CWE-187 · Input Validation and Logic
Partial String Comparison
21CVEs
SortMost likely exploited
21 CVEs with CWE-187 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-41110Moby authz zero length regressionmoby · moby · CVSS 10 · 2024-07-24 | 10.0 | 16% | 2024-07-24 |
| CVE-2022-31802Partial string comparison in CODESYS gateway serverCODESYS · CODESYS Gateway Server V2 · CVSS 9.8 · 2022-06-24 | 9.8 | 1.4% | 2022-06-24 |
| CVE-2024-39742IBM MQ Container authentication bypassIBM · MQ Operator · CVSS 8.1 · 2024-07-08 | 8.1 | 0.8% | 2024-07-08 |
| CVE-2025-12977CVE-2025-12977FluentBit · Fluent Bit · CVSS 9.1 · 2025-11-24 | 9.1 | 0.8% | 2025-11-24 |
| CVE-2026-84376Astro: Authorization bypass from missing path-segment boundary check when stripping the configured basewithastro · astro · CVSS 6.3 · 2026-09-02 | 6.3 | 0.7% | 2026-09-02 |
| CVE-2026-62750Windows HTTP Protocol Stack Tampering VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 6.5 · 2026-08-11 | 6.5 | 0.7% | 2026-08-11 |
| CVE-2026-14687666ghj BettaFish InsightEngine search-result Deduplication agent.py _deduplicate_results partial string comparison666ghj · BettaFish · CVSS 5.3 · 2026-07-05 | 5.3 | 0.5% | 2026-07-05 |
| CVE-2026-94576An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1.…Brocade · Fabric OS · CVSS 5.9 · 2026-10-08 | 5.9 | 0.4% | 2026-10-08 |
| CVE-2026-112266SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matchingsgl-project · sglang · CVSS 5.9 · 2026-10-19 | 5.9 | 0.4% | 2026-10-19 |
| CVE-2026-44837view_component: System Test Entry Point Path Check Allows Sibling Directory EscapeViewComponent · view_component · CVSS 5.9 · 2026-05-26 | 5.9 | 0.4% | 2026-05-26 |
| CVE-2025-12978CVE-2025-12978FluentBit · Fluent Bit · CVSS 5.4 · 2025-11-24 | 5.4 | 0.4% | 2025-11-24 |
| CVE-2026-34785Rack: Local file inclusion in `Rack::Static` via URL Prefix Matchingrack · rack · CVSS 7.5 · 2026-04-02 | 7.5 | 0.4% | 2026-04-02 |
| CVE-2026-115646Partial String Comparison Vulnerability in HiRDBHitachi · HiRDB Server Version 10 · CVSS 9.8 · 2026-11-10 | 9.8 | 0.4% | 2026-11-10 |
| CVE-2026-55602http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypasschimurai · http-proxy-middleware · CVSS 6.9 · 2026-06-22 | 6.9 | 0.4% | 2026-06-22 |
| CVE-2026-87853Sssd: sssd: idp authentication prefix comparison allows cross-user impersonationRed Hat · Red Hat Enterprise Linux 10 · CVSS 7.5 · 2026-09-09 | 7.5 | 0.3% | 2026-09-09 |
| CVE-2026-30874OpenWrt procd PATH Environment Variable Filter Bypass via Incorrect String Comparison Leads to Privilege Escalationopenwrt · openwrt · CVSS 1.8 · 2026-03-19 | 1.8 | 0.3% | 2026-03-19 |
| CVE-2026-125371Tinyproxy through 1.11.3 Hostname ACL Allow-List Bypass via Suffix Matchtinyproxy · tinyproxy · CVSS 4.8 · 2026-11-09 | 4.8 | 0.3% | 2026-11-09 |
| CVE-2025-23384A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions <…Siemens · RUGGEDCOM RM1224 LTE(4G) EU · CVSS 3.7 · 2025-03-11 | 3.7 | 0.3% | 2025-03-11 |
| CVE-2026-101914@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matchesgrpc · grpc-node · CVSS 6.5 · 2026-09-28 | 6.5 | 0.3% | 2026-09-28 |
| CVE-2026-45692Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalizationcaddyserver · caddy · CVSS 5.4 · 2026-06-23 | 5.4 | 0.2% | 2026-06-23 |
| CVE-2026-81479Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability. A low privileged attacker with local access could potentially…Dell · OpenManage Server Administrator Managed Node (Patch) for Windows · CVSS 5.8 · 2026-09-17 | 5.8 | 0.2% | 2026-09-17 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.