On this page

Atomicorp WAF Rule 390719

Rule Summary

Rule ID: 390719
Status: Active
Alert message: Atomicorp.com WAF Rules: Attempt to access protected file remotely
Observed CWEs: CWE-20 (9), CWE-22 (34), CWE-23 (1), CWE-27 (2), CWE-31 (1), CWE-36 (1), CWE-59 (1), CWE-74 (4), CWE-77 (1), CWE-78 (6), CWE-88 (1), CWE-89 (7), CWE-93 (1), CWE-94 (8), CWE-98 (1), CWE-113 (1), CWE-121 (2), CWE-177 (1), CWE-178 (1), CWE-183 (1), CWE-184 (1), CWE-200 (1), CWE-259 (1), CWE-269 (2), CWE-284 (1), CWE-287 (4), CWE-288 (1), CWE-306 (7), CWE-350 (1), CWE-367 (1), CWE-434 (13), CWE-444 (1), CWE-502 (2), CWE-601 (1), CWE-610 (1), CWE-611 (4), CWE-706 (1), CWE-755 (1), CWE-787 (2), CWE-791 (1), CWE-798 (2), CWE-918 (35), CWE-942 (1), CWE-1385 (1)
Revision: 6
Rule severity: Critical (2)
Phase: 2 (request body)
Request surfaces: Request headers
Rule action: deny
HTTP status: 403
Logging: log, auditlog

Description

This rule detects when a protected file name is used in an HTTP header (other than the URL, Cookie or Referer headers). This rule specifically protects sensitive OS and application configuration files, such as webserver configuration files, operating system configuration files, password files, and command history files from disclosure.

Troubleshooting

False Positives

A false positive can occur when an application legitimately uses this information in an HTTP header. There are no known cases where this occurs.

It is not recommended that you disable this rule if you have a false positive. If you believe this is a false positive, please report this to our security team to determine if this is a legitimate case, or if its clever attack on your system. Instructions to report false positives are detailed on the Reporting False Positives wiki page. If it is a false positive, we will fix the issue in the rules and get a release out to you promptly.

Tuning Guidance

If you know that this behavior is acceptable for your application, you can either disable the rule for the domain, or you can disable it for the application. Please see the Tuning the Atomicorp WAF Rules page for basic information.

Additional Information

Similar Rules

WAF_390709

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

CVE	Vulnerability	Product	CVSS	Severity
CVE-2011-2653	Novell ZENworks Asset Management Remote Execution	zenworks asset management	10.0 (v2.0)	High
CVE-2012-3811	Avaya IP Office Customer Call Reporter ImageUpload.ashx Remote Command Execution	ip office customer call reporter	10.0 (v2.0)	High
CVE-2013-1080	Novell ZENworks Configuration Management Remote Execution	zenworks configuration management	10.0 (v2.0)	High
CVE-2013-4811	HP ProCurve Manager SNAC UpdateDomainControllerServlet File Upload	identity driven manager	10.0 (v2.0)	High
CVE-2013-4812	HP ProCurve Manager SNAC UpdateCertificatesServlet File Upload	identity driven manager	10.0 (v2.0)	High
CVE-2013-6221	HP AutoPass License Server File Upload	service virtualization	10.0 (v2.0)	High
CVE-2020-24186	WordPress wpDiscuz Unauthenticated File Upload Vulnerability	wpdiscuz	10.0 (v3.1)	Critical
CVE-2024-1709	ConnectWise ScreenConnect Unauthenticated Remote Code Execution	screenconnect	10.0 (v3.1)	Critical
CVE-2025-52691	SmarterTools SmarterMail GUID File Upload Vulnerability	smartermail	10.0 (v3.1)	Critical
CVE-2024-2044	pgAdmin Session Deserialization RCE	pgadmin 4	9.9 (v3.1)	Critical
CVE-2025-24016	Wazuh server remote code execution caused by an unsafe deserialization vulnerability.	wazuh	9.9 (v3.1)	Critical
CVE-2026-44015	Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services	nginx ui	9.9 (v3.1)	Critical
CVE-2026-66898	Path traversal via unvalidated instance name in backup tarball restore enables root file write / RCE	lxd	9.9 (v3.1)	Critical
CVE-2014-6271	CUPS Filter Bash Environment Variable Code Injection (Shellshock)	bash	9.8 (v3.1)	Critical
CVE-2014-8741	Lexmark MarkVision Enterprise Arbitrary File Upload	markvision enterprise	9.8 (v3.1)	Critical
CVE-2016-2555	ATutor 2.2.1 SQL Injection / Remote Code Execution	atutor	9.8 (v3.0)	Critical
CVE-2017-1000002	ATutor 2.2.1 Directory Traversal / Remote Code Execution	atutor	9.8 (v3.0)	Critical
CVE-2017-5638	S2-045 Remote Code Execution Vulnerablity（CVE-2017-5638）	struts	9.8 (v3.1)	Critical
CVE-2018-17552	Navigate CMS Unauthenticated Remote Code Execution	navigate cms	9.8 (v3.0)	Critical
CVE-2019-1821	Cisco Prime Infrastructure Health Monitor TarArchive Directory Traversal Vulnerability	evolved programmable network manager	9.8 (v3.0)	Critical
CVE-2019-19781	Citrix ADC (NetScaler) Directory Traversal RCE	application delivery controller firmware	9.8 (v3.1)	Critical
CVE-2019-9194	elFinder PHP Connector exiftran Command Injection	elfinder	9.8 (v3.0)	Critical
CVE-2020-3243	Cisco UCS Director Cloupia Script RCE	ucs director	9.8 (v3.1)	Critical
CVE-2020-3250	Cisco UCS Director Cloupia Script RCE	ucs director	9.8 (v3.1)	Critical
CVE-2020-4427	IBM Data Risk Manager Unauthenticated Remote Code Execution	data risk manager	9.8 (v3.1)	Critical
CVE-2020-4429	IBM Data Risk Manager Unauthenticated Remote Code Execution	data risk manager	9.8 (v3.1)	Critical
CVE-2021-21972	VMware vCenter Server Unauthenticated OVA File Upload RCE	cloud foundation	9.8 (v3.1)	Critical
CVE-2021-3378	FortiLogger Arbitrary File Upload Exploit	fortilogger	9.8 (v3.1)	Critical
CVE-2021-40539	ManageEngine ADSelfService Plus CVE-2021-40539	manageengine adselfservice plus	9.8 (v3.1)	Critical
CVE-2021-41749	CraftCMS SEOmatic - Server-Side Template Injection	seomatic	9.8 (v3.1)	Critical
CVE-2021-45837	TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.	tos	9.8 (v3.1)	Critical
CVE-2022-20705	Cisco RV Series Authentication Bypass and Command Injection	rv340 firmware	9.8 (v3.1)	Critical
CVE-2022-24989	TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989	terramaster operating system	9.8 (v3.1)	Critical
CVE-2023-26469	Jorani unauthenticated Remote Code Execution	jorani	9.8 (v3.1)	Critical
CVE-2023-40498	LG Simple Editor Remote Code Execution	simple editor	9.8 (v3.1)	Critical
CVE-2024-23897	Jenkins cli Ampersand Replacement Arbitrary File Read	jenkins	9.8 (v3.1)	Critical
CVE-2025-64446	Fortinet FortiWeb unauthenticated RCE	fortiweb	9.8 (v3.1)	Critical
CVE-2025-66516	Elasticsearch ingest-attachment Apache Tika XFA XXE Local File Read	tika	9.8 (v3.1)	Critical
CVE-2025-67489	@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development serve	vite-plugin-react	9.8 (v3.1)	Critical
CVE-2026-47323	Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering	camel	9.8 (v3.1)	Critical
CVE-2024-31214	Traccar v5 Remote Code Execution (CVE-2024-31214 and CVE-2024-24809)	traccar	9.6 (v3.1)	Critical
CVE-2026-61568	@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport	gitlab-mcp	9.6 (v3.1)	Critical
CVE-2026-85185	Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root	LXD	9.6 (v3.1)	Critical
CVE-2020-36851	Rob–W cors-anywhere Misconfigured CORS Proxy Allows SSRF	Rob–W / cors-anywhere	9.5 (v4.0)	Critical
CVE-2026-82244	Budibase before 3.41.3 Remote Code Execution via Plugin eval()	server	9.4 (v4.0)	Critical
CVE-2013-10047	MiniWeb (Build 300) Arbitrary File Upload	MiniWeb	9.3 (v4.0)	Critical
CVE-2023-7325	Mingyu Operations and Maintenance Audit and Risk Control System xmlrpc.sock SSRF	Mingyu Operations and Maintenance Audit and Risk Control System	9.3 (v4.0)	Critical
CVE-2025-34100	BuilderEngine Arbitrary File Upload Vulnerability and execution	CMS	9.3 (v4.0)	Critical
CVE-2025-34111	Tiki Wiki Unauthenticated File Upload Vulnerability	tikiwiki cms/groupware	9.3 (v4.0)	Critical
CVE-2025-66039	FreePBX firmware file upload	freepbx	9.3 (v4.0)	Critical
CVE-2025-71336	Flowise - Unsandboxed Remote Code Execution via Custom MCP	flowise	9.3 (v4.0)	Critical
CVE-2026-110536	D-Link DIR-868L HNAP CGI cgibin system os command injection	DIR-868L	9.3 (v4.0)	Critical
CVE-2026-24479	HUSTOJ Admin users can zip-slip problem_import_qduoj.php, planting PHP files in webroot for RCE	hustoj	9.3 (v4.0)	Critical
CVE-2026-65700	h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API	h2ogpt	9.3 (v4.0)	Critical
CVE-2026-17552	Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concaten	Plack::App::Prerender	9.1 (v3.1)	Critical
CVE-2026-86259	OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation	OpenMAIC	9.0 (v4.0)	Critical
CVE-2026-48989	Windows-MCP: HTTP transports expose unauthenticated PowerShell control with wildcard CORS	Windows-MCP	8.9 (v4.0)	High
CVE-2026-50189	Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route	appsmith	8.9 (v4.0)	High
CVE-2018-17553	Navigate CMS Unauthenticated Remote Code Execution	navigate cms	8.8 (v3.0)	High
CVE-2019-12169	ATutor 2.2.4 - Directory Traversal / Remote Code Execution,	atutor	8.8 (v3.1)	High
CVE-2019-12799	Shopware createInstanceFromNamedArguments PHP Object Instantiation RCE	shopware	8.8 (v3.1)	High
CVE-2019-8942	WordPress Crop-image Shell Upload	WordPress	8.8 (v3.0)	High
CVE-2019-9858	Horde Form File Upload Vulnerability	groupware	8.8 (v3.1)	High
CVE-2020-7246	qdPM 9.1 Authenticated Arbitrary PHP File Upload (RCE)	qdpm	8.8 (v3.1)	High
CVE-2022-34876	VICIdial Multiple Authenticated SQLi	vicidial	8.8 (v3.1)	High
CVE-2022-34877	VICIdial Multiple Authenticated SQLi	vicidial	8.8 (v3.1)	High
CVE-2022-34878	VICIdial Multiple Authenticated SQLi	vicidial	8.8 (v3.1)	High
CVE-2023-49084	Cacti RCE via SQLi in pollers.php	cacti	8.8 (v3.1)	High
CVE-2023-49085	Cacti RCE via SQLi in pollers.php	cacti	8.8 (v3.1)	High
CVE-2026-10054	Eclipse Theia Missing Origin Validation in WebSockets Vulnerability	Eclipse Theia	8.8 (v3.1)	High
CVE-2026-116176	vLLM 0.9.2 before 0.24.0 SSRF via X-Request-Id in P2pNcclConnector	vllm	8.8 (v4.0)	High
CVE-2026-84889	A path traversal vulnerability in file handling components could allow an authenticated attacker to write files to arbit	langflow	8.8 (v3.1)	High
CVE-2026-85731	oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)	oras-go	8.8 (v3.1)	High
CVE-2025-57790	Commvault Command-Line Argument Injection to Traversal Remote Code Execution	commvault	8.7 (v4.0)	High
CVE-2026-115935	Control panel only API response emulation replaces "securityKey" and reaches server RCE	cms	8.7 (v4.0)	High
CVE-2026-82270	Portkey AI Gateway Server-Side Request Forgery via /v1/proxy/*	gateway	8.7 (v4.0)	High
CVE-2026-82638	jina-ai reader Server-Side Request Forgery via disabled private-address guard	reader	8.7 (v4.0)	High
CVE-2025-61678	FreePBX firmware file upload	endpointman	8.6 (v4.0)	High
CVE-2026-112371	H3C Magic NX15 RPC esps write code injection	Magic NX15	8.6 (v4.0)	High
CVE-2026-44522	Note Mark: Arbitrary File Write via Path Traversal in Asset Names Leading to Remote Code Execution	note-mark	8.6 (v4.0)	High
CVE-2013-0136	Mutiny 5 Arbitrary File Upload	mutiny	8.5 (v2.0)	High
CVE-2024-24809	Traccar v5 Remote Code Execution (CVE-2024-31214 and CVE-2024-24809)	traccar	8.5 (v3.1)	High
CVE-2024-1708	ConnectWise ScreenConnect Unauthenticated Remote Code Execution	screenconnect	8.4 (v3.1)	High
CVE-2025-54988	Elasticsearch ingest-attachment Apache Tika XFA XXE Local File Read	tika	8.4 (v3.1)	High
CVE-2026-104458	YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses	yeswiki	8.3 (v4.0)	High
CVE-2026-52769	YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`	yeswiki	8.3 (v3.1)	High
CVE-2026-54549	Meta Ads MCP: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch	meta-ads-mcp	8.3 (v3.1)	High
CVE-2021-45841	TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.	tos	8.1 (v3.1)	High
CVE-2026-52831	Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE	nuclio	8.0 (v3.1)	High
CVE-2026-47684	Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP	server	7.7 (v3.1)	High
CVE-2026-71365	Awx: webhook status callback ssrf leaks the git pat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	7.7 (v3.1)	High
CVE-2026-76820	OpenCTI: Synchronizer SSRF: stream fetch has no URL validation	opencti	7.7 (v3.1)	High
CVE-2026-77775	Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation	Headroom	7.7 (v4.0)	High
CVE-2011-4166	HP Managed Printing Administration jobAcct Remote Command Execution	managed printing administration	7.5 (v2.0)	High
CVE-2013-5014	Symantec Endpoint Protection Manager /servlet/ConsoleServlet Remote Command Execution	endpoint protection manager	7.5 (v2.0)	High
CVE-2018-2392	SAP Internet Graphics Server (IGS) XMLCHART XXE	internet graphics server	7.5 (v3.0)	High
CVE-2018-2393	SAP Internet Graphics Server (IGS) XMLCHART XXE	internet graphics server	7.5 (v3.0)	High
CVE-2019-5418	Ruby on Rails Path Traversal and Arbitrary File Read (CVE-2019-5418)	rails	7.5 (v3.1)	High
CVE-2022-24990	TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989	terramaster operating system	7.5 (v3.1)	High
CVE-2023-2825	GitLab Authenticated File Read	gitlab	7.5 (v3.1)	High
CVE-2023-32315	Openfire authentication bypass with RCE plugin	openfire	7.5 (v3.1)	High
CVE-2026-50151	oras-go: credential forwarding via unvalidated Location header in blob upload	oras	7.5 (v3.1)	High
CVE-2024-20767	CVE-2024-20767 - Adobe Coldfusion Arbitrary File Read	coldfusion	7.4 (v3.1)	High
CVE-2022-20707	Cisco RV Series Authentication Bypass and Command Injection	rv340 firmware	7.3 (v3.1)	High
CVE-2026-35587	Glances IP Plugin has SSRF via public_api that leads to credential leakage	glances	7.3 (v4.0)	High
CVE-2020-8260	Pulse Secure VPN gzip RCE	connect secure	7.2 (v3.1)	High
CVE-2025-58034	Fortinet FortiWeb unauthenticated RCE	fortiweb	7.2 (v3.1)	High
CVE-2026-47735	Arc has an authenticated arbitrary local-file read via DuckDB I/O functions that bypasses RBAC table-level checks	arc	7.1 (v4.0)	High
CVE-2025-57788	Commvault Command-Line Argument Injection to Traversal Remote Code Execution	commvault	6.9 (v4.0)	Medium
CVE-2025-57791	Commvault Command-Line Argument Injection to Traversal Remote Code Execution	commvault	6.9 (v4.0)	Medium
CVE-2026-110719	Portkey AI Gateway 1.14.0 through 1.15.2 SSRF via x-portkey-custom-host Header	gateway	6.9 (v4.0)	Medium
CVE-2026-116800	WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header	AVideo	6.9 (v4.0)	Medium
CVE-2026-39383	Gotenberg unauthenticated blind SSRF via unfiltered webhook URL	gotenberg	6.9 (v4.0)	Medium
CVE-2013-5015	Symantec Endpoint Protection Manager /servlet/ConsoleServlet Remote Command Execution	endpoint protection manager	6.5 (v2.0)	Medium
CVE-2015-2994	SysAid Help Desk Administrator Portal Arbitrary File Upload	sysaid	6.5 (v2.0)	Medium
CVE-2017-18357	Shopware createInstanceFromNamedArguments PHP Object Instantiation RCE	shopware	6.5 (v3.0)	Medium
CVE-2019-8943	WordPress Crop-image Shell Upload	WordPress	6.5 (v3.1)	Medium
CVE-2021-45839	TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.	tos	6.5 (v3.1)	Medium
CVE-2026-17557	Lm-evaluation-harness: lm-evaluation-harness: ssrf via job-spec model.url with bearer credential forwarding	Red Hat OpenShift AI (RHOAI)	6.5 (v3.1)	Medium
CVE-2026-111385	Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools	nezha	6.3 (v4.0)	Medium
CVE-2026-72860	9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unre	9router	6.3 (v4.0)	Medium
CVE-2012-6081	MoinMoin twikidraw Action Traversal File Upload	moinmoin	6.0 (v2.0)	Medium
CVE-2013-3631	NAS4Free Arbitrary Remote Code Execution	nas4free	6.0 (v2.0)	Medium
CVE-2026-105743	Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTM	docling	5.8 (v3.1)	Medium
CVE-2020-10977	GitLab File Read Remote Code Execution	gitlab	5.5 (v3.1)	Medium
CVE-2026-7177	ChatGPTNextWeb NextChat route.ts proxyHandler server-side request forgery	nextchat	5.5 (v4.0)	Medium
CVE-2026-7223	BigSweetPotatoStudio HyperChat AI Proxy Middleware aiProxyMiddleware.mts fetch server-side request forgery	HyperChat	5.5 (v4.0)	Medium
CVE-2026-115877	Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value	twisted	5.4 (v3.1)	Medium
CVE-2026-44583	Paymenter: Blind Unauthenticated SSRF on the Paypal gateway module	Paymenter	5.3 (v3.1)	Medium
CVE-2026-85650	Trigger.dev before 4.5.2 Server-Side Request Forgery via webhook alert-channel	trigger.dev	5.3 (v4.0)	Medium
CVE-2026-54430	Server-Site Request Forgery in liboauth2	liboauth2	5.1 (v4.0)	Medium
CVE-2015-1830	Apache ActiveMQ 5.x-5.11.1 Directory Traversal Shell Upload	activemq	5.0 (v2.0)	Medium
CVE-2026-55495	Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account	cloudreve	4.3 (v3.1)	Medium
CVE-2026-86334	CLI Path Traversal via Content-Disposition in LXD Image Export/Copy	LXD	4.2 (v3.1)	Medium
CVE-2014-2424	Oracle Event Processing FileUploadServlet Arbitrary File Upload	fusion middleware	4.0 (v2.0)	Medium
CVE-2025-11990	Improper Handling of URL Encoding (Hex Encoding) in GitLab	gitlab	3.5 (v3.1)	Low
CVE-2026-112076	alexta69 MeTube Feed-metadata Thumbnail Fetch ytdl.py DownloadQueue.__write_feed_metadata_sync server-side request forge	MeTube	2.9 (v4.0)	Low
CVE-2026-42578	Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation	netty	2.9 (v4.0)	Low
CVE-2026-16434	Adminer before 5.5.1 X-Forwarded-Prefix Backslash Bypass	adminer	2.3 (v4.0)	Low
CVE-2026-105329	TallCMS PluginManager ThemeManager.php code injection	TallCMS	2.1 (v4.0)	Low
CVE-2026-15624	nextlevelbuilder GoClaw invoke Endpoint create_video_byteplus.go bytePlusDownloadVideo server-side request forgery	GoClaw	2.1 (v4.0)	Low
CVE-2026-15750	mastergo-design mastergo-magic-mcp mcp__getComponentLink get-component-link.ts z.string server-side request forgery	mastergo-magic-mcp	2.1 (v4.0)	Low
CVE-2026-16124	nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgery	GoClaw	2.1 (v4.0)	Low
CVE-2026-7700	langflow-ai langflow LambdaFilterComponent lambda_filter.py eval code injection	langflow	2.1 (v4.0)	Low
CVE-2026-90580	FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery	flowise	2.1 (v4.0)	Low
CVE-2026-10583	nextlevelbuilder GoClaw TTS Configuration Endpoint tts_config.go import server-side request forgery	GoClaw	2.0 (v4.0)	Low

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

CWE	Related Published CVEs
CWE-20	CVE-2013-4811 , CVE-2013-4812 , CVE-2019-1821 , CVE-2020-3243 , CVE-2020-3250 , CVE-2025-34100 , CVE-2025-34111 , CVE-2026-44522 , CVE-2026-16434
CWE-22	CVE-2011-2653 , CVE-2013-6221 , CVE-2026-66898 , CVE-2014-8741 , CVE-2017-1000002 , CVE-2019-19781 , CVE-2021-21972 , CVE-2023-26469 , CVE-2023-40498 , CVE-2024-23897 , CVE-2026-85185 , CVE-2026-24479 , CVE-2026-65700 , CVE-2018-17553 , CVE-2019-12169 , CVE-2019-9858 , CVE-2020-7246 , CVE-2026-84889 , CVE-2026-85731 , CVE-2026-44522 , CVE-2013-0136 , CVE-2024-1708 , CVE-2011-4166 , CVE-2019-5418 , CVE-2023-2825 , CVE-2023-32315 , CVE-2026-47735 , CVE-2026-116800 , CVE-2019-8943 , CVE-2020-10977 , CVE-2015-1830 , CVE-2026-55495 , CVE-2026-86334 , CVE-2025-11990
CWE-23	CVE-2025-64446
CWE-27	CVE-2024-23897 , CVE-2024-24809
CWE-31	CVE-2024-2044
CWE-36	CVE-2025-57790
CWE-59	CVE-2026-85731
CWE-74	CVE-2022-24989 , CVE-2026-112371 , CVE-2026-105329 , CVE-2026-7700
CWE-77	CVE-2026-110536
CWE-78	CVE-2014-6271 , CVE-2019-9194 , CVE-2025-71336 , CVE-2026-110536 , CVE-2026-52831 , CVE-2025-58034
CWE-88	CVE-2025-57791
CWE-89	CVE-2016-2555 , CVE-2018-17552 , CVE-2022-34876 , CVE-2022-34877 , CVE-2022-34878 , CVE-2023-49085 , CVE-2013-5015
CWE-93	CVE-2026-42578
CWE-94	CVE-2021-41749 , CVE-2025-67489 , CVE-2026-82244 , CVE-2026-115935 , CVE-2026-112371 , CVE-2013-3631 , CVE-2026-105329 , CVE-2026-7700
CWE-98	CVE-2023-49084
CWE-113	CVE-2026-42578
CWE-121	CVE-2022-20705 , CVE-2022-20707
CWE-177	CVE-2025-11990
CWE-178	CVE-2026-47323
CWE-183	CVE-2026-50189
CWE-184	CVE-2026-72860
CWE-200	CVE-2026-47735
CWE-259	CVE-2025-57788
CWE-269	CVE-2020-3243 , CVE-2020-3250
CWE-284	CVE-2024-20767
CWE-287	CVE-2013-1080 , CVE-2020-4427 , CVE-2025-66039 , CVE-2021-45841
CWE-288	CVE-2024-1709
CWE-306	CVE-2023-7325 , CVE-2025-34100 , CVE-2025-34111 , CVE-2026-86259 , CVE-2026-48989 , CVE-2026-10054 , CVE-2022-24990
CWE-350	CVE-2026-61568
CWE-367	CVE-2026-105743
CWE-434	CVE-2020-24186 , CVE-2025-52691 , CVE-2021-3378 , CVE-2024-31214 , CVE-2013-10047 , CVE-2025-34100 , CVE-2025-34111 , CVE-2018-17553 , CVE-2019-8942 , CVE-2020-7246 , CVE-2025-61678 , CVE-2024-24809 , CVE-2020-8260
CWE-444	CVE-2026-115877
CWE-502	CVE-2025-24016 , CVE-2019-12799
CWE-601	CVE-2026-111385
CWE-610	CVE-2017-18357
CWE-611	CVE-2025-66516 , CVE-2025-54988 , CVE-2018-2392 , CVE-2018-2393
CWE-706	CVE-2021-40539
CWE-755	CVE-2017-5638
CWE-787	CVE-2022-20705 , CVE-2022-20707
CWE-791	CVE-2026-47323
CWE-798	CVE-2020-4429 , CVE-2021-45841
CWE-918	CVE-2026-44015 , CVE-2020-36851 , CVE-2023-7325 , CVE-2026-17552 , CVE-2026-86259 , CVE-2026-50189 , CVE-2026-116176 , CVE-2026-82270 , CVE-2026-82638 , CVE-2026-104458 , CVE-2026-52769 , CVE-2026-54549 , CVE-2026-47684 , CVE-2026-71365 , CVE-2026-76820 , CVE-2026-77775 , CVE-2026-50151 , CVE-2026-35587 , CVE-2026-47735 , CVE-2026-110719 , CVE-2026-39383 , CVE-2026-17557 , CVE-2026-72860 , CVE-2026-105743 , CVE-2026-7177 , CVE-2026-7223 , CVE-2026-44583 , CVE-2026-85650 , CVE-2026-54430 , CVE-2026-112076 , CVE-2026-15624 , CVE-2026-15750 , CVE-2026-16124 , CVE-2026-90580 , CVE-2026-10583
CWE-942	CVE-2020-36851
CWE-1385	CVE-2026-10054

Documentation Source

Original wiki page: WAF 390719
Source revision: 2733
Source revision date: 2012-09-20