CWE-180

CVEs per yearBy the year they were published

1. 20222
2. 20254
3. 202640

Newest CVEs

• CVE-2026-120638

  CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect

  CGI

  Not scored
• CVE-2026-118662

  Vite: `server.fs.deny` bypassed with queries

  vitejs · vite

  Medium6.9
• CVE-2026-114622

  baserCMS: Encoded path traversal bypass in the theme file API

  baserproject · basercms

  High7.2
• CVE-2026-93630

  Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization

  Zimbra · Zimbra Collaboration Suite

  Medium4.3
• CVE-2026-110306

  fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

  fast-uri · fast-uri

  Medium6.1
• CVE-2026-112003

  ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete

  ProjectSend · ProjectSend

  Medium6.0
• CVE-2026-100409

  OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

  opennextjs · opennextjs-cloudflare

  High7.5
• CVE-2026-110846

  n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook

  n8n-io · n8n

  High7.0
• CVE-2026-93326

  Crafted Git build source can bypass certain policy validation

  moby · BuildKit

  Medium6.0
• CVE-2026-105050

  PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already…

  PeaZip · PeaZip

  High7.1

Vendors it comes up for most

1. Atlassian2
2. guzzle2
3. vitejs2
4. @auth1
5. @fastify/static1
6. Eclipse Foundation1
7. Ivanti1
8. Mintplex-Labs1
9. NVIDIA1
10. OpenClaw1