CWE-551 · 11 kayıt
Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Bu sınıftaki CVE’ler
11 kayıt
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
40Planlayın | CVE-2023-23924Kavram kanıtı | URI validation failure on SVG parsing in Dompdfdompdf project · dompdf · CWE-551 | Kritik9,8 | — | %3,6 | 31 Oca 2023 |
37İzleyin | CVE-2016-20030İstismar yok | ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginActionzkteco inc. · zkteco zkbiosecurity · CWE-551 | Kritik9,3 | — | %0,6 | 16 Mar 2026 |
34İzleyin | CVE-2021-32777İstismar yok | Incorrect concatenation of multiple value request headers in ext-authz extensionenvoyproxy · envoy · CWE-551 | Yüksek8,3 | — | %3,3 | 24 Ağu 2021 |
33İzleyin | CVE-2021-32779İstismar yok | Incorrectly handling of URI '#fragment' element as part of the path elementenvoyproxy · envoy · CWE-551 | Yüksek8,3 | — | %0,9 | 24 Ağu 2021 |
32İzleyin | CVE-2026-4636İstismar yok | Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.redhat · build of keycloak · CWE-551 | Yüksek8,1 | — | %0,5 | 2 Nis 2026 |
32İzleyin | CVE-2026-16102İstismar yok | Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappersredhat · build of keycloak · CWE-551 | Yüksek8,1 | — | %0,5 | 5 Ağu 2026 |
32İzleyin | CVE-2026-15573İstismar yok | Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcherredhat · build of keycloak · CWE-551 | Yüksek8,1 | — | %0,5 | 5 Ağu 2026 |
30İzleyin | CVE-2026-87743İstismar yok | Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http securityred hat · exploit intelligence · CWE-551 | Yüksek7,5 | — | %0,5 | 18 Eyl 2026 |
30İzleyin | CVE-2026-89060İstismar yok | Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration referencesred hat · red hat advanced cluster management for kubernetes 2.13 · CWE-551 | Yüksek7,7 | — | %0,5 | 11 Eyl 2026 |
30İzleyin | CVE-2026-57920İstismar yok | Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} enpeplink · intcontrol 2 · CWE-551 | Yüksek7,7 | — | %0,4 | 26 Haz 2026 |
21İzleyin | CVE-2026-0707İstismar yok | Keycloak: keycloak authorization header parsing leading to potential security control bypassred hat · red hat build of keycloak 26.4 · CWE-551 | Orta5,3 | — | %0,4 | 8 Oca 2026 |
- CVE-2023-2392440Planlayın
URI validation failure on SVG parsing in Dompdf
KritikCVSS 9,8Kavram kanıtıEPSS %4dompdf project · dompdf31 Oca 2023
- CVE-2016-2003037İzleyin
ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction
KritikCVSS 9,3İstismar yokEPSS %1zkteco inc. · zkteco zkbiosecurity16 Mar 2026
- CVE-2021-3277734İzleyin
Incorrect concatenation of multiple value request headers in ext-authz extension
YüksekCVSS 8,3İstismar yokEPSS %3envoyproxy · envoy24 Ağu 2021
- CVE-2021-3277933İzleyin
Incorrectly handling of URI '#fragment' element as part of the path element
YüksekCVSS 8,3İstismar yokEPSS %1envoyproxy · envoy24 Ağu 2021
- CVE-2026-463632İzleyin
Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.
YüksekCVSS 8,1İstismar yokEPSS %0redhat · build of keycloak2 Nis 2026
- CVE-2026-1610232İzleyin
Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers
YüksekCVSS 8,1İstismar yokEPSS %0redhat · build of keycloak5 Ağu 2026
- CVE-2026-1557332İzleyin
Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher
YüksekCVSS 8,1İstismar yokEPSS %0redhat · build of keycloak5 Ağu 2026
- CVE-2026-8774330İzleyin
Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security
YüksekCVSS 7,5İstismar yokEPSS %1red hat · exploit intelligence18 Eyl 2026
- CVE-2026-8906030İzleyin
Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references
YüksekCVSS 7,7İstismar yokEPSS %0red hat · red hat advanced cluster management for kubernetes 2.1311 Eyl 2026
- CVE-2026-5792030İzleyin
Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} en
YüksekCVSS 7,7İstismar yokEPSS %0peplink · intcontrol 226 Haz 2026
- CVE-2026-070721İzleyin
Keycloak: keycloak authorization header parsing leading to potential security control bypass
OrtaCVSS 5,3İstismar yokEPSS %0red hat · red hat build of keycloak 26.48 Oca 2026