CWE-551
28 published CVEs are weaknesses of this kind, as the records or NVD name it.
- Published CVEs
- 28
- Last 12 months
- 21
- Critical
- 3
- Known exploited
- 0
Critical 3High 21Medium 4Low 0Not scored 0
CVEs per yearBy the year they were published
- 20216
- 20231
- 202621
Newest CVEs
- CVE-2026-106579
ImageMagick: Policy Bypass when using coder as the domain.
ImageMagick · ImageMagick
Medium6.2 - CVE-2026-87743
Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security
Red Hat · Red Hat build of Quarkus 3.27.5.SP2
High7.5 - CVE-2026-89060
Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references
multicluster-observability-addon
High7.7 - CVE-2026-16102
Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers
Red Hat · Red Hat build of Keycloak 26.4
High8.1 - CVE-2026-15573
Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
Red Hat · Red Hat build of Keycloak 26.4
High8.1 - CVE-2026-13676
fast-uri vulnerable to host confusion via failed IDN canonicalization
fast-uri · fast-uri
High7.5 - CVE-2026-57920
Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} endpoints.
Peplink · InControl
High7.7 - CVE-2026-50559
Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities
quarkusio · quarkus
High7.5 - CVE-2026-45832
All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass…
Chroma · ChromaDB
High8.8 - CVE-2026-44574
Next.js: Middleware / Proxy bypass through dynamic route parameter injection
vercel · next.js
High8.1