CWE-177

19 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

Critical 3High 8Medium 6Low 2Not scored 0

CVEs per yearBy the year they were published

CVE-2026-76504
Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
Cisco · Cisco Catalyst SD-WAN Manager
ExploitedCritical9.8

CVE-2026-118650
Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path
labstack · echo
High7.5
CVE-2026-100409
OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths
opennextjs · opennextjs-cloudflare
High7.5
CVE-2026-76504
Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
Cisco · Cisco Catalyst SD-WAN Manager
ExploitedCritical9.8
CVE-2026-96748
Connection redirection via percent-encoded delimiter injection in connection string hosts
MongoDB · Python Driver
High8.3
CVE-2026-76172
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
fast-uri · fast-uri
High7.5
CVE-2026-67448
Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)
axllent · mailpit
Medium6.5
CVE-2026-15371
Velociraptor Stored XSS in URL column types
Rapid7 · Velociraptor
High8.1
CVE-2026-59083
Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass
Apache Software Foundation · Apache Tomcat
Critical9.1
CVE-2026-41041
Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints.
Apache Software Foundation · Apache Gravitino
Critical9.1
CVE-2026-6414
@fastify/static vulnerable to route guard bypass via encoded path separators
@fastify/static · @fastify/static
Medium5.9