Book møte

Sårbarheter

CWE-436: Interpretation Conflict

Svakhetstype fra CWE-katalogen

Hva svakheten betyr

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Definisjonen gjengis slik MITRE har publisert den, på engelsk.

77 sårbarheter i tjenesten peker på denne svakheten

  1. CVE-2026-63030 Utnyttes aktivt Kritisk 9.8

    WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), cou…

  2. CVE-2025-48384 Utnyttes aktivt Høy 8.0

    Git Link Following Vulnerability

    Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git…

  3. CVE-2026-47767 Kritisk 9.8

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsi…

  4. CVE-2026-8034 Kritisk 9.8

    A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting URL parser confusi…

  5. CVE-2026-32052 Kritisk 9.8

    OpenClaw versions prior to 2026.2.24 contain a command injection vulnerability in the system.run shell-wrapper that allows attackers to execute hidden commands by injecting positional argv carriers a…

  6. CVE-2025-25291 Kritisk 9.8

    ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a …

  7. CVE-2025-25292 Kritisk 9.8

    ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a …

  8. CVE-2026-57580 Kritisk 9.4

    authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, an inbound SAML Source configured with the non-default USERNAME_LINK or EMAIL_LINK user-matching mode interprets an XML …

  9. CVE-2026-85184 Kritisk 9.1

    @fastify/middie versions >= 9.1.0 and before 9.3.4 decide whether to run path-scoped middleware by matching against the raw request target, while the Fastify router resolves an absolute-form request …

  10. CVE-2026-14198 Kritisk 9.1

    @fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding durin…

  11. CVE-2026-41248 Kritisk 9.1

    Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowi…

  12. CVE-2026-33804 Kritisk 9.1

    @fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled. The middleware path matching logic does not accoun…

  13. CVE-2026-6270 Kritisk 9.1

    @fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances. When a Fastify application registers authentication middleware in a parent s…

  14. CVE-2026-33807 Kritisk 9.1

    @fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is register…

  15. CVE-2026-33808 Kritisk 9.1

    Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-…

  16. CVE-2026-49473 Høy 8.8

    @cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluatin…

  17. CVE-2026-40165 Høy 8.7

    authentik is an open-source identity provider. Versions 2025.12.4 and prior, and versions 2026.2.0-rc1 through 2026.2.2 were vulnerable to Authentication Bypass through SAML NameID XML Comment Inject…

  18. CVE-2025-12816 Høy 8.6

    An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a…

  19. CVE-2026-81378 Høy 8.2

    Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

  20. CVE-2026-48788 Høy 8.2

    Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting (XSS) vulnerability explo…

  21. CVE-2026-42272 Høy 7.8

    Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall handles URL-encoded slashes (%2F) in a case-sensitive manner, while percent-enc…

  22. CVE-2026-42273 Høy 7.8

    Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs host matching in a case-sensitive manner, while HTTP hostnames are cas…

  23. CVE-2026-42274 Høy 7.8

    Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule matching on the raw (non-normalized) request path, while downstre…

  24. CVE-2026-82537 Høy 7.7

    Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the app…

  25. CVE-2026-67201 Høy 7.7

    V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser different…