CWE-187 · weakness in Input Validation and Logic
Partial String Comparison
21 CVEs
Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- likely to be exploited
- 1
Every one of the 21 is a mark on the map. Named now: 1 to 21, most at risk first.
- Moby authz zero length regression
- Partial string comparison in CODESYS gateway server
- IBM MQ Container authentication bypass
- CVE-2025-12977
- Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
- Windows HTTP Protocol Stack Tampering Vulnerability
- 666ghj BettaFish InsightEngine search-result Deduplication agent.py _deduplicate_results partial string comparison
- An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1.…
- SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching
- view_component: System Test Entry Point Path Check Allows Sibling Directory Escape
- CVE-2025-12978
- Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching
- Partial String Comparison Vulnerability in HiRDB
- http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
- Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation
- OpenWrt procd PATH Environment Variable Filter Bypass via Incorrect String Comparison Leads to Privilege Escalation
- Tinyproxy through 1.11.3 Hostname ACL Allow-List Bypass via Suffix Match
- A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions <…
- @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches
- Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
- Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability. A low privileged attacker with local access could potentially…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.