CWE-436 · Input Validation and Logic
Interpretation Conflict
157CVEs
2exploited
0with a public check
1likely (EPSS 10%+)
SortMost likely exploited
157 CVEs with CWE-436 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-63030In CISA KEVExploitedWordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route ConfusionWordPress · WordPress · CVSS 9.8 · 2026-07-17 | 9.8 | 11% | 2026-07-17 |
| CVE-2025-48384In CISA KEVExploitedGit allows arbitrary code execution through broken config quotinggit · git · CVSS 8.1 · 2025-07-08 | 8.1 | 4.5% | 2025-07-08 |
| CVE-2021-28474Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft · Microsoft SharePoint Enterprise Server 2016 · CVSS 8.8 · 2021-05-11 | 8.8 | 51% | 2021-05-11 |
| CVE-2019-17596Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are several attack scenarios, such as tr…Golang · Go · 2019-10-24 | – | 4.7% | 2019-10-24 |
| CVE-2019-5892bgpd in FRRouting FRR (aka Free Range Routing) 2.x and 3.x before 3.0.4, 4.x before 4.0.1, 5.x before 5.0.2, and 6.x before 6.0.2 (not affecting Cumulus Linux or VyOS), when ENABL…Frrouting · Frrouting · 2019-01-10 | – | 2.7% | 2019-01-10 |
| CVE-2022-23773cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is…Golang · Go · 2022-02-11 | – | 2.7% | 2022-02-11 |
| CVE-2019-18792An issue was discovered in Suricata 5.0.0. It is possible to bypass/evade any tcp based signature by overlapping a TCP segment with a fake FIN packet. The fake FIN packet is injec…Oisf · Suricata · 2020-01-06 | – | 2.5% | 2020-01-06 |
| CVE-2023-24813URI validation failure on SVG parsing. Bypass of CVE-2023-23924dompdf · dompdf · CVSS 10 · 2023-02-07 | 10.0 | 2.5% | 2023-02-07 |
| CVE-2021-45327Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. which could let a remote malisious user e…Gitea · Gitea · 2022-02-08 | – | 2.1% | 2022-02-08 |
| CVE-2019-19589The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives. Note: It has been argued that "The vulnerabi…Wp-Pdf · Pdf Embedder · CVSS 9.8 · 2019-12-05 | 9.8 | 1.8% | 2019-12-05 |
| CVE-2020-10180The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects versions before 1294 of Smart Security Premium, Internet Secu…Eset · Cyber Security · 2020-03-05 | – | 1.7% | 2020-03-05 |
| CVE-2020-9342The F-Secure AV parsing engine before 2020-02-05 allows virus-detection bypass via crafted Compression Method data in a GZIP archive. This affects versions before 17.0.605.474 (on…F-Secure · Cloud Protection For Salesforce · 2020-02-22 | – | 1.6% | 2020-02-22 |
| CVE-2023-22602Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP requestApache Software Foundation · Apache Shiro · 2023-01-14 | – | 1.6% | 2023-01-14 |
| CVE-2023-39481Softing Secure Integration Server Interpretation Conflict Remote Code Execution VulnerabilitySofting · Secure Integration Server · CVSS 6.6 · 2024-05-03 | 6.6 | 1.6% | 2024-05-03 |
| CVE-2020-9362The Quick Heal AV parsing engine (November 2019) allows virus-detection bypass via a crafted GPFLAG in a ZIP archive. This affects Total Security, Home Security, Total Security Mu…Quickheal · Antivirus For Server · 2020-02-24 | – | 1.5% | 2020-02-24 |
| CVE-2020-10193ESET Archive Support Module before 1294 allows virus-detection bypass via crafted RAR Compression Information in an archive. This affects versions before 1294 of Smart Security Pr…Eset · Cyber Security · 2020-03-06 | – | 1.4% | 2020-03-06 |
| CVE-2021-39137Consensus flaw during block processing in go-ethereumethereum · go-ethereum · CVSS 6.5 · 2021-08-24 | 6.5 | 1.3% | 2021-08-24 |
| CVE-2022-48279In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-…Owasp · Modsecurity · CVSS 7.5 · 2023-01-20 | 7.5 | 1.2% | 2023-01-20 |
| CVE-2023-29197Improper header name validation in guzzlehttp/psr7guzzle · psr7 · CVSS 5.3 · 2023-04-17 | 5.3 | 1.2% | 2023-04-17 |
| CVE-2020-9264ESET Archive Support Module before 1296 allows virus-detection bypass via a crafted Compression Information Field in a ZIP archive. This affects versions before 1294 of Smart Secu…Eset · Cyber Security · 2020-02-18 | – | 1.2% | 2020-02-18 |
| CVE-2020-9399The Avast AV parsing engine allows virus-detection bypass via a crafted ZIP archive. This affects versions before 12 definitions 200114-0 of Antivirus Pro, Antivirus Pro Plus, and…Avast · Antivirus Pro · 2020-02-28 | – | 1.2% | 2020-02-28 |
| CVE-2022-36051Broken Authorization in ZITADEL Actionszitadel · zitadel · CVSS 8.7 · 2022-08-31 | 8.7 | 1.0% | 2022-08-31 |
| CVE-2020-9363The Sophos AV parsing engine before 2020-01-14 allows virus-detection bypass via a crafted ZIP archive. This affects Endpoint Protection, Cloud Optix, Mobile, Intercept X Endpoint…Sophos · Cloud Optix · 2020-02-24 | – | 1.0% | 2020-02-24 |
| CVE-2026-32052OpenClaw < 2026.2.24 - Hidden Command Execution via Shell-Wrapper Positional argv CarriersOpenClaw · OpenClaw · CVSS 6.4 · 2026-03-21 | 6.4 | 1.0% | 2026-03-21 |
| CVE-2026-25223Fastify's Content-Type header tab character allows body validation bypassfastify · fastify · CVSS 7.5 · 2026-02-03 | 7.5 | 0.9% | 2026-02-03 |
| CVE-2024-28054Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some mail user agents) when there are multiple…No vendor recorded · CVSS 7.4 · 2024-03-18 | 7.4 | 0.8% | 2024-03-18 |
| CVE-2023-30541TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contractsOpenZeppelin · openzeppelin-contracts · CVSS 5.3 · 2023-04-17 | 5.3 | 0.8% | 2023-04-17 |
| CVE-2023-36456Authentik lacks Proxy IP headers validationgoauthentik · authentik · CVSS 8.3 · 2023-07-06 | 8.3 | 0.8% | 2023-07-06 |
| CVE-2026-17084stringprep.map_table_b2() deviates from RFC 3454 Table B.2Python Software Foundation · CPython · CVSS 6 · 2026-08-18 | 6.0 | 0.8% | 2026-08-18 |
| CVE-2023-30536Insecure header validation in slim/psr7slimphp · Slim-Psr7 · CVSS 6.5 · 2023-04-17 | 6.5 | 0.7% | 2023-04-17 |
| CVE-2026-47767Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatchsymfony · symfony · CVSS 8.3 · 2026-07-14 | 8.3 | 0.7% | 2026-07-14 |
| CVE-2026-13676fast-uri vulnerable to host confusion via failed IDN canonicalizationfast-uri · fast-uri · CVSS 7.5 · 2026-06-29 | 7.5 | 0.7% | 2026-06-29 |
| CVE-2026-73614Network-AI ClaudeHookBridge Deny Pattern Bypass via TruncationJovancoding · Network-AI · CVSS 8.8 · 2026-08-13 | 8.8 | 0.7% | 2026-08-13 |
| CVE-2022-29254Failed payment recorded has completed in silverstripe/silverstripe-omnipaysilverstripe · silverstripe-omnipay · CVSS 3.7 · 2022-06-06 | 3.7 | 0.7% | 2022-06-06 |
| CVE-2024-38428url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the…Gnu · Wget · CVSS 9.1 · 2024-06-16 | 9.1 | 0.7% | 2024-06-16 |
| CVE-2022-0011PAN-OS: URL Category Exceptions Match More URLs Than Intended in URL FilteringPalo Alto Networks · PAN-OS · CVSS 6.5 · 2022-02-10 | 6.5 | 0.7% | 2022-02-10 |
| CVE-2026-73615Network-AI SandboxPolicy before 5.15.1 Blocklist Bypass via Quote MismatchJovancoding · Network-AI · CVSS 8.8 · 2026-08-13 | 8.8 | 0.7% | 2026-08-13 |
| CVE-2022-36048IP address leak via image proxy bypass in Zulip Serverzulip · zulip · CVSS 4.3 · 2022-08-31 | 4.3 | 0.6% | 2022-08-31 |
| CVE-2024-24754Bref Body Parsing Inconsistency in Event-Driven Functionsbrefphp · bref · CVSS 3.7 · 2024-02-01 | 3.7 | 0.6% | 2024-02-01 |
| CVE-2026-57580authentik: Account Takeover via SAML NameID Comment Truncationgoauthentik · authentik · CVSS 9.4 · 2026-08-18 | 9.4 | 0.6% | 2026-08-18 |
| CVE-2025-12816CVE-2025-12816Digital Bazaar · node-forge · CVSS 8.6 · 2025-11-25 | 8.6 | 0.6% | 2025-11-25 |
| CVE-2026-104269ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)owasp-modsecurity · ModSecurity · CVSS 8.6 · 2026-11-05 | 8.6 | 0.6% | 2026-11-05 |
| CVE-2026-109429Mistral Vibe < 2.25.4 Bash Permission Bypass via ${var@P} Prompt-Transformmistralai · mistral-vibe · CVSS 8.8 · 2026-10-13 | 8.8 | 0.6% | 2026-10-13 |
| CVE-2024-34478btcd before 0.24.0 does not correctly implement the consensus rules outlined in BIP 68 and BIP 112, making it susceptible to consensus failures. Specifically, it uses the transact…Btcd Project · Btcd · CVSS 7.5 · 2024-05-05 | 7.5 | 0.6% | 2024-05-05 |
| CVE-2026-81378Visual Studio Code Security Feature Bypass VulnerabilityMicrosoft · Visual Studio Code · CVSS 8.2 · 2026-09-08 | 8.2 | 0.5% | 2026-09-08 |
| CVE-2026-67201V 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.httpvlang · v · CVSS 8.6 · 2026-07-29 | 8.6 | 0.5% | 2026-07-29 |
| CVE-2023-40718A interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packets.Fortinet · IPS Engine · CVSS 6.7 · 2023-10-10 | 6.7 | 0.5% | 2023-10-10 |
| CVE-2026-49332Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreamsRed Hat · Red Hat OpenShift Container Platform 4.12 · CVSS 8.5 · 2026-07-28 | 8.5 | 0.5% | 2026-07-28 |
| CVE-2026-85184@fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target@fastify/middie · @fastify/middie · CVSS 9.1 · 2026-09-04 | 9.1 | 0.5% | 2026-09-04 |
| CVE-2026-14198@fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values@fastify/middie · @fastify/middie · CVSS 9.1 · 2026-07-01 | 9.1 | 0.5% | 2026-07-01 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.