Vulnerability Weakness Types
Browse CVEs by CWE classification. Click a CWE to see all associated vulnerabilities.
CWE-284 (2634)
CWE-79 (1821)
CWE-416 (1298)
CWE-862 (1175)
CWE-89 (1097)
CWE-22 (1024)
CWE-125 (884)
CWE-200 (847)
CWE-306 (838)
CWE-122 (831)
CWE-20 (798)
CWE-78 (710)
CWE-918 (689)
CWE-787 (686)
CWE-94 (641)
CWE-863 (617)
CWE-74 (600)
CWE-639 (543)
CWE-400 (530)
CWE-119 (503)
CWE-269 (501)
CWE-502 (470)
CWE-770 (440)
CWE-287 (432)
CWE-121 (408)
CWE-77 (373)
CWE-190 (370)
CWE-362 (323)
CWE-352 (276)
CWE-285 (243)
| CVE | Severity | CVSS | EPSS | Published | Description | Flags |
|---|---|---|---|---|---|---|
CVE-2026-59726 |
critical | 10.0 | 0.0302 | 2026-07-09 | Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default docker-co | |
CVE-2026-15966 |
critical | 9.8 | 0.0037 | 2026-07-23 | Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Tran | |
CVE-2025-61163 |
critical | 9.8 | 0.0036 | 2026-08-26 | Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with unt | |
CVE-2026-9739 |
critical | 9.4 | 0.0028 | 2026-05-27 | Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we i | |
CVE-2026-61736 |
critical | 9.3 | 0.0142 | 2026-07-15 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server default | |
CVE-2026-62895 |
high | 8.8 | 0.0080 | 2026-09-08 | Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker t | |
CVE-2026-116748 |
high | 8.7 | 0.0053 | 2026-10-26 | Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc- | |
CVE-2025-13017 |
high | 8.1 | 0.0027 | 2025-11-11 | Same-origin policy bypass in the DOM: Notifications component. This vulnerability was fixed in Firef | |
CVE-2025-13019 |
high | 8.1 | 0.0027 | 2025-11-11 | Same-origin policy bypass in the DOM: Workers component. This vulnerability was fixed in Firefox 145 | |
CVE-2026-5302 |
high | 8.1 | 0.0026 | 2026-04-08 | CORS misconfiguration in CoolerControl/coolercontrold <4.0.0 allows unauthenticated remote attackers | |
CVE-2026-41056 |
high | 8.1 | 0.0034 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and below, the `allowOrigin($allowAll | |
CVE-2026-34839 |
high | 7.7 | 0.0041 | 2026-04-21 | Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Glances | |
CVE-2026-12084 |
high | 7.5 | 0.0026 | 2026-06-30 | IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 uses Cross-Origin Resource | |
CVE-2026-56458 |
high | 7.5 | 0.0026 | 2026-07-09 | HCL DevOps Deploy uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry o | |
CVE-2026-46608 |
high | 7.4 | 0.0040 | 2026-06-25 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.5, the Glances XML-RPC | |
CVE-2026-89058 |
high | 7.4 | 0.0026 | 2026-09-18 | A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflec | |
CVE-2026-8919 |
high | 7.2 | 0.0045 | 2026-07-15 | Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user | |
CVE-2026-107858 |
high | 7.2 | 0.0036 | 2026-10-23 | Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted | |
CVE-2026-33533 |
high | 7.1 | 0.0033 | 2026-04-02 | Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.3, the Glances | |
CVE-2026-54290 |
high | 7.1 | 0.0033 | 2026-06-22 | Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12. | |
CVE-2026-62387 |
high | 7.1 | 0.0031 | 2026-07-17 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 shipped Access-Control-Allow-Origin | |
CVE-2025-10529 |
medium | 6.5 | 0.0032 | 2025-09-16 | Same-origin policy bypass in the Layout component. This vulnerability was fixed in Firefox 143, Fire | |
CVE-2026-68517 |
medium | 6.5 | 0.0046 | 2026-08-17 | Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins gu | |
CVE-2026-50087 |
medium | 6.1 | 0.0020 | 2026-06-12 | The Aqara IAM/SSO gateway (gw-builder.aqara.com) exhibits a cross-origin request sharing vulnerabili | |
CVE-2026-54753 |
medium | 5.9 | 0.0120 | 2026-06-26 | Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0 | |
CVE-2026-119285 |
medium | 5.9 | — | 2026-10-29 | Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middlew | |
CVE-2026-6662 |
medium | 5.5 | 0.0018 | 2026-04-20 | A vulnerability was found in ericc-ch copilot-api up to 0.7.0. The impacted element is the function | |
CVE-2026-21761 |
medium | 5.4 | 0.0020 | 2026-07-17 | HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper COR | |
CVE-2026-66005 |
medium | 5.3 | 0.0033 | 2026-07-24 | Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its lo | |
CVE-2026-45021 |
medium | 5.1 | 0.0020 | 2026-05-28 | Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs | |
CVE-2026-18676 |
medium | 5.1 | 0.0030 | 2026-08-12 | The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to | |
CVE-2026-115917 |
medium | 4.7 | 0.0024 | 2026-10-26 | vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compa | |
CVE-2026-8537 |
medium | 4.3 | 0.0018 | 2026-05-14 | Insufficient policy enforcement in ViewTransitions in Google Chrome prior to 148.0.7778.168 allowed | |
CVE-2026-8576 |
medium | 4.3 | 0.0015 | 2026-05-14 | Inappropriate implementation in CORS in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 | |
CVE-2026-110737 |
low | 2.3 | 0.0019 | 2026-10-27 | The push endpoint of a Vaadin application that uses server push reflects the request Origin into the | |
CVE-2026-6143 |
low | 2.1 | 0.0019 | 2026-04-13 | A security flaw has been discovered in farion1231 cc-switch up to 3.12.3. Affected by this issue is | |
CVE-2026-7581 |
low | 2.1 | 0.0017 | 2026-05-01 | A security vulnerability has been detected in alexta69 MeTube up to 2026.04.09. This affects the fun | |
CVE-2026-7643 |
low | 2.1 | 0.0016 | 2026-05-02 | A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function of t |