CWE-176

43 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

Critical 4High 12Medium 22Low 4Not scored 1

CVEs per yearBy the year they were published

CVE-2024-43093
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due…
Google · Android
ExploitedHigh7.3

CVE-2026-62374
SD JWT JS: Tampered disclosures silently dropped instead of rejected
openwallet-foundation · @sd-jwt/core
High7.1
CVE-2026-116542
Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding
netty · netty-tcnative
Medium6.9
CVE-2026-114114
Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters
vyperlang · vyper
Medium6.0
CVE-2026-110687
Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp
Cpanel-JSON-XS
High7.5
CVE-2026-110674
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv
Cpanel-JSON-XS
Medium6.5
CVE-2026-89074
MOVEit Transfer Email MFA Bypass
Progress · MOVEit Transfer
High7.5
CVE-2026-105241
Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch
Apache Software Foundation · Apache log4net
Medium5.3
CVE-2026-19954
Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names
Net-Whois-Raw
Medium5.4
CVE-2026-86105
Fireware OS Improper Authorization in Access Portal Reverse Proxy
WatchGuard · Fireware OS
Medium5.3
CVE-2026-93990
Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate
libexpat · libexpat
High8.7