Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2661)
CWE-79 (1966)
CWE-416 (1559)
CWE-862 (1268)
CWE-122 (1130)
CWE-89 (1128)
CWE-125 (1089)
CWE-22 (1054)
CWE-200 (874)
CWE-306 (873)
CWE-20 (832)
CWE-787 (739)
CWE-78 (729)
CWE-918 (712)
CWE-863 (675)
CWE-94 (665)
CWE-74 (605)
CWE-639 (583)
CWE-400 (547)
CWE-269 (515)
CWE-119 (507)
CWE-502 (495)
CWE-287 (460)
CWE-770 (454)
CWE-121 (447)
CWE-190 (421)
CWE-362 (394)
CWE-77 (384)
CWE-476 (322)
CWE-352 (289)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-65462 |
high | 7.6 | 0.0038 | 2026-07-23 | Administrator SQL Injection in Uncanny Automator <= 7.3.2 versions. | |
CVE-2026-65532 |
high | 7.6 | 0.0038 | 2026-07-23 | Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions. | |
CVE-2026-59537 |
high | 7.6 | 0.0038 | 2026-07-27 | Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommer | |
CVE-2026-66427 |
high | 7.6 | 0.0038 | 2026-07-27 | Administrator SQL Injection in WP Google Review Slider <= 18.4 versions. | |
CVE-2026-73346 |
high | 7.6 | 0.0038 | 2026-08-13 | Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions. | |
CVE-2026-65822 |
high | 7.6 | 0.0046 | 2026-08-17 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, | |
CVE-2026-61569 |
high | 7.5 | 0.0028 | 2026-10-28 | AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated streamer login at `objects/l | |
CVE-2026-93855 |
high | 7.5 | 0.0041 | 2026-10-29 | The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the 'su | |
CVE-2026-93904 |
high | 7.5 | 0.0046 | 2026-10-29 | The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vul | |
CVE-2026-47296 |
high | 7.5 | 0.0069 | 2026-07-14 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server a | |
CVE-2025-65877 |
high | 7.5 | 0.0030 | 2025-12-02 | Lvzhou CMS before commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 (2025-09-22) is vulnerable to SQL | |
CVE-2026-22743 |
high | 7.5 | 0.0026 | 2026-03-27 | Spring AI's spring-ai-neo4j-store contains a Cypher injection vulnerability in Neo4jVectorFilterExpr | |
CVE-2026-33614 |
high | 7.5 | 0.0034 | 2026-04-02 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-33616 |
high | 7.5 | 0.0034 | 2026-04-02 | An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability | |
CVE-2026-44446 |
high | 7.5 | 0.0027 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.14.0, | |
CVE-2026-44447 |
high | 7.5 | 0.0031 | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.0, some endpoints | |
CVE-2026-44635 |
high | 7.5 | 0.0036 | 2026-05-27 | Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.vis | |
CVE-2026-11945 |
high | 7.5 | 0.0025 | 2026-06-11 | PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by cr | |
CVE-2026-40762 |
high | 7.5 | 0.0025 | 2026-06-15 | Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions. | |
CVE-2026-54829 |
high | 7.5 | 0.0032 | 2026-06-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-11823 |
high | 7.5 | 0.0046 | 2026-07-01 | The BookingPress Appointment Booking Pro plugin for WordPress is vulnerable to SQL Injection via the | |
CVE-2026-8441 |
high | 7.5 | 0.0046 | 2026-07-02 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' p | |
CVE-2026-59834 |
high | 7.5 | 0.0048 | 2026-07-09 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endp | |
CVE-2026-67579 |
high | 7.5 | 0.0061 | 2026-08-12 | Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacke | |
CVE-2026-27538 |
high | 7.5 | 0.0032 | 2026-08-13 | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. | |
CVE-2026-66622 |
high | 7.5 | 0.0032 | 2026-08-18 | Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions. | |
CVE-2026-110184 |
high | 7.5 | 0.0042 | 2026-10-29 | The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in a | |
CVE-2026-119163 |
high | 7.5 | — | 2026-10-31 | The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin fo | |
CVE-2026-109197 |
high | 7.5 | — | 2026-10-31 | The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' p | |
CVE-2026-15081 |
high | 7.4 | 0.0034 | 2026-07-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2024-33288 |
high | 7.3 | 0.0092 | 2026-05-08 | Prison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability via | |
CVE-2026-115418 |
high | 7.3 | 0.0017 | 2026-10-26 | SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud | |
CVE-2023-29154 |
high | 7.2 | 0.4144 | 2023-06-01 | SQL injection vulnerability exists in the CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user | |
CVE-2023-29095 |
high | 7.2 | 0.0090 | 2023-07-10 | Auth. (admin+) SQL Injection (SQLi) vulnerability in David F. Carr RSVPMaker plugin < 10.5.5 version | |
CVE-2026-39325 |
high | 7.2 | 0.0025 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability | |
CVE-2026-4112 |
high | 7.2 | 0.0061 | 2026-04-09 | Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SM | |
CVE-2026-40315 |
high | 7.2 | 0.0030 | 2026-04-14 | PraisonAI is a multi-agent teams system. Prior to 4.5.133, there is an SQL identifier injection vuln | |
CVE-2026-40871 |
high | 7.2 | 0.0857 | 2026-04-21 | mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026- | |
CVE-2026-44860 |
high | 7.2 | 0.0032 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the | |
CVE-2026-44861 |
high | 7.2 | 0.0032 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the | |
CVE-2026-44862 |
high | 7.2 | 0.0032 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the | |
CVE-2026-44863 |
high | 7.2 | 0.0032 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the | |
CVE-2026-44864 |
high | 7.2 | 0.0032 | 2026-05-12 | SQL injection vulnerabilities exist in several underlying service components accessible through the | |
CVE-2026-6888 |
high | 7.2 | 0.0037 | 2026-05-13 | Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attack | |
CVE-2026-40524 |
high | 7.2 | 0.0034 | 2026-06-29 | FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the get_gl_transactions() fu | |
CVE-2026-62238 |
high | 7.2 | 0.0050 | 2026-07-17 | OpenRemote before 1.26.0 contain an authenticated SQL injection vulnerability in the datapoint cross | |
CVE-2026-71292 |
high | 7.2 | 0.0057 | 2026-08-05 | Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admi | |
CVE-2026-23705 |
high | 7.2 | 0.0031 | 2026-10-13 | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabilit | |
CVE-2026-116218 |
high | 7.2 | 0.0027 | 2026-10-26 | Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authentica | |
CVE-2026-11587 |
high | 7.2 | 0.0026 | 2026-10-29 | SQL injection allowing an authenticated user with access to ACL management to read and modify the Ce |