 | 2026-07-14 | A vulnerability was found in zhinianboke xianyu-auto-reply up to dcb445ad97816ad65299a7580ee0c8c8f92 | |
CVE-2026-16126 |
medium | 5.5 | 0.0051 | 2026-07-18 | A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function h | |
CVE-2026-16200 |
medium | 5.5 | 0.0050 | 2026-07-19 | A vulnerability has been found in zevorn rt-claw up to 0.2.0. This impacts the function claw_tool_in | |
CVE-2026-16215 |
medium | 5.5 | 0.0055 | 2026-07-19 | A security flaw has been discovered in geex-arts django-jet up to 1.0.8. This impacts an unknown fun | |
CVE-2026-19345 |
medium | 5.5 | 0.0055 | 2026-08-09 | A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part | |
CVE-2026-111738 |
medium | 5.5 | 0.0028 | 2026-10-23 | The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before ap | |
CVE-2026-111980 |
medium | 5.5 | 0.0018 | 2026-10-25 | The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capabili | |
CVE-2026-62904 |
medium | 5.4 | 0.0039 | 2026-08-28 | Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclo | |
CVE-2026-101486 |
medium | 5.4 | 0.0021 | 2026-10-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Flui | |
CVE-2026-101487 |
medium | 5.4 | 0.0021 | 2026-10-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Port | |
CVE-2026-116679 |
medium | 5.4 | 0.0031 | 2026-10-27 | Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 unti | |
CVE-2026-24069 |
medium | 5.4 | 0.0019 | 2026-04-14 | Kiuwan SAST improperly authorizes SSO logins for locally disabled mapped user accounts, allowing dis | |
CVE-2026-6383 |
medium | 5.4 | 0.0015 | 2026-04-15 | A flaw was found in KubeVirt's Role-Based Access Control (RBAC) evaluation logic. The authorization | |
CVE-2026-30368 |
medium | 5.4 | 0.0035 | 2026-04-24 | A client-side authorization flaw in Lightspeed Systems Classroom v5.1.2.1763770643 allows unauthenti | |
CVE-2026-52779 |
medium | 5.4 | 0.0022 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, a cro | |
CVE-2026-58211 |
medium | 5.4 | 0.0029 | 2026-07-08 | NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Pr | |
CVE-2026-55608 |
medium | 5.4 | 0.0028 | 2026-07-15 | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, a | |
CVE-2026-47082 |
medium | 5.4 | 0.0030 | 2026-07-16 | An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skip | |
CVE-2026-56146 |
medium | 5.4 | 0.0024 | 2026-07-21 | Improper Access Control (CWE-284) in Kibana can lead to unauthorized modification of Entity Analytic | |
CVE-2026-106463 |
medium | 5.4 | 0.0017 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin | |
CVE-2026-67249 |
medium | 5.4 | 0.0019 | 2026-10-19 | A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verificatio | |
CVE-2026-96370 |
medium | 5.4 | 0.0024 | 2026-10-22 | Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery. This iss | |
CVE-2026-115221 |
medium | 5.4 | 0.0014 | 2026-10-22 | A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retriev | |
CVE-2025-13050 |
medium | 5.4 | 0.0026 | 2026-10-29 | Broken Function Level Authorization allows execution of poller post-restart commands by authenticate | |
CVE-2026-107258 |
medium | 5.4 | 0.0014 | 2026-10-30 | Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. | |
CVE-2026-107263 |
medium | 5.4 | 0.0014 | 2026-10-30 | Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affec | |
CVE-2026-87336 |
medium | 5.3 | 0.0027 | 2026-10-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Port | |
CVE-2026-118640 |
medium | 5.3 | 0.0019 | 2026-10-28 | n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability in Chat Hub t | |
CVE-2026-69640 |
medium | 5.3 | 0.0069 | 2026-10-13 | Incorrect authorization in Windows Key Distribution Center allows an authorized attacker to bypass a | |
CVE-2026-34364 |
medium | 5.3 | 0.0033 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `categories. | |
CVE-2026-5380 |
medium | 5.3 | 0.0020 | 2026-04-07 | An issue that could allow an authorized user to view the clear-text secrets for a subset of credenti | |
CVE-2026-33551 |
medium | 5.3 | 0.0022 | 2026-04-10 | An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0. | |
CVE-2026-33888 |
medium | 5.3 | 0.0051 | 2026-04-15 | ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain | |
CVE-2026-24749 |
medium | 5.3 | 0.0040 | 2026-04-16 | The Silverstripe Assets Module is a required component of Silverstripe Framework. In versions prior | |
CVE-2026-40304 |
medium | 5.3 | 0.0029 | 2026-04-17 | zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the | |
CVE-2026-34082 |
medium | 5.3 | 0.0019 | 2026-04-20 | Dify is an open-source LLM app development platform. Prior to 1.13.1, the method `DELETE /console/ap | |
CVE-2026-40099 |
medium | 5.3 | 0.0027 | 2026-04-24 | Kirby is an open-source content management system. Kirby's user permissions control which user role | |
CVE-2026-45009 |
medium | 5.3 | 0.0021 | 2026-05-15 | phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes that | |
CVE-2026-44838 |
medium | 5.3 | 0.0020 | 2026-05-27 | RabbitMQ is a messaging and streaming broker. From 4.2.0 to before 4.2.4, RabbitMQ's MQTT plugin all | |
CVE-2026-44173 |
medium | 5.3 | 0.0062 | 2026-06-12 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26 |