CWE-179

9 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 0High 5Medium 3Low 1Not scored 0

CVEs per yearBy the year they were published

CVE-2026-84177
Apache Wicket: A component's markup is served as a package resource when its class name contains an underscore
Apache Software Foundation · Apache Wicket
Medium6.3
CVE-2026-90813
cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalize
cosmicstack-labs · mercury-agent
Medium5.3
CVE-2026-49414
ASLR bypass for setuid executables via procctl(2)
FreeBSD · FreeBSD
High7.8
CVE-2026-3832
Gnutls: gnutls: security bypass allows acceptance of revoked server certificates via crafted ocsp response
gnutls
Low3.7
CVE-2026-32305
Traefik mTLS bypass via fragmented ClientHello SNI extraction failure
traefik · traefik
High7.8
CVE-2026-25223
Fastify's Content-Type header tab character allows body validation bypass
fastify · fastify
High7.5
CVE-2025-4759
Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package…
lockfile-lint-api
Medium6.9
CVE-2024-41686
Password Policy Bypass Vulnerability
SyroTech · SyroTech SY-GPON-1110-WDONT router
High7.3
CVE-2022-1271
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted…
gzip, xz-utils
High8.8