CWE-155
19 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 19Published CVEs19 of them scored
- 5Last 12 monthspublished in the last year
- 1Critical5 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-85724
Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass
moquette-io · moquette
Critical9.6 - CVE-2026-87016
Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite
open-webui · open-webui
High8.1 - CVE-2026-68939
Pyenv: Glob/wildcard metacharacters bypass is_version_safe(), causing silent version/interpreter substitution via unquoted expansion (CVE-2022-35861 residual)
pyenv · pyenv
Low2.0 - CVE-2026-73412
Shescape: Path disclosure on Unix with Zsh
ericcornelissen · shescape
Medium6.3 - CVE-2026-49482
ClipBucket: SQL Wildcard Injection in Subtitle Edit Endpoint Allows Mass Subtitle Overwrite
MacWarrior · clipbucket-v5
Medium4.3 - CVE-2025-11757
Improper Neutralization of Wildcards or Matching Symbols in CloudEdge Online Cameras and App
CloudEdge · CloudEdge App
High8.7 - CVE-2025-4232
GlobalProtect: Authenticated Code Injection Through Wildcard on macOS
Palo Alto Networks · GlobalProtect App
High8.5 - CVE-2025-27515
Laravel has a File Validation Bypass
laravel · framework
Medium6.9 - CVE-2025-0681
New Rock Technologies Cloud Connected Devices Improper Neutralization of Wildcards or Matching Symbols
New Rock Technologies · OM500 IP-PBX
Medium6.9 - CVE-2025-24376
The kubewarden-controller AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resources
kubewarden · kubewarden-controller
Medium6.5