CWE-187 · 16 records

Partial String Comparison

CVEs in this class

16 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
44Plan	CVE-2024-41110Proof of concept	Moby authz zero length regressionmoby · moby · CWE-187	Critical9.9	—	16.4%	Jul 24, 2024
39Monitor	CVE-2022-31802No exploit	Partial string comparison in CODESYS gateway servercodesys · gateway · CWE-187 Pre-auth	Critical9.8	—	1.3%	Jun 24, 2022
39Monitor	CVE-2024-39742No exploit	IBM MQ Container authentication bypassibm · mq operator · CWE-187 Pre-auth Auth bypass	Critical9.8	—	0.7%	Jul 8, 2024
32Monitor	CVE-2026-112266No exploit	SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matchingsgl-project · sglang · CWE-187 Pre-auth	High8.2	—	0.4%	4 days ago
30Monitor	CVE-2026-34785No exploit	Rack: Local file inclusion in `Rack::Static` via URL Prefix Matchingrack · rack · CWE-187 Pre-auth	High7.5	—	0.5%	Apr 2, 2026
30Monitor	CVE-2026-44837No exploit	view_component: System Test Entry Point Path Check Allows Sibling Directory Escapeviewcomponent · view component · CWE-187 Pre-auth	High7.5	—	0.3%	May 26, 2026
30Monitor	CVE-2026-87853No exploit	Sssd: sssd: idp authentication prefix comparison allows cross-user impersonationred hat · red hat enterprise linux 10 · CWE-187	High7.5	—	0.3%	Sep 9, 2026
26Monitor	CVE-2026-62750No exploit	Windows HTTP Protocol Stack Tampering Vulnerabilitymicrosoft · windows 10 1607 · CWE-187 Pre-auth	Medium6.5	—	0.6%	Aug 11, 2026
26Monitor	CVE-2026-101914No exploit	@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matchesgrpc · grpc-node · CWE-187 Pre-auth	Medium6.5	—	0.2%	Sep 28, 2026
25Monitor	CVE-2026-84376No exploit	Astro: Authorization bypass from missing path-segment boundary check when stripping the configured basewithastro · astro · CWE-187 Pre-auth	Medium6.3	—	0.7%	Sep 2, 2026
25Monitor	CVE-2025-23384No exploit	A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2.1), RUGGEDCOM RM1224 LTE(4G) NAsiemens · ruggedcom rm1224 lte(4g) eu · CWE-187 Pre-auth	Medium6.3	—	0.2%	Mar 11, 2025
23Monitor	CVE-2026-94576No exploit	An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions befobroadcom · fabric operating system · CWE-187	Medium5.9	—	0.4%	Oct 8, 2026
22Monitor	CVE-2026-14687No exploit	666ghj BettaFish InsightEngine search-result Deduplication agent.py _deduplicate_results partial string comparison666ghj · bettafish · CWE-187 Pre-auth	Medium5.5	—	0.5%	Jul 4, 2026
22Monitor	CVE-2026-81479No exploit	Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability.dell · openmanage server administrator · CWE-187 Local privilege escalation Denial of service	Medium5.5	—	0.1%	Sep 17, 2026
21Monitor	CVE-2025-12978No exploit	Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exacttreasuredata · fluent bit · CWE-187	Medium5.4	—	0.3%	Nov 24, 2025
15Monitor	CVE-2026-45692No exploit	Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalizationcaddyserver · caddy · CWE-187	Low3.8	—	0.2%	Jun 23, 2026

CVE-2024-41110
44Plan
Moby authz zero length regression
CriticalCVSS 9.9Proof of conceptEPSS 16%
moby · mobyJul 24, 2024
CVE-2022-31802
39Monitor
Partial string comparison in CODESYS gateway server
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
codesys · gatewayJun 24, 2022
CVE-2024-39742
39Monitor
IBM MQ Container authentication bypass
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
ibm · mq operatorJul 8, 2024
CVE-2026-112266
32Monitor
SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
sgl-project · sglang4 days ago
CVE-2026-34785
30Monitor
Rack: Local file inclusion in `Rack::Static` via URL Prefix Matching
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
rack · rackApr 2, 2026
CVE-2026-44837
30Monitor
view_component: System Test Entry Point Path Check Allows Sibling Directory Escape
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
viewcomponent · view componentMay 26, 2026
CVE-2026-87853
30Monitor
Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation
HighCVSS 7.5No exploitEPSS 0%
red hat · red hat enterprise linux 10Sep 9, 2026
CVE-2026-62750
26Monitor
Windows HTTP Protocol Stack Tampering Vulnerability
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
microsoft · windows 10 1607Aug 11, 2026
CVE-2026-101914
26Monitor
@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
grpc · grpc-nodeSep 28, 2026
CVE-2026-84376
25Monitor
Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
MediumCVSS 6.3No exploitEPSS 0%
- Pre-auth
withastro · astroSep 2, 2026
CVE-2025-23384
25Monitor
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2.1), RUGGEDCOM RM1224 LTE(4G) NA
MediumCVSS 6.3No exploitEPSS 0%
- Pre-auth
siemens · ruggedcom rm1224 lte(4g) euMar 11, 2025
CVE-2026-94576
23Monitor
An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions befo
MediumCVSS 5.9No exploitEPSS 0%
broadcom · fabric operating systemOct 8, 2026
CVE-2026-14687
22Monitor
666ghj BettaFish InsightEngine search-result Deduplication agent.py _deduplicate_results partial string comparison
MediumCVSS 5.5No exploitEPSS 0%
- Pre-auth
666ghj · bettafishJul 4, 2026
CVE-2026-81479
22Monitor
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability.
MediumCVSS 5.5No exploitEPSS 0%
- Local privilege escalation
- Denial of service
dell · openmanage server administratorSep 17, 2026
CVE-2025-12978
21Monitor
Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fails to enforce exact
MediumCVSS 5.4No exploitEPSS 0%
treasuredata · fluent bitNov 24, 2025
CVE-2026-45692
15Monitor
Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
LowCVSS 3.8No exploitEPSS 0%
caddyserver · caddyJun 23, 2026

All vulnerability classes