CWE-159

13 published CVEs are weaknesses of this kind, as the records or NVD name it.

Newest CVEs

CVE-2026-35536
In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked…
tornadoweb · Tornado
High7.2
CVE-2026-29106
SuiteCRM has blind XSS in return_id parameter
SuiteCRM · SuiteCRM
Medium5.9
CVE-2026-2636
Denial of Service in Microsoft OS
Microsoft · Windows OS
Medium5.5
CVE-2025-61984
ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution…
OpenBSD · OpenSSH
Low3.6
CVE-2025-52884
risc0-ethereum-contracts allows invalid commitment with digest value of zero to be accepted by Steel.validateCommitment
risc0 · risc0-ethereum
Low1.7
CVE-2024-51500
Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware
meshtastic · firmware
Medium5.3
CVE-2021-21707
Special characters break path parsing in XML functions
PHP Group · PHP
Medium5.3
CVE-2021-42375
An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell…
busybox · busybox
Medium5.5
CVE-2020-29022
Host Header Injection allowing web cache poisoning attacks
Secomea · GateManager
Medium5.3
CVE-2020-1653
Junos OS: Kernel crash (vmcore) or FPC crash due to mbuf leak
Juniper Networks · Junos OS
High7.5