By weakness (CWE)

CWE-284: related vulnerabilities

CVEs classified under CWE-284. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

205 published vulnerabilities · page 3 of 3

• CVE-2026-45266LOW 3.5

  A flaw in Nextcloud allows any authenticated user to remotely mute other participants' microphones during calls, but only when the deployment lacks a High-performance Backend configuration. This is a low-severity integrity issue that affects call participants' ability to communicate via audio.

• CVE-2026-11459LOW 3.3

  SecureAge CatchPulse versions up to 10.9.3 contain a vulnerability in the saappctl.sys driver that can leak sensitive information to authenticated local users. An attacker with a valid local account on the affected system can trigger the IOCTL handler to access data they shouldn't normally see. The vulnerability has been publicly disclosed and active exploitation is possible, though it requires legitimate access to the target machine.

• CVE-2026-11464LOW 3.1

  JeecgBoot versions up to 3.9.2 contain a vulnerability in the User List Endpoint that allows authenticated users to disclose sensitive information by manipulating a salt parameter. An attacker with valid credentials can exploit this flaw to access restricted data, though doing so requires specific conditions and technical knowledge. A fix is planned for a future release.

• CVE-2026-45154LOW 2.6

  Nextcloud, an open-source content collaboration platform, contains a flaw affecting versions 2.6.0 through 4.2.x that allows guest users to retrieve deleted collaborative pages from the trash when the parent collective is shared in view-only mode. An attacker with guest access could circumvent intended deletion by directly accessing removed content, though the exposure is limited to information disclosure and requires prior access to the shared collective. The vulnerability has been resolved in version 4.3.0.

• CVE-2026-48617LOW 1.8

  Node.js versions 22, 24, and 26 contain a flaw in how they enforce the Permission Model security feature. Specifically, the `process.report.writeReport()` function does not properly validate file paths, allowing an authenticated local attacker with high privileges to bypass the intended security boundary. The risk is limited to integrity impact in this case, though the vulnerability could expose sensitive information under certain configurations. This is a low-severity issue that requires local access and user interaction to exploit.