Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2608)
CWE-79 (1775)
CWE-416 (1278)
CWE-862 (1126)
CWE-89 (1088)
CWE-22 (1003)
CWE-125 (861)
CWE-200 (836)
CWE-306 (831)
CWE-122 (821)
CWE-20 (785)
CWE-78 (697)
CWE-918 (680)
CWE-787 (674)
CWE-94 (626)
CWE-863 (600)
CWE-74 (599)
CWE-639 (530)
CWE-400 (510)
CWE-269 (499)
CWE-119 (493)
CWE-770 (428)
CWE-502 (422)
CWE-287 (419)
CWE-121 (403)
CWE-77 (371)
CWE-190 (360)
CWE-362 (319)
CWE-352 (270)
CWE-285 (240)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-34208 |
critical | 10.0 | 0.0056 | 2026-04-06 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to | |
CVE-2026-115933 |
critical | 9.9 | 0.0025 | 2026-10-24 | Postiz signs its session, invitation and password reset tokens with one shared secret and without an | |
CVE-2026-41267 |
critical | 9.8 | 0.0033 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-9726 |
critical | 9.8 | 0.0056 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drup | |
CVE-2026-12535 |
critical | 9.8 | 0.0056 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drup | |
CVE-2026-34179 |
critical | 9.1 | 0.0027 | 2026-04-09 | In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go | |
CVE-2026-58255 |
high | 8.8 | 0.0042 | 2026-10-27 | Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.12 | |
CVE-2026-41139 |
high | 8.8 | 0.0058 | 2026-05-07 | Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before versi | |
CVE-2026-56142 |
high | 8.8 | 0.0062 | 2026-06-19 | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 20 | |
CVE-2026-58477 |
high | 8.8 | 0.0051 | 2026-07-14 | Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a mass assignment vulnerabilit | |
CVE-2026-69258 |
high | 8.8 | 0.0067 | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-34427 |
high | 8.7 | 0.0056 | 2026-04-20 | Vvveb prior to 1.0.8.1 contains a privilege escalation vulnerability in the admin user profile save | |
CVE-2026-6912 |
high | 8.7 | 0.0055 | 2026-04-24 | Improperly controlled modification of dynamically-determined object attributes in the Cognito User P | |
CVE-2026-45229 |
high | 8.7 | 0.0037 | 2026-05-13 | Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that | |
CVE-2026-56679 |
high | 8.7 | 0.0040 | 2026-07-15 | 9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the e | |
CVE-2026-72778 |
high | 8.7 | 0.0080 | 2026-08-11 | Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenti | |
CVE-2026-45687 |
high | 8.5 | 0.0034 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8 | |
CVE-2026-71473 |
high | 8.5 | 0.0047 | 2026-08-12 | A flaw was found in the `search-v2-operator` component. A user with specific administrative permissi | |
CVE-2026-17095 |
high | 8.3 | 0.0054 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrict | |
CVE-2026-13244 |
high | 8.1 | 0.0043 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drup | |
CVE-2026-55809 |
high | 8.1 | 0.0043 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drup | |
CVE-2026-55810 |
high | 8.1 | 0.0043 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drup | |
CVE-2026-41277 |
high | 7.6 | 0.0311 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3. | |
CVE-2026-53958 |
high | 7.6 | 0.0040 | 2026-08-18 | 4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an au | |
CVE-2026-44635 |
high | 7.5 | 0.0036 | 2026-05-27 | Kysely is a type-safe TypeScript SQL query builder. From 0.26.0 to 0.28.16, DefaultQueryCompiler.vis | |
CVE-2026-50281 |
high | 7.1 | 0.0043 | 2026-07-02 | Craft CMS is a content management system (CMS). Versions 5.7.0 and above, prior to 5.9.21 contain a | |
CVE-2026-62315 |
high | 7.1 | 0.0049 | 2026-08-20 | Frappe is a full-stack web application framework. In version 16.31.0 and earlier, frappe.client.set_ | |
CVE-2026-46721 |
medium | 6.9 | 0.0036 | 2026-05-19 | The create and edit flows do not restrict which user properties may be submitted and do not enforce | |
CVE-2026-43925 |
medium | 6.9 | 0.0046 | 2026-07-06 | FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, an | |
CVE-2026-116216 |
medium | 6.9 | 0.0027 | 2026-10-26 | MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveDat | |
CVE-2026-41043 |
medium | 6.5 | 0.0056 | 2026-04-24 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apach | |
CVE-2026-48943 |
medium | 6.5 | 0.0030 | 2026-06-25 | K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered | |
CVE-2026-59888 |
medium | 6.5 | 0.0042 | 2026-07-14 | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson | |
CVE-2026-55223 |
medium | 6.3 | 0.0048 | 2026-06-30 | c3p0 is a JDBC Connection pooling library. In versions prior to 0.14.0, c3p0 in combination with ot | |
CVE-2026-54601 |
medium | 6.3 | 0.0030 | 2026-07-07 | FastGPT is an open source AI knowledge base platform. From 4.14.17 to before 4.15.0-beta4, FastGPT a | |
CVE-2026-55736 |
medium | 5.9 | 0.0022 | 2026-06-23 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash- | |
CVE-2026-55803 |
medium | 5.9 | 0.0035 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drup | |
CVE-2026-55804 |
medium | 5.9 | 0.0035 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drup | |
CVE-2026-112295 |
medium | 5.3 | 0.0026 | 2026-10-19 | FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated us | |
CVE-2026-54515 |
medium | 5.3 | 0.0044 | 2026-06-23 | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson | |
CVE-2026-54516 |
medium | 5.3 | 0.0045 | 2026-06-23 | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson | |
CVE-2026-63102 |
medium | 5.3 | 0.0033 | 2026-07-20 | rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated us | |
CVE-2026-17598 |
medium | 5.3 | 0.0039 | 2026-08-07 | Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied t | |
CVE-2026-118538 |
medium | 5.1 | — | 2026-10-28 | A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Ro | |
CVE-2026-110804 |
medium | 4.3 | 0.0018 | 2026-10-16 | Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2 | |
CVE-2026-96378 |
medium | 4.3 | 0.0023 | 2026-10-22 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drup | |
CVE-2026-15083 |
medium | 4.2 | 0.0023 | 2026-07-10 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drup | |
CVE-2026-40897 |
— | — | 0.0055 | 2026-04-24 | Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vul | |
CVE-2026-33453 |
— | — | 0.0918 | 2026-04-27 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apac |