CWE-644
65 published CVEs are weaknesses of this kind, as the records or NVD name it.
- Published CVEs
- 65
- Last 12 months
- 33
- Critical
- 4
- Known exploited
- 0
Critical 4High 15Medium 41Low 5Not scored 0
CVEs per yearBy the year they were published
- 20171
- 20201
- 20213
- 20222
- 20234
- 202410
- 202516
- 202628
Newest CVEs
- CVE-2026-110723
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element…
Eclipse Foundation · Eclipse Connected Services Platform
High7.5 - CVE-2026-69183
Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)
monkeytypegame · monkeytype
High7.5 - CVE-2026-67179
Genkit improper host header validation
genkit-ai · genkit
High7.8 - CVE-2026-66778
Multiple vulnerabilities in SAP Business AI Platform (Approuter)
SAP_SE · SAP Business AI Platform (Approuter)
Medium5.3 - CVE-2026-72574
picocms Pico - Host Header Injection Enables Script Source Hijacking
picocms · Pico
Medium6.1 - CVE-2026-0516
A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host header and…
SonicWall · SonicOS
Medium6.5 - CVE-2026-48061
Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header
litestar-org · litestar
Medium5.9 - CVE-2026-21762
Missing HTTP Security Headers in DevOps Loop
HCLSoftware · DevOps Loop
Low3.7 - CVE-2026-54477
Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax
Gardyn · Gardyn Home Firmware
Medium5.1 - CVE-2026-55791
Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs
craftcms · cms
Medium6.9