CWE-155

CVEs per yearBy the year they were published

1. 20191
2. 20201
3. 20221
4. 20245
5. 20256
6. 20265

Newest CVEs

• CVE-2026-85724

  Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass

  moquette-io · moquette

  Critical9.6
• CVE-2026-87016

  Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

  open-webui · open-webui

  High8.1
• CVE-2026-68939

  Pyenv: Glob/wildcard metacharacters bypass is_version_safe(), causing silent version/interpreter substitution via unquoted expansion (CVE-2022-35861 residual)

  pyenv · pyenv

  Low2.0
• CVE-2026-73412

  Shescape: Path disclosure on Unix with Zsh

  ericcornelissen · shescape

  Medium6.3
• CVE-2026-49482

  ClipBucket: SQL Wildcard Injection in Subtitle Edit Endpoint Allows Mass Subtitle Overwrite

  MacWarrior · clipbucket-v5

  Medium4.3
• CVE-2025-11757

  Improper Neutralization of Wildcards or Matching Symbols in CloudEdge Online Cameras and App

  CloudEdge · CloudEdge App

  High8.7
• CVE-2025-4232

  GlobalProtect: Authenticated Code Injection Through Wildcard on macOS

  Palo Alto Networks · GlobalProtect App

  High8.5
• CVE-2025-27515

  Laravel has a File Validation Bypass

  laravel · framework

  Medium6.9
• CVE-2025-0681

  New Rock Technologies Cloud Connected Devices Improper Neutralization of Wildcards or Matching Symbols

  New Rock Technologies · OM500 IP-PBX

  Medium6.9
• CVE-2025-24376

  The kubewarden-controller AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resources

  kubewarden · kubewarden-controller

  Medium6.5

Vendors it comes up for most

1. Axis Communications AB3
2. Palo Alto Networks3
3. CloudEdge1
4. MacWarrior1
5. New Rock Technologies1
6. OTRS AG1
7. Ruijie1
8. Spring1
9. authzed1
10. ericcornelissen1