# CWE-173.

Every Advisory and CVE whose sources give the weakness CWE-173, newest first.

## Records, newest first

- [Ghost before 6.20.0 File Read via URL Encoding Bypass](https://agentprime.io/advisories/CVE-2026-103276.md)
  `CVE-2026-103276` · CVE record: TryGhost Ghost · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-173
- [Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry](https://agentprime.io/advisories/GHSA-qxp2-vgp9-268q.md)
  `GHSA-qxp2-vgp9-268q`, `CVE-2026-81638`, `EEF-CVE-2026-81638` · Hex `ash_double_entry`: affected `>=0.1.0, <1.0.19`, fixed in `1.0.19` · CVSS 2.1 Low · Not analysed yet · Published 7 Sept 2026 · Tags: CWE-173
- [Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding](https://agentprime.io/advisories/CVE-2026-19611.md)
  `CVE-2026-19611` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 7.4 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-173
- [Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution](https://agentprime.io/advisories/GHSA-2fvj-hgj9-j2gr.md)
  `GHSA-2fvj-hgj9-j2gr`, `CVE-2026-10050` · Maven `org.eclipse.jetty.ee8:jetty-ee8-security` and 2 more: affected `>=12.0.0, <12.0.36 || >=12.1.0, <12.1.10`, fixed in `12.0.36`, `12.1.10` · CVSS 8.7 High · Not analysed yet · Published 22 Jul 2026 · Tags: Authentication bypass, CWE-173
- [JetBrains YouTrack: In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack…](https://agentprime.io/advisories/CVE-2024-54158.md)
  `CVE-2024-54158` · CVE record: JetBrains YouTrack · CVSS 3.5 Low · Not analysed yet · Published 4 Dec 2024 · Tags: CWE-173
- [Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input.](https://agentprime.io/advisories/GHSA-vrjv-mxr7-vjf8.md)
  `GHSA-vrjv-mxr7-vjf8`, `CVE-2023-26303`, `PYSEC-2023-24` · PyPI `markdown-it-py`: affected `<2.2.0`, fixed in `2.2.0` · CVSS 3.3 Low · Not analysed yet · Published 23 Feb 2023 · Tags: CWE-173
- [Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as input.](https://agentprime.io/advisories/GHSA-jrwr-5x3p-hvc3.md)
  `GHSA-jrwr-5x3p-hvc3`, `CVE-2023-26302`, `PYSEC-2023-23` · PyPI `markdown-it-py`: affected `<2.2.0`, fixed in `2.2.0` · CVSS 3.3 Low · Not analysed yet · Published 22 Feb 2023 · Tags: CWE-173
- [node-fetch forwards secure headers to untrusted sites](https://agentprime.io/advisories/GHSA-r683-j2x4-v87g.md)
  `GHSA-r683-j2x4-v87g`, `CVE-2022-0235` · npm `node-fetch`: affected `<2.6.7 || >=3.0.0, <3.1.1`, fixed in `2.6.7`, `3.1.1` · CVSS 8.8 High · Not analysed yet · Published 21 Jan 2022 · Tags: Information disclosure, Open redirect, CWE-173
- [Information Disclosure in Guava](https://agentprime.io/advisories/GHSA-5mg8-w23w-74h3.md)
  `GHSA-5mg8-w23w-74h3`, `CVE-2020-8908`, `SNYK-JAVA-COMGOOGLEGUAVA-1015415` · Maven `com.google.guava:guava`: affected `<32.0.0-android`, fixed in `32.0.0-android` · CVSS 3.3 Low · Not analysed yet · Published 25 Mar 2021 · Tags: Information disclosure, Broken access control, CWE-173, CWE-378
- [Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization.](https://agentprime.io/advisories/CVE-2019-9636.md)
  `CVE-2019-9636` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 8 Mar 2019 · Tags: CWE-173

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-173>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-173/>. Everything for agents: <https://agentprime.io/llms.txt>.