CWE-1289

CVEs per yearBy the year they were published

1. 20221
2. 20245
3. 20251
4. 202645

Known exploitedNewest addition to KEV first

• CVE-2026-48710

  Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

  Kludex · starlette

  ExploitedMedium6.5

Newest CVEs

• CVE-2026-116870

  In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably…

  Octopus Deploy · Octopus Server

  High8.7
• CVE-2026-116197

  Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection

  edgelesssys · contrast

  Low2.1
• CVE-2026-114348

  webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint

  webpack-dev-server · webpack-dev-server

  Medium5.3
• CVE-2026-107289

  Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifier (incomplete fix for CVE-2026-46678 and CVE-2026-48782)

  pydantic · pydantic-ai

  Medium6.8
• CVE-2026-107288

  Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differently

  pydantic · pydantic-ai

  Low3.7
• CVE-2026-102478

  In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in…

  Octopus Deploy · Octopus Server

  High8.7
• CVE-2026-106445

  Handlebars: JavaScript Injection via Own Property Check Bypass

  handlebars-lang · handlebars.js

  Critical9.2
• CVE-2026-105048

  The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private IP addresses).

  Zilliz · Attu

  Medium4.0
• CVE-2026-100255

  In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset

  JetBrains · TeamCity

  High8.1
• CVE-2026-97196

  WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability

  Liquid Web / StellarWP · GiveWP

  Critical9.1

Vendors it comes up for most

1. AWS2
2. Go standard library2
3. Octopus Deploy2
4. RRWO2
5. STIGTSP2
6. edgelesssys2
7. pydantic2
8. squid-cache2
9. Aqara1
10. Devolutions1