CWE-185

CVEs per yearBy the year they were published

1. 20152
2. 20187
3. 20194
4. 20204
5. 20213
6. 20243
7. 20252
8. 202621

Newest CVEs

• CVE-2026-114653

  Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder

  MongoDB · C# Driver

  High7.1
• CVE-2026-111755

  follow-redirects sensitiveHeaders regex escaping can expose credential headers

  follow-redirects · follow-redirects

  High8.2
• CVE-2026-111057

  Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

  mljar · mercury

  Critical10.0
• CVE-2026-54506

  Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field

  givanz · Vvveb

  High7.6
• CVE-2026-88021

  Consul vulnerable to an authorization bypass in the Connect service mesh

  HashiCorp · Consul

  High7.5
• CVE-2026-73425

  @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped

  withastro · astro

  Low3.7
• CVE-2026-64655

  GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching

  cli · cli

  Low2.1
• CVE-2026-45065

  Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection

  symfony · symfony

  Low2.3
• CVE-2026-56021

  Webmin information disclosure via regex pattern

  Webmin · Webmin

  Medium6.9
• CVE-2026-47674

  Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

  honojs · hono

  Medium5.3

Vendors it comes up for most

1. Cisco2
2. HackerOne2
3. honojs2
4. Bitdefender1
5. Budibase1
6. Elastic1
7. GitHub1
8. HashiCorp1
9. LDAPAccountManager1
10. MongoDB1