CWE-180 · weakness in Input Validation and Logic
Incorrect Behavior Order: Validate Before Canonicalize
44 CVEs
Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- check available
- 1
Every one of the 44 is a mark on the map. Named now: 1 to 26, most at risk first.
- Vite Dev Server - Directory Traversal
- A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which…
- A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests…
- Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
- A directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9. By appending %3F.php to the URI of the /client/index.php endpoint, an attacker can…
- NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
- The cohttp package before 6.3.0 for OCaml allows directory traversal.
- Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory t…
- FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files
- Caddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport
- cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalize
- PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the string" i…
- n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook
- Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce
- ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass
- ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete
- CSS sanitizer bypass in Pentestify report themes allows forced outbound requests
- Guzzle: Noncanonical host can bypass host-based checks
- @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths
- Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Path Traversal via Image Insert Tag
- Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses
- AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization
- Vite: `server.fs.deny` bypassed with queries
- Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization
- Loofah: CSS url() sanitization bypass via escaped parentheses
- CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.