Skip to content

CWE-1285 · weakness in Input Validation and Logic

Improper Validation of Specified Index, Position, or Offset in Input

56 CVEs

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

Every one of the 56 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Missing input check in lvpict.cpp used in NI LabVIEWCVE-2025-7848NI · CVSS 7.8 · 6.1% likely

    NI

  2. NVIDIA CUDA Toolkit SDK contains an integer overflow vulnerability in cuobjdump.To exploit this vulnerability, a remote attacker would require a local user to download a specially…CVE-2022-21821NVIDIA · CVSS 7.8 · 2.1% likely

    NVIDIA

  3. MariaDB: insufficient validation of binary frm data when opening a tableCVE-2026-107821MariaDB · CVSS 8 · 1.2% likelycovered by CyberSIXT

    MariaDB1 article

  4. IBM Tivoli Monitoring code executionCVE-2025-3357IBM · CVSS 9.8 · 1.1% likely

    IBM

  5. A vulnerability has been identified in SIMATIC MV400 family (All Versions < V7.0.6). The underlying TCP stack of the affected products does not correctly validate the sequence num…CVE-2020-25241Siemens · 1.1% likely

    Siemens

  6. Junos OS: QFX10000 Series: In IP/MPLS PHP node scenarios upon receipt of certain crafted packets multiple interfaces in LAG configurations may detach.CVE-2022-22223Juniper Networks · CVSS 6.5 · 0.9% likely

    Juniper Networks

  7. Apache Kafka: Missing JWT token validation in OAUTHBEARER authenticationCVE-2026-33557Apache Software Foundation · CVSS 9.1 · 0.9% likely

    Apache

  8. Information Disclosure and Denial-of-Service(DoS) Vulnerability in MELSEC iQ-F Series CPU moduleCVE-2025-3755Mitsubishi Electric Corporation · CVSS 9.1 · 0.9% likely

    Mitsubishi Electric

  9. SRX5000 Series with SPC3, SRX4000 Series, and vSRX: When PowerMode IPsec is configured, the PFE will crash upon receipt of a malformed ESP packetCVE-2022-22201Juniper Networks · CVSS 7.5 · 0.7% likely

    Juniper Networks

  10. Improper Error Handling Issue in LabVIEWCVE-2024-23612NI · CVSS 7.8 · 0.6% likely

    NI

  11. Improper Error Handling Issue in LabVIEWCVE-2024-23609NI · CVSS 7.8 · 0.6% likely

    NI

  12. Denial of Service (DoS) Vulnerability in Mitsubishi Electric CNC SeriesCVE-2025-2399Mitsubishi Electric Corporation · CVSS 5.9 · 0.6% likely

    Mitsubishi Electric

  13. Arbitrary Files can be installed in the Setting Data Import function of Office / Small Office Multifunction Printers and Laser Printers(*). *:Satera LBP660C Series/LBP620C Series/…CVE-2023-0859Canon Inc. · CVSS 2.2 · 0.5% likely

    Canon Inc.

  14. A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA1) (…CVE-2022-36363Siemens · CVSS 5.3 · 0.5% likely

    Siemens

  15. ZIP64 End of Central Directory (EOCD) Locator record offset not checkedCVE-2025-8291Python Software Foundation · CVSS 4.3 · 0.5% likely

    Python Software Foundation

  16. bhyve(8) infinite loop in the hda audio driverCVE-2024-51564FreeBSD · CVSS 7.5 · 0.5% likely

    FreeBSD

  17. In NextX Duo's snmp addon versions before 6.4.4, a part of the Eclipse Foundation ThreadX, an attacker could cause an out-of-bound read by a crafted SNMPv3 security parameters.CVE-2025-55087Eclipse Foundation · CVSS 6.3 · 0.5% likely

    Eclipse Foundation

  18. In NetXDuo version before 6.4.4, a networking support module for Eclipse Foundation ThreadX, in the DHCPV6 client there was an unchecked index extracting the server DUID from the…CVE-2025-55086Eclipse Foundation · CVSS 6.3 · 0.4% likely

    Eclipse Foundation

  19. bhyve(8) NVMe driver to guest-induced infinite loops.CVE-2024-51566FreeBSD · CVSS 6.5 · 0.4% likely

    FreeBSD

  20. Panic in name constraint checking for malformed certificates in crypto/x509CVE-2026-27138Go standard library · CVSS 5.9 · 0.4% likely

    Go standard library

  21. cpp-httplib DoS: Negative chunk-size in chunked Transfer-EncodingCVE-2026-45352yhirose · CVSS 5.3 · 0.3% likely

    Yhirose

  22. Junos OS: MX Series: An MPC will crash upon receipt of a malformed CFM packet.CVE-2023-36850Juniper Networks · CVSS 6.5 · 0.3% likely

    Juniper Networks

  23. Heap memory out of bounds read and crash in C Driver legacy GridFS file readerCVE-2026-9100MongoDB, Inc. · CVSS 5.9 · 0.3% likely

    MongoDB

  24. Out Of Bounds Write when parsing a DSB file with Digilent DASYLabCVE-2025-9189Digilent · CVSS 7.8 · 0.3% likely

    Digilent

  25. Memory Corruption Issue in NI LabVIEW due to improper error handlingCVE-2025-7849NI · CVSS 7.8 · 0.3% likely

    NI

  26. Softros LAN Messenger 9.2 Denial of Service via Log Files LocationCVE-2018-25232Messenger · CVSS 5.5 · 0.3% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

Updated AboutDevelopersSign in