CWE-644

CWE-644 · 3 records · 1 with a public proof-of-concept

Records the NVD classes under CWE-644, highest CVSS first.

  1. HIGH 7.5CVE-2026-110723public PoC2026-10-15

    In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and…

    AI risk analysis on Exploit-DB.ai →

  2. MEDIUM 6.5CVE-2026-05162026-08-05

    A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host header and redirect firewall management users to arbitrary web domains.

    AI risk analysis on Exploit-DB.ai →

  3. UNSCOREDCVE-2026-1258802026-11-10

    Improper neutralization of HTTP headers for scripting syntax vulnerability in N-able N-central allows Cross-Site Scripting (XSS). This issue affects N-central: before 26.4.1.

    AI risk analysis on Exploit-DB.ai →