Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1289)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1023)
CWE-125 (880)
CWE-200 (847)
CWE-306 (838)
CWE-122 (830)
CWE-20 (795)
CWE-78 (710)
CWE-918 (689)
CWE-787 (681)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (541)
CWE-400 (530)
CWE-269 (501)
CWE-119 (494)
CWE-502 (470)
CWE-770 (440)
CWE-287 (431)
CWE-121 (406)
CWE-77 (373)
CWE-190 (367)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-39492 |
critical | 9.3 | 0.0036 | 2026-06-15 | Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions. | |
CVE-2026-39493 |
critical | 9.3 | 0.0036 | 2026-06-15 | Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions. | |
CVE-2026-39502 |
critical | 9.3 | 0.0029 | 2026-06-15 | Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions. | |
CVE-2026-39511 |
critical | 9.3 | 0.0029 | 2026-06-15 | Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions. | |
CVE-2026-39512 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions. | |
CVE-2026-39519 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions. | |
CVE-2026-39530 |
critical | 9.3 | 0.0030 | 2026-06-15 | Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions. | |
CVE-2026-40771 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions. | |
CVE-2026-40798 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions. | |
CVE-2026-42381 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions. | |
CVE-2026-42386 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions. | |
CVE-2026-42639 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions. | |
CVE-2026-42665 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions. | |
CVE-2026-45439 |
critical | 9.3 | 0.0029 | 2026-06-15 | Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions. | |
CVE-2026-48886 |
critical | 9.3 | 0.0028 | 2026-06-15 | Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions. | |
CVE-2026-49067 |
critical | 9.3 | 0.0029 | 2026-06-15 | Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions. | |
CVE-2026-49776 |
critical | 9.3 | 0.0029 | 2026-06-15 | Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatica | |
CVE-2026-52693 |
critical | 9.3 | 0.0029 | 2026-06-15 | Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions. | |
CVE-2026-114358 |
critical | 9.3 | 0.0050 | 2026-10-29 | This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user su | |
CVE-2026-39574 |
critical | 9.3 | 0.0023 | 2026-06-16 | Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions. | |
CVE-2026-49772 |
critical | 9.3 | 0.0194 | 2026-06-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-52715 |
critical | 9.3 | 0.0119 | 2026-06-16 | Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions. | |
CVE-2026-22332 |
critical | 9.3 | 0.0028 | 2026-06-17 | Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions. | |
CVE-2026-22340 |
critical | 9.3 | 0.0037 | 2026-06-17 | Unauthenticated SQL Injection in WPJobster <= 6.3.5 versions. | |
CVE-2026-39438 |
critical | 9.3 | 0.0037 | 2026-06-17 | Unauthenticated SQL Injection in ListingPro <= 2.9.10 versions. | |
CVE-2026-39596 |
critical | 9.3 | 0.0037 | 2026-06-17 | Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions. | |
CVE-2026-48875 |
critical | 9.3 | 0.0042 | 2026-06-17 | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions. | |
CVE-2026-49076 |
critical | 9.3 | 0.0037 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-49079 |
critical | 9.3 | 0.0035 | 2026-06-17 | Unauthenticated SQL Injection in JetSearch <= 3.5.17 versions. | |
CVE-2026-49080 |
critical | 9.3 | 0.0031 | 2026-06-17 | Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions. | |
CVE-2026-49084 |
critical | 9.3 | 0.0028 | 2026-06-17 | Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions. | |
CVE-2026-54186 |
critical | 9.3 | 0.0029 | 2026-06-17 | Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions. | |
CVE-2026-54187 |
critical | 9.3 | 0.0028 | 2026-06-17 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions. | |
CVE-2026-54811 |
critical | 9.3 | 0.0028 | 2026-06-17 | Unauthenticated SQL Injection in WP eMember < v10.9.4 versions. | |
CVE-2026-54808 |
critical | 9.3 | 0.0031 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-54809 |
critical | 9.3 | 0.0023 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-54815 |
critical | 9.3 | 0.0023 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-54819 |
critical | 9.3 | 0.0023 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-54812 |
critical | 9.3 | 0.0028 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-55740 |
critical | 9.3 | 0.0028 | 2026-06-18 | Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) | |
CVE-2026-54419 |
critical | 9.3 | 0.0044 | 2026-06-18 | claudiopizzillo PIAF-HMS (PBX-In-A-Flash Hotel Management System; no released versions, latest commi | |
CVE-2026-54836 |
critical | 9.3 | 0.0134 | 2026-06-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i | |
CVE-2026-54843 |
critical | 9.3 | 0.0040 | 2026-06-25 | Unauthenticated SQL Injection in MDTF <= 1.3.7 versions. | |
CVE-2026-54849 |
critical | 9.3 | 0.0040 | 2026-06-25 | Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions. | |
CVE-2026-54820 |
critical | 9.3 | 0.0040 | 2026-06-26 | Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions. | |
CVE-2026-54827 |
critical | 9.3 | 0.0040 | 2026-06-26 | Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions. | |
CVE-2026-54831 |
critical | 9.3 | 0.0040 | 2026-06-26 | Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions. | |
CVE-2026-56034 |
critical | 9.3 | 0.0040 | 2026-06-26 | Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions. | |
CVE-2026-56036 |
critical | 9.3 | 0.0040 | 2026-06-26 | Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions. | |
CVE-2026-56062 |
critical | 9.3 | 0.0144 | 2026-06-26 | Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions. |