Reference page — cumulative record through Tuesday, October 20, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-644
Weakness type CWE-644 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 14 | 14 | 0 |
Monthly trend
▂▅▅█▁▂
2026-05 1 · 2026-06 3 · 2026-07 3 · 2026-08 6 · 2026-09 0 · 2026-10 1
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-48126 | 8.2 | 41.7 | — | Algernon: Host header path traversal in --domain mode reads files and runs Lua from par… |
| CVE-2026-69183 | 7.5 | 40.1 | — | Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP header… |
| CVE-2026-55791 | 6.9 | 38.8 | — | Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in a… |
| CVE-2026-72574 | 6.1 | 35.0 | — | picocms Pico - Host Header Injection Enables Script Source Hijacking |
| CVE-2026-48061 | 5.9 | 30.0 | — | Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwa… |
| CVE-2026-66778 | 5.3 | 28.1 | — | Multiple vulnerabilities in SAP Business AI Platform (Approuter) |
| CVE-2026-0516 | 6.5 | 26.3 | — | — |
| CVE-2026-110723 | 7.5 | 25.7 | — | — |
| CVE-2026-54477 | 5.1 | 24.3 | — | Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax |
| CVE-2026-10836 | 5.1 | 22.2 | — | Improper neutralization of HTTP headers in Password Manager |
| CVE-2026-21762 | 5.3 | 20.0 | — | Missing HTTP Security Headers in DevOps Loop |
| CVE-2024-51454 | 6.1 | 15.7 | — | IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by v… |
| CVE-2026-4096 | 6.1 | 15.8 | — | A vulnerability has been identified in IBM DevOps Plan that allows a Host Header Inject… |
| CVE-2026-67179 | 7.8 | 7.8 | — | Genkit improper host header validation |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| ibm | 2 |
| craftcms | 1 |
| eclipse foundation | 1 |
| gardyn | 1 |
| genkit-ai | 1 |
| hclsoftware | 1 |
| litestar-org | 1 |
| monkeytypegame | 1 |
| password manager | 1 |
| picocms | 1 |
| sap_se | 1 |
| sonicwall | 1 |
| xyproto | 1 |
