Advisories · Weakness
CWE-187.
Every Advisory and CVE whose sources give the weakness CWE-187, newest first.
- CVSS 8.2 High
SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching
- sgl-project sglang
- CWE-187
- CVSS 5.9 Medium
Brocade Fabric OS: An authentication logic and privilege escalation vulnerability exists in the account…
- Brocade Fabric OS
- CWE-187
- CVSS 6.5 Medium
@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches
- Broken access control
- CWE-187
<1.13.1 || >=1.14.0, <1.14.1 · fixed in 1.13.1, 1.14.1
GHSA-88h9-xgvx-hvf2 · CVE-2026-101914 - CVSS 5.8 Medium
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability.
- Dell OpenManage Server Administrator Managed Node (Patch) for Windows
- Dell OpenManage Server Administrator Managed Node for RHEL 8.10
- CWE-187
- CVSS 7.5 High
Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- CWE-187
- CVSS 6.3 Medium
Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
- CWE-187
<7.2.4 · fixed in 7.2.4
GHSA-376h-93r7-7g6f · CVE-2026-84376 - CVSS 6.5 Medium
Windows HTTP Protocol Stack Tampering Vulnerability
- Microsoft Windows 10 Version 1607
- Microsoft Windows 10 Version 1809
- CWE-187
- CVSS 6.9 Medium
666ghj BettaFish InsightEngine search-result Deduplication agent.py _deduplicate_results partial string comparison
- 666ghj BettaFish
- CWE-187
- CWE-697
- CVSS 6.9 Medium
http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
- CWE-20
- CWE-187
>=0.16.0, <2.0.10 || >=3.0.0, <3.0.6 || >=4.0.0, <4.1.0 · fixed in 2.0.10, 3.0.6, 4.1.0
GHSA-64mm-vxmg-q3vj · CVE-2026-55602 - CVSS 5.4 Medium
Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
- Broken access control
- CWE-187
>=2.4.0, <2.11.3 · fixed in 2.11.3
GHSA-x5w9-xh9r-mvfc · CVE-2026-45692 - CVSS 5.9 Medium
view_component: System Test Entry Point Path Check Allows Sibling Directory Escape
- Path traversal
- CWE-187
>=3.0.0, <4.9.0 · fixed in 4.9.0
GHSA-hg3h-g7xc-f7vp · CVE-2026-44837 - CVSS 10.0 CriticalCritical · CVSS 9+
Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain
- jellyfin
- Path traversal
- CWE-20
- CVSS 7.5 High
Rack::Static prefix matching can expose unintended files under the static root
- Information disclosure
- CWE-187
<2.2.23 || >=3.0.0.beta1, <3.1.21 || >=3.2.0, <3.2.6 · fixed in 2.2.23, 3.1.21, 3.2.6
GHSA-h2jq-g4cq-5ppq · CVE-2026-34785 - CVSS 1.8 Low
OpenWrt procd PATH Environment Variable Filter Bypass via Incorrect String Comparison Leads to Privilege Escalation
- openwrt
- Other injection
- Privilege escalation
- CVSS 8.1 High
ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header
- Authentication bypass
- CWE-187
<2025.8.1 · fixed in 2025.8.1
GHSA-mxh2-ccgj-8635 · CVE-2025-57808 - CVSS 6.3 Medium
Siemens RUGGEDCOM RM1224 LTE(4G) EU: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2)…
- Siemens RUGGEDCOM RM1224 LTE(4G) EU
- Siemens RUGGEDCOM RM1224 LTE(4G) NAM
- CWE-187
- CVSS 10.0 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Authz zero length regression
- HTTP request smuggling
- Broken access control
>=19.03.0, <23.0.15 || >=24.0.0, <25.0.6 || >=26.0.0, <26.1.5 || >=27.0.0, <27.1.1 · fixed in 23.0.15, 25.0.6, 26.1.5, 27.1.1
GHSA-v23v-6jw2-98fq · CVE-2024-41110 - CVSS 8.1 High
IBM MQ Container authentication bypass
- IBM MQ Operator
- CWE-187
- CVSS 9.8 CriticalCritical · CVSS 9+
Partial string comparison in CODESYS gateway server
- CODESYS Gateway Server V2
- CWE-187