Reference page — cumulative record through Thursday, October 8, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-644
Weakness type CWE-644 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 13 | 13 | 0 |
Monthly trend
▂▅▅█▁▁
2026-05 1 · 2026-06 3 · 2026-07 3 · 2026-08 6 · 2026-09 0 · 2026-10 0
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-48126 | 8.2 | 41.0 | — | Algernon: Host header path traversal in --domain mode reads files and runs Lua from par… |
| CVE-2026-69183 | 7.5 | 39.4 | — | Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP header… |
| CVE-2026-55791 | 6.9 | 38.2 | — | Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in a… |
| CVE-2026-72574 | 6.1 | 34.4 | — | picocms Pico - Host Header Injection Enables Script Source Hijacking |
| CVE-2026-48061 | 5.9 | 29.4 | — | Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwa… |
| CVE-2026-66778 | 5.3 | 27.5 | — | Multiple vulnerabilities in SAP Business AI Platform (Approuter) |
| CVE-2026-0516 | 6.5 | 25.6 | — | — |
| CVE-2026-54477 | 5.1 | 23.7 | — | Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax |
| CVE-2026-10836 | 5.1 | 21.6 | — | Improper neutralization of HTTP headers in Password Manager |
| CVE-2026-21762 | 5.3 | 19.5 | — | Missing HTTP Security Headers in DevOps Loop |
| CVE-2024-51454 | 6.1 | 15.4 | — | IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by v… |
| CVE-2026-4096 | 6.1 | 15.4 | — | A vulnerability has been identified in IBM DevOps Plan that allows a Host Header Inject… |
| CVE-2026-67179 | 7.8 | 7.5 | — | Genkit improper host header validation |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| ibm | 2 |
| craftcms | 1 |
| gardyn | 1 |
| genkit-ai | 1 |
| hclsoftware | 1 |
| litestar-org | 1 |
| monkeytypegame | 1 |
| password manager | 1 |
| picocms | 1 |
| sap_se | 1 |
| sonicwall | 1 |
| xyproto | 1 |
