CWE-41

CVEs per yearBy the year they were published

1. 20221
2. 20231
3. 20244
4. 202515
5. 202621

Newest CVEs

• CVE-2026-119200

  Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

  nuxt · nuxt

  Medium6.5
• CVE-2026-112343

  Syncplify Server! < 8.8.0 Permission Override Bypass via Path Casing

  Syncplify, Inc. · Syncplify Server!

  High8.6
• CVE-2026-110725

  fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

  fast-uri · fast-uri

  Low3.7
• CVE-2026-110095

  fast-uri vulnerable to improper path equivalence in relative reference normalization

  fast-uri · fast-uri

  Low3.7
• CVE-2026-108463

  Windows SmartScreen Security Feature Bypass Vulnerability

  Microsoft · Windows 11 Version 24H2

  High8.8
• CVE-2026-102217

  WebDAV Elevation of Privilege Vulnerability

  Microsoft · Windows 10 Version 1607

  High8.8
• CVE-2026-70184

  Windows Backup Engine Elevation of Privilege Vulnerability

  Microsoft · Windows 10 Version 21H2

  High7.8
• CVE-2026-88136

  Web Distributed Authoring and Versioning (WEBDAV) Remote Code Execution Vulnerability

  Microsoft · Windows 10 Version 1607

  High8.8
• CVE-2026-102231

  Visual Studio Code Security Feature Bypass Vulnerability

  Microsoft · Visual Studio Code

  High7.7
• CVE-2026-93709

  Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler

  Dancer2

  Medium5.3

Vendors it comes up for most

1. Microsoft19
2. fast-uri2
3. @nuxt1
4. Apple1
5. Byron1
6. Fortinet1
7. GitLab1
8. Huawei1
9. IBM1
10. OpenClaw1