Skip to content
Noroxi

CWE-436 · 125 records

Interpretation Conflict

CVEs in this class

125 records

  • CVE-2026-63030
    72This week

    WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

    CriticalCVSS 9.8KEVWeaponizedEPSS 10%

    wordpress · wordpressJul 17, 2026

  • CVE-2021-28474
    50Plan

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 50%

    microsoft · sharepoint foundationMay 11, 2021

  • CVE-2023-24813
    40Plan

    URI validation failure on SVG parsing. Bypass of CVE-2023-23924

    CriticalCVSS 9.8No exploitEPSS 2%

    dompdf project · dompdfFeb 7, 2023

  • CVE-2021-45327
    40Plan

    Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API.

    CriticalCVSS 9.8No exploitEPSS 2%

    gitea · giteaFeb 8, 2022

  • CVE-2019-19589
    40Plan

    The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are valid JAR archives.

    CriticalCVSS 9.8No exploitEPSS 1%

    wp-pdf · pdf embedderDec 5, 2019

  • CVE-2020-10180
    40Plan

    The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive.

    CriticalCVSS 9.8No exploitEPSS 1%

    eset · cyber securityMar 5, 2020

  • CVE-2024-24754
    39Monitor

    Bref Body Parsing Inconsistency in Event-Driven Functions

    CriticalCVSS 9.8No exploitEPSS 0%

    mnapoli · brefFeb 1, 2024

  • CVE-2019-18792
    37Monitor

    An issue was discovered in Suricata 5.0.0.

    CriticalCVSS 9.1No exploitEPSS 2%

    oisf · suricataJan 6, 2020

  • CVE-2026-57580
    37Monitor

    authentik: Account Takeover via SAML NameID Comment Truncation

    CriticalCVSS 9.4No exploitEPSS 0%

    goauthentik · authentikAug 18, 2026

  • CVE-2024-38428
    36Monitor

    url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in whi

    CriticalCVSS 9.1No exploitEPSS 0%

    gnu · wgetJun 15, 2024

  • CVE-2026-6270
    36Monitor

    @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes

    CriticalCVSS 9.1No exploitEPSS 0%

    fastify · fastify\/middieApr 16, 2026

  • CVE-2026-33808
    36Monitor

    @fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)

    CriticalCVSS 9.1No exploitEPSS 0%

    fastify · fastify\/expressApr 15, 2026

  • CVE-2026-33807
    36Monitor

    @fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes

    CriticalCVSS 9.1No exploitEPSS 0%

    fastify · fastify\/expressApr 15, 2026

  • CVE-2026-41248
    36Monitor

    Official Clerk JavaScript SDKs: Middleware-based route protection bypass

    CriticalCVSS 9.1No exploitEPSS 0%

    clerk · astroApr 24, 2026

  • CVE-2026-85184
    36Monitor

    @fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target

    CriticalCVSS 9.1No exploitEPSS 0%

    fastify · fastify\/middieSep 4, 2026

  • CVE-2026-14198
    36Monitor

    @fastify/middie vulnerable to authorization bypass via encoded slash in path parameter values

    CriticalCVSS 9.1No exploitEPSS 0%

    fastify · fastify\/middieJul 1, 2026

  • CVE-2026-33804
    36Monitor

    @fastify/middie vulnerable to middleware bypass via deprecated ignoreDuplicateSlashes option

    CriticalCVSS 9.1No exploitEPSS 0%

    fastify · fastify\/middieApr 16, 2026

  • CVE-2023-39481
    35Monitor

    Softing Secure Integration Server Interpretation Conflict Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 1%

    softing · secure integration serverMay 2, 2024

  • CVE-2022-36051
    35Monitor

    Broken Authorization in ZITADEL Actions

    HighCVSS 8.8No exploitEPSS 0%

    zitadel · zitadelAug 31, 2022

  • CVE-2026-49473
    35Monitor

    @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

    HighCVSS 8.8No exploitEPSS 0%

    cedar-policy · authorization-for-expressjsAug 12, 2026

  • CVE-2018-19966
    35Monitor

    An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service (host OS crash) or possibly gain h

    HighCVSS 8.8No exploitEPSS 0%

    xen · xenDec 8, 2018

  • CVE-2018-6560
    35Monitor

    In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to

    HighCVSS 8.8No exploitEPSS 0%

    flatpak · flatpakFeb 2, 2018

  • CVE-2025-12816
    34Monitor

    An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1

    HighCVSS 8.6No exploitEPSS 0%

    digitalbazaar · forgeNov 25, 2025

  • CVE-2026-73614
    34Monitor

    Network-AI ClaudeHookBridge Deny Pattern Bypass via Truncation

    HighCVSS 8.7No exploitEPSS 0%

    jovancoding · network-aiAug 13, 2026

  • CVE-2026-73615
    34Monitor

    Network-AI SandboxPolicy before 5.15.1 Blocklist Bypass via Quote Mismatch

    HighCVSS 8.7No exploitEPSS 0%

    jovancoding · network-aiAug 13, 2026

All vulnerability classes