# CWE-187.

Every Advisory and CVE whose sources give the weakness CWE-187, newest first.

## Records, newest first

- [SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching](https://agentprime.io/advisories/CVE-2026-112266.md)
  `CVE-2026-112266` · CVE record: sgl-project sglang · CVSS 8.2 High · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-187
- [Brocade Fabric OS: An authentication logic and privilege escalation vulnerability exists in the account…](https://agentprime.io/advisories/CVE-2026-94576.md)
  `CVE-2026-94576` · CVE record: Brocade Fabric OS · CVSS 5.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-187
- [@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches](https://agentprime.io/advisories/GHSA-88h9-xgvx-hvf2.md)
  `GHSA-88h9-xgvx-hvf2`, `CVE-2026-101914` · npm `@grpc/grpc-js-xds`: affected `<1.13.1 || >=1.14.0, <1.14.1`, fixed in `1.13.1`, `1.14.1` · CVSS 6.5 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control, CWE-187
- [Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability.](https://agentprime.io/advisories/CVE-2026-81479.md)
  `CVE-2026-81479` · CVE record: Dell OpenManage Server Administrator Managed Node (Patch) for Windows and 4 more · CVSS 5.8 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-187
- [Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation](https://agentprime.io/advisories/CVE-2026-87853.md)
  `CVE-2026-87853` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-187
- [Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base](https://agentprime.io/advisories/GHSA-376h-93r7-7g6f.md)
  `GHSA-376h-93r7-7g6f`, `CVE-2026-84376` · npm `astro`: affected `<7.2.4`, fixed in `7.2.4` · CVSS 6.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-187
- [Windows HTTP Protocol Stack Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-62750.md)
  `CVE-2026-62750` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-187
- [666ghj BettaFish InsightEngine search-result Deduplication agent.py \_deduplicate_results partial string comparison](https://agentprime.io/advisories/CVE-2026-14687.md)
  `CVE-2026-14687` · CVE record: 666ghj BettaFish · CVSS 6.9 Medium · Not analysed yet · Published 5 Jul 2026 · Tags: CWE-187, CWE-697
- [http-proxy-middleware \`router\` host+path substring matching allows Host-header-driven backend routing bypass](https://agentprime.io/advisories/GHSA-64mm-vxmg-q3vj.md)
  `GHSA-64mm-vxmg-q3vj`, `CVE-2026-55602` · npm `http-proxy-middleware`: affected `>=0.16.0, <2.0.10 || >=3.0.0, <3.0.6 || >=4.0.0, <4.1.0`, fixed in `2.0.10`, `3.0.6`, `4.1.0` · CVSS 6.9 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-20, CWE-187
- [Caddy: Remote Admin Authorization Bypass in \`/config\` API via Array Index Normalization](https://agentprime.io/advisories/GHSA-x5w9-xh9r-mvfc.md)
  `GHSA-x5w9-xh9r-mvfc`, `CVE-2026-45692`, `GO-2026-5743` · Go `github.com/caddyserver/caddy/v2`: affected `>=2.4.0, <2.11.3`, fixed in `2.11.3` · CVSS 5.4 Medium · Not analysed yet · Published 19 May 2026 · Tags: Broken access control, CWE-187
- [view_component: System Test Entry Point Path Check Allows Sibling Directory Escape](https://agentprime.io/advisories/GHSA-hg3h-g7xc-f7vp.md)
  `GHSA-hg3h-g7xc-f7vp`, `CVE-2026-44837` · RubyGems `view_component`: affected `>=3.0.0, <4.9.0`, fixed in `4.9.0` · CVSS 5.9 Medium · Not analysed yet · Published 8 May 2026 · Tags: Path traversal, CWE-187
- [Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain](https://agentprime.io/advisories/CVE-2026-35031.md)
  `CVE-2026-35031` · CVE record: jellyfin jellyfin · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Apr 2026 · Tags: Path traversal, CWE-20, CWE-187
- [Rack::Static prefix matching can expose unintended files under the static root](https://agentprime.io/advisories/GHSA-h2jq-g4cq-5ppq.md)
  `GHSA-h2jq-g4cq-5ppq`, `CVE-2026-34785` · RubyGems `rack`: affected `<2.2.23 || >=3.0.0.beta1, <3.1.21 || >=3.2.0, <3.2.6`, fixed in `2.2.23`, `3.1.21`, `3.2.6` · CVSS 7.5 High · Not analysed yet · Published 2 Apr 2026 · Tags: Information disclosure, CWE-187
- [OpenWrt procd PATH Environment Variable Filter Bypass via Incorrect String Comparison Leads to Privilege Escalation](https://agentprime.io/advisories/CVE-2026-30874.md)
  `CVE-2026-30874` · CVE record: openwrt openwrt · CVSS 1.8 Low · Not analysed yet · Published 19 Mar 2026 · Tags: Other injection, Privilege escalation, CWE-187
- [ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header](https://agentprime.io/advisories/GHSA-mxh2-ccgj-8635.md)
  `GHSA-mxh2-ccgj-8635`, `CVE-2025-57808`, `PYSEC-2026-1330` · PyPI `esphome`: affected `<2025.8.1`, fixed in `2025.8.1` · CVSS 8.1 High · Not analysed yet · Published 2 Sept 2025 · Tags: Authentication bypass, CWE-187
- [Siemens RUGGEDCOM RM1224 LTE(4G) EU: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2)…](https://agentprime.io/advisories/CVE-2025-23384.md)
  `CVE-2025-23384` · CVE record: Siemens RUGGEDCOM RM1224 LTE(4G) EU and 4 more · CVSS 6.3 Medium · Not analysed yet · Published 11 Mar 2025 · Tags: CWE-187
- [Authz zero length regression](https://agentprime.io/advisories/GHSA-v23v-6jw2-98fq.md)
  `GHSA-v23v-6jw2-98fq`, `CVE-2024-41110`, `GO-2024-3005` · Go `github.com/docker/docker`: affected `>=19.03.0, <23.0.15 || >=24.0.0, <25.0.6 || >=26.0.0, <26.1.5 || >=27.0.0, <27.1.1`, fixed in `23.0.15`, `25.0.6`, `26.1.5`, `27.1.1` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.16 · Not analysed yet · Published 30 Jul 2024 · Tags: HTTP request smuggling, Broken access control, CWE-187
- [IBM MQ Container authentication bypass](https://agentprime.io/advisories/CVE-2024-39742.md)
  `CVE-2024-39742` · CVE record: IBM MQ Operator · CVSS 8.1 High · Not analysed yet · Published 8 Jul 2024 · Tags: CWE-187
- [Partial string comparison in CODESYS gateway server](https://agentprime.io/advisories/CVE-2022-31802.md)
  `CVE-2022-31802` · CVE record: CODESYS CODESYS Gateway Server V2 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2022 · Tags: CWE-187

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-187>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-187/>. Everything for agents: <https://agentprime.io/llms.txt>.