CWE-173

8 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 0High 2Medium 2Low 4Not scored 0

CVEs per yearBy the year they were published

CVE-2026-103276
Ghost before 6.20.0 File Read via URL Encoding Bypass
TryGhost · Ghost
Medium6.9
CVE-2026-81638
Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry
ash-project · ash_double_entry
Low2.1
CVE-2026-19611
Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding
Red Hat · Red Hat Build of Apache Camel 3.33.3.SP2
High7.4
CVE-2026-10050
Digest authentication lossy encoding
Eclipse Foundation · Eclipse Jetty - EE8
High8.7
CVE-2024-54158
In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding
JetBrains · YouTrack
Low3.5
CVE-2023-26303
markdown-it-py crash on null assertions
Executable Books · markdown-it-py
Low3.3
CVE-2023-26302
markdown-it-py CLI crash on invalid UTF-8 characters
Executable Books · markdown-it-py
Low3.3
CVE-2019-9636
Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization.…
Product not named
Medium5.3