recorded together · two weakness classes
Information Disclosure and Input Validation and Logic
27 CVEs
27 CVEs name a weakness of both Information Disclosure and Input Validation and Logic, fewer than chance alone would give (about 129). The pairing most often behind it is CWE-200 (Information Exposure) with CWE-178 (Improper Handling of Case Sensitivity), in 3 CVEs.
Every dot is a CVE whose record names a weakness from both classes, neither being the other's parent in the CWE hierarchy. The named ones come first: exploited in the wild, then those with a public check, then the likeliest to be.
- CVEs that carry a weakness of both
- 27
- Chance alone would give
- about 129
- So they are recorded together
- less often than chance (0.2×)
A CVE counts when its record names a weakness from each class, neither being the other's parent. It says the two kinds of flaw are recorded together in one vulnerability more or less often than chance: not that one causes the other, and it follows how the people who file CVEs choose CWEs.
How this is weighed, and the sources
Chance is what the two classes' shares of all CVEs that carry weaknesses of two or more classes would give if weaknesses paired at random. A line is drawn on the dial only for pairs with enough CVEs and clearly above chance. Weaknesses are the CWEs the CVE List and NVD record; exploitation is CISA KEV, likelihood is EPSS.
- check available
- 1
Every one of the 27 is a mark on the map. Named now: 1 to 26, most at risk first.
- Mailcow Dockerized Swagger UI - Cross-Site Scripting
- A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A remote, authenticated attacker could exp…
- Nextcloud Talk not properly disassociating users from chats after account deletion
- Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem
- @microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter
- FileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info
- Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)
- Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch
- RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET
- follow-redirects sensitiveHeaders regex escaping can expose credential headers
- NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass
- undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives
- libIEC61850: Remote information disclosure in MMS file service via out-of-range initialPosition in fileOpen followed by fileRead
- Starlette-Admin: Unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS
- undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives
- Mastodon: SSRF protection bypass on older Ruby versions
- Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching
- SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`
- Deleting a collaboration should also delete linked resources
- Formio improperly authorized permission elevation through specially crafted request path
- webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint
- TREK: Public trip share link ignores the `share_map` permission server-side (client-enforced authorization → itinerary/location disclosure)
- The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to…
- An issue was discovered in eProsima FastDDS v.2.14.0 and before, allows a local attacker to cause a denial of service (DoS) and obtain sensitive information via a crafted history_…
- Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion
- Information disclosure, sandbox escape in the Security: Process Sandboxing component
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.