CWE-551 · Access Control
Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
13CVEs
SortMost likely exploited
13 CVEs with CWE-551 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-23924URI validation failure on SVG parsing in Dompdfdompdf · dompdf · CVSS 10 · 2023-01-31 | 10.0 | 3.7% | 2023-01-31 |
| CVE-2021-32777Incorrect concatenation of multiple value request headers in ext-authz extensionenvoyproxy · envoy · CVSS 8.6 · 2021-08-24 | 8.6 | 3.3% | 2021-08-24 |
| CVE-2021-31384Junos OS: SRX Series: Under a specific device configuration an attacker can access the devices J-Web management services from any interface, regardless of security settings protec…Juniper Networks · Junos OS · CVSS 7.2 · 2021-10-19 | 7.2 | 1.2% | 2021-10-19 |
| CVE-2021-32779Incorrectly handling of URI '#fragment' element as part of the path elementenvoyproxy · envoy · CVSS 8.6 · 2021-08-24 | 8.6 | 1.0% | 2021-08-24 |
| CVE-2016-20030ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginActionZKTeco Inc. · ZKTeco ZKBioSecurity · CVSS 9.8 · 2026-03-15 | 9.8 | 0.6% | 2026-03-15 |
| CVE-2026-87743Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http securityRed Hat · Red Hat build of Quarkus 3.27.5.SP2 · CVSS 7.5 · 2026-09-18 | 7.5 | 0.5% | 2026-09-18 |
| CVE-2026-89060Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration referencesRed Hat · Red Hat Advanced Cluster Management for Kubernetes 2.13 · CVSS 7.7 · 2026-09-11 | 7.7 | 0.5% | 2026-09-11 |
| CVE-2026-16102Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappersRed Hat · Red Hat build of Keycloak 26.4 · CVSS 8.1 · 2026-08-05 | 8.1 | 0.5% | 2026-08-05 |
| CVE-2026-15573Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcherRed Hat · Red Hat build of Keycloak 26.4 · CVSS 8.1 · 2026-08-05 | 8.1 | 0.5% | 2026-08-05 |
| CVE-2026-4636Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.Red Hat · Red Hat build of Keycloak 26.2 · CVSS 8.1 · 2026-04-02 | 8.1 | 0.4% | 2026-04-02 |
| CVE-2026-0707Keycloak: keycloak authorization header parsing leading to potential security control bypassRed Hat · Red Hat build of Keycloak 26.4 · CVSS 5.3 · 2026-01-08 | 5.3 | 0.4% | 2026-01-08 |
| CVE-2026-57920Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} endpoints.Peplink · InControl · CVSS 7.7 · 2026-06-26 | 7.7 | 0.4% | 2026-06-26 |
| CVE-2026-106579ImageMagick: Policy Bypass when using coder as the domain.ImageMagick · ImageMagick · CVSS 6.2 · 2026-10-07 | 6.2 | 0.3% | 2026-10-07 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.