CWE-390 · weakness in Input Validation and Logic
Detection of Error Condition Without Action
30 CVEs
Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- likely to be exploited
- 2
Every one of the 30 is a mark on the map. Named now: 1 to 26, most at risk first.
- HTTP/2: CPU exhaustion due to CONTINUATION frame flood
- HTTP/2: memory exhaustion due to CONTINUATION frame flood
- Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled
- An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and pote…
- An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and the forked version of Gerbv (commit 714…
- In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing…
- Rsync: rsync server leaks arbitrary client files
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests
- Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector
- Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
- Django REST framework: TokenProxy.delete() reports success and revokes nothing
- A vulnerability in the data model interface (DMI) services of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access resources that should have been prote…
- Mishandling of corrupt central directory record in archive/zip
- `gh attestation verify` returns incorrect exit code during verification if no attestations are present
- Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membership
- Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002
- nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers
- @fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed
- CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.
- Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)
- util-linux libmount Privilege Escalation via Failed Mount Helper
- Guest access to Firecracker process memory after a failed memory discard
- Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Detection of Error Condition Without Action vulnerability. A low privileged attacker with local ac…
- Improper handling of error condition during host-induced faults can allow a local high-privileged attack to selectively drop guest DMA writes, potentially resulting in a loss of S…
- pam_usb: pusb_has_virtual_input_device() silently discards EACCES, disabling remote desktop detection under non-root execution
- Detection of error condition without action in the MigTD's vmcall_raw transport for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalati…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.