CWE-176

CWE-176 · 10 records · 8 with a public proof-of-concept

Records the NVD classes under CWE-176, highest CVSS first.

  1. HIGH 7.5CVE-2026-890742026-10-14

    Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

    moveit transfer

    AI risk analysis on Exploit-DB.ai →

  2. HIGH 7.5CVE-2026-93990public PoC2026-09-19

    Expat through 2.8.4 fails to validate low surrogates following high surrogates in UTF-16 input, allowing malformed UTF-16 sequences to be accepted. Attackers can craft UTF-16 encoded XML with lone high surrogates that consume following code units, hiding marku…

    AI risk analysis on Exploit-DB.ai →

  3. MEDIUM 5.4CVE-2026-19954public PoC2026-10-05

    Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names. pwhois encodes each non-ASCII label directly using Net::IDN::Punycode and prepends xn--. Apart from lowercasing …

    AI risk analysis on Exploit-DB.ai →

  4. MEDIUM 5.3CVE-2026-116542public PoC2026-10-26

    Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server…

    AI risk analysis on Exploit-DB.ai →

  5. MEDIUM 5.3CVE-2026-114114public PoC2026-10-21

    Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. A…

    AI risk analysis on Exploit-DB.ai →

  6. MEDIUM 5.3CVE-2026-105241public PoC2026-10-06

    Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, n…

    log4net

    AI risk analysis on Exploit-DB.ai →

  7. UNSCOREDCVE-2026-62374public PoC2026-10-29

    SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specification. In version 0.19.0 and earlier, `@sd-jwt/decode`, also used by `@sd-jwt/core`, silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed…

    AI risk analysis on Exploit-DB.ai →

  8. UNSCOREDCVE-2026-110687public PoC2026-10-19

    Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, in…

    AI risk analysis on Exploit-DB.ai →

  9. UNSCOREDCVE-2026-110674public PoC2026-10-19

    Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. With allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 b…

    AI risk analysis on Exploit-DB.ai →

  10. UNSCOREDCVE-2026-861052026-09-30

    An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different …

    AI risk analysis on Exploit-DB.ai →