CWE-180 · Input Validation and Logic
Incorrect Behavior Order: Validate Before Canonicalize
44CVEs
SortMost likely exploited
44 CVEs with CWE-180 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-39364CheckVite Dev Server - Directory Traversalvitejs · vite · CVSS 7.5 · 2026-04-07 | 7.5 | 2.3% | 2026-04-07 |
| CVE-2022-26136A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which…Atlassian · Bamboo Server · CVSS 9.8 · 2022-07-20 | 9.8 | 5.7% | 2022-07-20 |
| CVE-2022-26137A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests…Atlassian · Bamboo Server · CVSS 8.8 · 2022-07-20 | 8.8 | 2.4% | 2022-07-20 |
| CVE-2024-24790Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netipGo standard library · net/netip · CVSS 9.8 · 2024-06-05 | 9.8 | 2.0% | 2024-06-05 |
| CVE-2025-43716A directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9. By appending %3F.php to the URI of the /client/index.php endpoint, an attacker can…Ivanti · LANDesk Management Suite · CVSS 5.8 · 2025-04-23 | 5.8 | 1.5% | 2025-04-23 |
| CVE-2026-73420NextAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypassnextauthjs · next-auth · CVSS 9.1 · 2026-08-13 | 9.1 | 0.7% | 2026-08-13 |
| CVE-2026-82481The cohttp package before 6.3.0 for OCaml allows directory traversal.mirage · cohttp · CVSS 8.7 · 2026-08-29 | 8.7 | 0.7% | 2026-08-29 |
| CVE-2026-100230Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory t…input-leap · Input Leap · CVSS 5.3 · 2026-09-25 | 5.3 | 0.7% | 2026-09-25 |
| CVE-2026-24895FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary filesphp · frankenphp · CVSS 8.9 · 2026-02-12 | 8.9 | 0.6% | 2026-02-12 |
| CVE-2026-27590Caddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transportcaddyserver · caddy · CVSS 8.9 · 2026-02-24 | 8.9 | 0.6% | 2026-02-24 |
| CVE-2026-90813cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalizecosmicstack-labs · mercury-agent · CVSS 4.3 · 2026-09-14 | 4.3 | 0.6% | 2026-09-14 |
| CVE-2026-105050PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the string" i…PeaZip · PeaZip · CVSS 7.1 · 2026-10-02 | 7.1 | 0.5% | 2026-10-02 |
| CVE-2026-110846n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhookn8n-io · n8n · CVSS 7 · 2026-10-14 | 7.0 | 0.5% | 2026-10-14 |
| CVE-2026-92899Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the NonceApache Software Foundation · Apache WSS4J · CVSS 4.8 · 2026-09-30 | 4.8 | 0.5% | 2026-09-30 |
| CVE-2026-52747ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypassowasp-modsecurity · ModSecurity · CVSS 8.6 · 2026-07-10 | 8.6 | 0.5% | 2026-07-10 |
| CVE-2026-112003ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/DeleteProjectSend · ProjectSend · CVSS 5.9 · 2026-10-18 | 5.9 | 0.4% | 2026-10-18 |
| CVE-2026-76203CSS sanitizer bypass in Pentestify report themes allows forced outbound requestsmaalfer · Pentestify · CVSS 5.1 · 2026-08-19 | 5.1 | 0.4% | 2026-08-19 |
| CVE-2026-69246Guzzle: Noncanonical host can bypass host-based checksguzzle · guzzle · CVSS 7.2 · 2026-08-03 | 7.2 | 0.4% | 2026-08-03 |
| CVE-2026-7120@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths@fastify/static · @fastify/static · CVSS 5.3 · 2026-07-23 | 5.3 | 0.4% | 2026-07-23 |
| CVE-2026-126663Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Path Traversal via Image Insert TagContao · Contao · CVSS 4.3 · 2026-11-11 | 4.3 | 0.4% | 2026-11-11 |
| CVE-2026-39409Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresseshonojs · hono · CVSS 6.3 · 2026-04-08 | 6.3 | 0.3% | 2026-04-08 |
| CVE-2026-72917AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalizationMintplex-Labs · anything-llm · CVSS 5.9 · 2026-08-10 | 5.9 | 0.3% | 2026-08-10 |
| CVE-2026-118662Vite: `server.fs.deny` bypassed with queriesvitejs · vite · CVSS 6.9 · 2026-10-28 | 6.9 | 0.3% | 2026-10-28 |
| CVE-2026-93630Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname CanonicalizationZimbra · Zimbra Collaboration Suite · CVSS 4.3 · 2026-10-23 | 4.3 | 0.3% | 2026-10-23 |
| CVE-2026-126207Loofah: CSS url() sanitization bypass via escaped parenthesesflavorjones · loofah · CVSS 4.7 · 2026-11-12 | 4.7 | 0.3% | 2026-11-12 |
| CVE-2026-120638CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirectCGI · CVSS 6.1 · 2026-11-03 | 6.1 | 0.3% | 2026-11-03 |
| CVE-2026-79300SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can create a second OTP access capability. SE…SEP · sesam · CVSS 3.5 · 2026-09-12 | 3.5 | 0.3% | 2026-09-12 |
| CVE-2026-125110Rack: Rack::Static header_rules bypass via dot-segment normalization mismatchrack · rack · CVSS 5.3 · 2026-11-09 | 5.3 | 0.3% | 2026-11-09 |
| CVE-2026-93326Crafted Git build source can bypass certain policy validationmoby · BuildKit · CVSS 6 · 2026-10-05 | 6.0 | 0.2% | 2026-10-05 |
| CVE-2026-123851In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded charactersJetBrains · Junie GitHub Action · CVSS 5.4 · 2026-11-06 | 5.4 | 0.2% | 2026-11-06 |
| CVE-2026-100674stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitizationstoatchat · stoatchat · CVSS 4.3 · 2026-09-26 | 4.3 | 0.2% | 2026-09-26 |
| CVE-2026-97764django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker can leverage the handling of diacritic…allauth · django-allauth · CVSS 3.7 · 2026-09-25 | 3.7 | 0.2% | 2026-09-25 |
| CVE-2026-102269PyJWT: Non-canonical signature segments enable raw-token revocation bypassjpadilla · pyjwt · CVSS 4.8 · 2026-09-28 | 4.8 | 0.2% | 2026-09-28 |
| CVE-2026-48721Warp: Env-var prefixes can lead to denylisted command autoexecutionwarpdotdev · warp · CVSS 8.6 · 2026-06-24 | 8.6 | 0.2% | 2026-06-24 |
| CVE-2026-34475Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to ca…varnish-software · Varnish Cache · CVSS 5.4 · 2026-03-27 | 5.4 | 0.2% | 2026-03-27 |
| CVE-2026-126837Attacker able to redirect a client's database traffic to a host they control via special characters in an SRV target, bypassing the SRV parent-domain guardMongoDB · Node.js Driver · CVSS 7.4 · 2026-11-12 | 7.4 | 0.2% | 2026-11-12 |
| CVE-2026-34786Rack: Rack::Static header_rules bypass via URL-encoded pathsrack · rack · CVSS 5.3 · 2026-04-02 | 5.3 | 0.2% | 2026-04-02 |
| CVE-2026-69245Guzzle: Noncanonical cookie domain keeps subdomain scopeguzzle · guzzle · CVSS 6.5 · 2026-08-03 | 6.5 | 0.2% | 2026-08-03 |
| CVE-2026-82736Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypassash-project · ash · CVSS 2.1 · 2026-09-01 | 2.1 | 0.2% | 2026-09-01 |
| CVE-2026-42462Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuringfedify-dev · fedify · CVSS 7 · 2026-06-10 | 7.0 | 0.2% | 2026-06-10 |
| CVE-2025-33194NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause improper processing of input data. A successful exploit of this vulnerability might…NVIDIA · DGX Spark · CVSS 5.7 · 2025-11-25 | 5.7 | 0.2% | 2025-11-25 |
| CVE-2026-45022go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Gitgo-git · go-git · CVSS 7 · 2026-05-27 | 7.0 | 0.2% | 2026-05-27 |
| CVE-2024-28607The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via a falsy isPrivate re…librasean · IP-Utils · CVSS 2.9 · 2025-03-11 | 2.9 | 0.1% | 2025-03-11 |
| CVE-2026-100547OpenClaw before 2026.8.1 Authentication Bypass via File URLOpenClaw · OpenClaw · CVSS 5.5 · 2026-09-26 | 5.5 | 0.1% | 2026-09-26 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.