Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1853)
CWE-416 (1298)
CWE-862 (1187)
CWE-89 (1099)
CWE-22 (1026)
CWE-125 (885)
CWE-200 (847)
CWE-306 (839)
CWE-122 (831)
CWE-20 (798)
CWE-78 (711)
CWE-918 (690)
CWE-787 (689)
CWE-863 (644)
CWE-94 (642)
CWE-74 (601)
CWE-639 (543)
CWE-400 (531)
CWE-119 (503)
CWE-269 (501)
CWE-502 (472)
CWE-770 (443)
CWE-287 (433)
CWE-121 (408)
CWE-77 (373)
CWE-190 (371)
CWE-362 (323)
CWE-352 (281)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-40835 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40836 |
high | 7.1 | 0.0022 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40837 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40838 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40839 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40840 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40841 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40842 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40843 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40844 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40845 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40846 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40847 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40848 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40849 |
high | 7.1 | 0.0026 | 2026-05-27 | An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-56221 |
high | 7.1 | 0.0034 | 2026-06-22 | Cap-go before 12.128.2 contains multiple SQL injection vulnerabilities in cloudflare.ts where user-c | |
CVE-2026-40522 |
high | 7.1 | 0.0023 | 2026-06-29 | FrontAccounting before 2.4.20 contains a SQL injection vulnerability in the Bank Statement report ha | |
CVE-2026-11321 |
high | 7.1 | 0.0042 | 2026-07-10 | The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field value | |
CVE-2026-64880 |
high | 7.1 | 0.0032 | 2026-07-21 | Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL que | |
CVE-2026-65494 |
high | 7.1 | 0.0029 | 2026-07-23 | Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions. | |
CVE-2026-12895 |
high | 7.1 | 0.0037 | 2026-07-29 | SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application co | |
CVE-2026-15929 |
high | 7.1 | 0.0027 | 2026-07-30 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i | |
CVE-2026-18737 |
high | 7.1 | 0.0040 | 2026-08-03 | Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to | |
CVE-2026-71276 |
high | 7.1 | 0.0032 | 2026-08-05 | Magistrala (formerly Mainflux)'s message-readers API reads a value from the HTTP query string (reade | |
CVE-2026-72607 |
high | 7.1 | 0.0045 | 2026-08-11 | A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allo | |
CVE-2026-72609 |
high | 7.1 | 0.0037 | 2026-08-11 | An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows aut | |
CVE-2026-73331 |
high | 7.1 | 0.0036 | 2026-08-12 | CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated at | |
CVE-2026-73345 |
high | 7.1 | 0.0029 | 2026-08-18 | Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions. | |
CVE-2026-114664 |
high | 7.1 | 0.0020 | 2026-10-22 | Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doct | |
CVE-2026-115191 |
high | 7.1 | 0.0035 | 2026-10-26 | A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration | |
CVE-2026-115192 |
high | 7.1 | 0.0035 | 2026-10-26 | An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type}). | |
CVE-2026-116807 |
high | 7.0 | 0.0027 | 2026-10-27 | OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to by | |
CVE-2026-57190 |
high | 7.0 | 0.0068 | 2026-10-27 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, | |
CVE-2026-40823 |
high | 7.0 | 0.0024 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40824 |
high | 7.0 | 0.0024 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40825 |
high | 7.0 | 0.0024 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40827 |
high | 7.0 | 0.0029 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40828 |
high | 7.0 | 0.0029 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40829 |
high | 7.0 | 0.0029 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-40830 |
high | 7.0 | 0.0029 | 2026-05-27 | A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the | |
CVE-2026-69704 |
high | 7.0 | 0.0033 | 2026-08-04 | Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database quer | |
CVE-2026-114243 |
medium | 6.9 | 0.0033 | 2026-10-21 | A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e | |
CVE-2026-114255 |
medium | 6.9 | 0.0027 | 2026-10-21 | A security flaw has been discovered in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df | |
CVE-2026-114256 |
medium | 6.9 | 0.0027 | 2026-10-21 | A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f | |
CVE-2026-114258 |
medium | 6.9 | 0.0034 | 2026-10-21 | A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f54 | |
CVE-2026-114440 |
medium | 6.9 | 0.0034 | 2026-10-21 | A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part o | |
CVE-2026-114577 |
medium | 6.9 | 0.0034 | 2026-10-22 | A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown | |
CVE-2026-116828 |
medium | 6.9 | 0.0025 | 2026-10-27 | YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter i | |
CVE-2026-117515 |
medium | 6.9 | 0.0041 | 2026-10-27 | A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae | |
CVE-2026-5147 |
medium | 6.9 | 0.0035 | 2026-03-30 | A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown par |