By weakness (CWE)

CWE-697: related vulnerabilities

CVEs classified under CWE-697. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

10 published vulnerabilities

• CVE-2026-45567HIGH 8.3

  Roxy-WI, a popular web management interface for load balancers and web servers (HAProxy, Nginx, Apache, and Keepalived), contains an authentication bypass flaw in version 8.2.6.4 and earlier. An attacker can reach the unauthenticated /api/gpt endpoint by crafting a URL containing the 'api' substring, bypassing login requirements. This allows unauthorized access to administrative functions without valid credentials.

• CVE-2026-44249HIGH 8.1

  Netty is a widely-used Java networking framework that powers many protocol servers and clients. A flaw in how it filters IPv6 traffic has been discovered: the masking logic in the IPv6 subnet filtering rules is broken, allowing attackers to craft IP addresses that appear to bypass intended network access controls. If your application relies on Netty to restrict traffic to specific IPv6 subnets, an attacker could send requests from addresses that should have been blocked, potentially gaining unauthorized access to protected services.

• CVE-2026-45569HIGH 8.1

  Roxy-WI, a web-based control panel for managing HAProxy, Nginx, Apache, and Keepalived servers, contains a path-traversal vulnerability in versions 8.2.6.4 and earlier. A security patch was attempted but contained a critical logic error: it checks whether the string '..' appears as an exact match in a list of values, rather than checking whether '..' appears anywhere within a file path. This means attackers can still bypass the check using common path-traversal payloads like '../../etc/passwd' or '..\..\/etc/passwd'. An authenticated user can exploit this to read, modify, or delete arbitrary configuration files on the server.

• CVE-2026-49340HIGH 8.1

  Gonic, a free-software music streaming server that implements the Subsonic API, contains a vulnerability in how it handles playlist creation and updates. Any authenticated user—not just administrators—can exploit a flaw in the playlist write function to place files anywhere on the server's filesystem and create directories with overly permissive access controls. This was patched in version 0.21.0.

• CVE-2026-10097HIGH 7.5

  wolfSSL's optimized implementation of ML-KEM-1024, a post-quantum key encapsulation mechanism, contains a critical flaw in how it validates ciphertexts during decryption. The vulnerability stems from an incomplete cryptographic check: the library compares only 1536 of the required 1568 ciphertext bytes when verifying that a ciphertext was correctly re-encrypted. This allows an attacker to craft malicious ciphertexts that pass validation when they should be rejected. An attacker with access to a decapsulation oracle can exploit this as a side-channel-like oracle to recover the long-term private key—without needing to exploit timing behavior or other indirect measurements. A proof of concept demonstrated recovery of a full private key using roughly 350 carefully chosen ciphertexts, with approximately 98% success rate.

• CVE-2026-22660HIGH 7.2

  FlaskBB administrators face a critical authorization bypass risk. A type mismatch in the application's group deletion safeguard allows authenticated admins to remove all built-in permission groups in one operation. Because FlaskBB's permission model relies on these groups, their deletion effectively breaks the forum's access controls, potentially locking legitimate users out and destabilizing the entire platform. The vulnerability requires admin credentials but no user interaction to trigger.

• CVE-2026-59890MEDIUM 6.1

  setuptools, a core Python package management tool, contains a vulnerability in how it handles file exclusion rules when building source distributions. On macOS systems using APFS or HFS+ filesystems, attackers or malicious developers can bypass intended file exclusion directives by exploiting Unicode normalization differences. Specifically, files named with decomposed Unicode characters (NFD form) can be packed into distributed Python packages even when exclusion rules target the composed form (NFC). This allows sensitive or malicious files to be included in source distributions when they should have been excluded, potentially affecting downstream package users.

• CVE-2026-14687MEDIUM 5.3

  A flaw in 666ghj BettaFish versions up to 1.2.1 allows remote attackers to manipulate how the InsightEngine search-result deduplication function compares strings, potentially causing partial or incomplete string matching. This could lead to incorrect or misleading search results being presented to users. The vulnerability requires no special privileges or user interaction to exploit, and proof-of-concept code has been publicly shared.

• CVE-2026-14686LOW 3.3

  HdrHistogram, a Java library for recording and analyzing latency distributions, contains a flaw in its range-checking logic for the DoubleHistogram component. When recording values, the library performs an incorrect comparison that could allow a local user to bypass validation checks. The vulnerability requires local system access and has limited security impact, as it does not enable data exfiltration or system unavailability—only the integrity of recorded histogram data could be affected. The security community has disputed whether this truly crosses a meaningful security boundary, and exploit details are now public.

• CVE-2026-14617LOW 3.1

  A case-sensitivity handling flaw exists in NousResearch's hermes-agent streaming reasoning component (versions up to 2026.4.30). The vulnerability allows a low-impact information disclosure when filtering streaming data, but requires both authentication and specific conditions to exploit. The vendor has elected not to patch this issue, determining the maintenance burden outweighs the security benefit given the limited attack surface and high complexity required to trigger it.