The product uses a regular expression that does not sufficiently restrict the set of allowed values.
Volume of CVEs assigned to CWE-625 and their average CVSS base score over time.
Top CVEs that have been assigned this CWE. A single CVE can have multiple CWE assignments, though many have just one.
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-32973CRITICAL OpenClaw before 2026.3.11 contains an exec allowlist bypass vulnerability where matchesExecAllowlistPattern improperly normalizes patterns with lowercasing and glob matching that o | Mar 29, 2026 | 9.8 | 34 | NO | NO |
CVE-2026-40110HIGH Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the Origin header validation uses Python's re.match() to check incoming origins against | May 5, 2026 | 7.3 | 32 | NO | NO |
CVE-2018-8926HIGH Permissive regular expression vulnerability in synophoto_dsm_user in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote authenticated users to conduct privi | Jun 8, 2018 | 8.8 | 27 | NO | NO |
CVE-2026-37737MEDIUM sanic-cors version 2.2.0 and prior contains an improper regular expression in the try_match() function in sanic_cors/core.py that uses re.match without end-anchoring. This allows a | Jun 5, 2026 | 6.5 | 26 | NO | NO |
CVE-2026-23651MEDIUM Permissive regular expression in Azure Compute Gallery allows an authorized attacker to elevate privileges locally. | Mar 5, 2026 | 6.7 | 25 | NO | NO |
CVE-2026-44587MEDIUM CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex metacharacters in str | Jun 16, 2026 | 6.1 | 24 | NO | NO |
CVE-2026-34830HIGH Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Sendfile#map_accel_path interpolates the value of the X-Accel-Mapping request header | Apr 2, 2026 | 7.5 | 24 | NO | NO |
CVE-2020-8910MEDIUM A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and retur | Mar 26, 2020 | 6.5 | 22 | NO | NO |
CVE-2026-34763MEDIUM Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Directory interpolates the configured root path directly into a regular expression w | Apr 2, 2026 | 5.3 | 18 | NO | NO |
CVE-2023-6544MEDIUM A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows hosts to register a dynamic client. A malici | Apr 25, 2024 | 5.4 | 18 | NO | NO |
Exploit activity across CVEs assigned to this CWE, including CVEs that carry other CWE assignments.
Social posts that mention CVE IDs assigned to this CWE. This is assigned-CVE activity, not mentions of the CWE label itself.
Media articles that mention CVE IDs assigned to this CWE. This is assigned-CVE coverage, not mentions of the CWE label itself.