CWE-180
51 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 51Published CVEs51 of them scored
- 46Last 12 monthspublished in the last year
- 3Critical17 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-126663
Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Path Traversal via Image Insert Tag
Contao · Contao
Medium5.3 - CVE-2026-125110
Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch
rack · rack
Medium5.3 - CVE-2026-61812
ModSecurity: HTML decoder missing entities, leading to evasion
owasp-modsecurity · ModSecurity
Medium6.3 - CVE-2026-123851
In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters
JetBrains · Junie GitHub Action
Medium5.4 - CVE-2026-120638
CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect
CGI
Medium6.1 - CVE-2026-118662
Vite: `server.fs.deny` bypassed with queries
vitejs · vite
Medium6.9 - CVE-2026-114622
baserCMS: Encoded path traversal bypass in the theme file API
baserproject · basercms
High7.2 - CVE-2026-93630
Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization
Zimbra · Zimbra Collaboration Suite
Medium4.3 - CVE-2026-110306
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
fast-uri · fast-uri
Medium6.1 - CVE-2026-112003
ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete
ProjectSend · ProjectSend
Medium6.0