CWE-187 · Partial String Comparison
18 CVEs classified under CWE-187 (Partial String Comparison). Newest first, with CVSS severity, EPSS score and public exploits for each.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-35031 | Critical | 9.9 | 2026-04-14 | Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{ite… |
CVE-2024-41110 | Critical | 9.9 | 2024-07-24 | Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine… |
CVE-2022-31802 | Critical | 9.8 | 2022-06-24 | In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. A… |
CVE-2026-55602 | High | 8.6 | 2026-06-22 | http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries… |
CVE-2024-39742 | High | 8.1 | 2024-07-08 | IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due to a partial string comparison vu… |
CVE-2026-94576 | High | 8.0 | 2026-10-08 | An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0… |
CVE-2026-30874 | High | 7.8 | 2026-03-19 | OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6, a vulnerability in the hotplug_call function allows an at… |
CVE-2026-87853 | High | 7.5 | 2026-09-09 | A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the auth… |
CVE-2026-34785 | High | 7.5 | 2026-04-02 | Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a stati… |
CVE-2026-101914 | Medium | 6.5 | 2026-09-28 | @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) mat… |
CVE-2026-62750 | Medium | 6.5 | 2026-08-11 | Partial string comparison in Windows HTTP Protocol Stack allows an unauthorized attacker to perform tampering over an adjacent network. |
CVE-2026-112266 | Medium | 5.9 | 2026-10-19 | SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a sho… |
CVE-2026-44837 | Medium | 5.9 | 2026-05-26 | view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoi… |
CVE-2026-81479 | Medium | 5.8 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability. A low privileged attacker with local acce… |
CVE-2026-45692 | Medium | 5.4 | 2026-06-23 | Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree… |
CVE-2026-14687 | Medium | 5.3 | 2026-07-05 | A vulnerability was determined in 666ghj BettaFish up to 1.2.1. Impacted is the function _deduplicate_results of the file InsightEngine/agent.py of the compone… |
CVE-2025-23384 | Low | 3.7 | 2025-03-11 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2D… |
CVE-2026-84376 | | 2026-09-02 | Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-pref… |
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-112266 | Medium | 5.9 | 2026-10-19 | SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a sho… |
CVE-2026-94576 | High | 8.0 | 2026-10-08 | An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0… |
CVE-2026-101914 | Medium | 6.5 | 2026-09-28 | @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) mat… |
CVE-2026-81479 | Medium | 5.8 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability. A low privileged attacker with local acce… |
CVE-2026-87853 | High | 7.5 | 2026-09-09 | A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the auth… |
CVE-2026-84376 | | 2026-09-02 | Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-pref… | |
CVE-2026-62750 | Medium | 6.5 | 2026-08-11 | Partial string comparison in Windows HTTP Protocol Stack allows an unauthorized attacker to perform tampering over an adjacent network. |
CVE-2026-14687 | Medium | 5.3 | 2026-07-05 | A vulnerability was determined in 666ghj BettaFish up to 1.2.1. Impacted is the function _deduplicate_results of the file InsightEngine/agent.py of the compone… |
CVE-2026-45692 | Medium | 5.4 | 2026-06-23 | Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree… |
CVE-2026-55602 | High | 8.6 | 2026-06-22 | http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries… |
CVE-2026-44837 | Medium | 5.9 | 2026-05-26 | view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoi… |
CVE-2026-35031 | Critical | 9.9 | 2026-04-14 | Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{ite… |
CVE-2026-34785 | High | 7.5 | 2026-04-02 | Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Static determines whether a request should be served as a stati… |
CVE-2026-30874 | High | 7.8 | 2026-03-19 | OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6, a vulnerability in the hotplug_call function allows an at… |
CVE-2025-23384 | Low | 3.7 | 2025-03-11 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2D… |
CVE-2024-41110 | Critical | 9.9 | 2024-07-24 | Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine… |
CVE-2024-39742 | High | 8.1 | 2024-07-08 | IBM MQ Operator 3.2.2 and IBM MQ Operator 2.0.24 could allow a user to bypass authentication under certain configurations due to a partial string comparison vu… |
CVE-2022-31802 | Critical | 9.8 | 2022-06-24 | In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. A… |