CWE-647
16 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.
- Published CVEs
- 16
- Last 12 months
- 13
- Critical
- 0
- Known exploited
- 1
Critical 0High 6Medium 7Low 3Not scored 0
CVEs per yearBy the year they were published
- 20231
- 20254
- 202611
Known exploitedNewest addition to KEV first
- CVE-2022-43939
Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions
Hitachi Vantara · Pentaho Business Analytics Server
ExploitedHigh8.6
Newest CVEs
- CVE-2026-76530
Use of Non-Canonical URL Paths for Authorization Decisions in Splunk SOAR
Splunk · Splunk SOAR
High8.8 - CVE-2026-94269
Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch
Apache Software Foundation · Apache APISIX
Medium6.3 - CVE-2026-71178
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions…
Dell · Secure Connect Gateway (SCG) Policy Manager
Low3.7 - CVE-2026-73551
Envoy: Path normalization does not handle dot and dotdot segments with parameters
envoyproxy · envoy
Medium5.3 - CVE-2026-80515
In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whether to apply its…
Eclipse Foundation · Eclipse Arrowhead
High8.9 - CVE-2026-15970
L7 intention authorization bypass via custom public listener
HashiCorp · Consul
Medium4.2 - CVE-2026-62685
File Browser: Colliding username normalization gives two users the same home directory
filebrowser · filebrowser
High8.1 - CVE-2026-8384
In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected:…
Eclipse Foundation · Eclipse Jetty
Medium5.3 - CVE-2026-59731
Astro 6.4.7 Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch
withastro · astro
High8.2 - CVE-2026-5222
Cargo can be coerced to share credentials between registries
Rust · Cargo
Low2.3