CWE-488

57 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 6High 22Medium 26Low 2Not scored 1

CVEs per yearBy the year they were published

CVE-2026-122233
FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode
php · frankenphp
Medium6.3
CVE-2026-121966
Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak
traefik · traefik
High7.0
CVE-2026-120634
CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer
CGI
Not scored
CVE-2026-115419
Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server
AWS · strands-agents
High8.6
CVE-2026-114637
Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak
traefik · traefik
High7.0
CVE-2026-112921
Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request
Robots-Validate
High7.3
CVE-2026-107929
local interface connection reuse mixup
curl · curl
High8.1
CVE-2026-86411
FTP connection reuse inherits client-certificate
curl · curl
Critical9.1
CVE-2026-85296
Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State
Apache Software Foundation · Apache Camel
Medium6.5
CVE-2026-85245
Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target
Apache Software Foundation · Apache Camel
Medium5.9