Skip to content

CWE-480 · weakness in Input Validation and Logic

Use of Incorrect Operator

11 CVEs

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

Every one of the 11 is a mark on the map. Named now: 1 to 11, most at risk first.

  1. Use of Incorrect Operator in polonel/trudeskCVE-2022-1947polonel · CVSS 9.1 · 1.3% likely

    Polonel

  2. DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on textCVE-2026-15043HMBRAND · CVSS 9.8 · 0.7% likely

    HMBRAND

  3. Keystone: `graphql.maxTake` bypass with negative `take`CVE-2026-63421keystonejs · CVSS 7.5 · 0.7% likely

    Keystonejs

  4. Envoy: Abnormal process termination in DNS UDP filterCVE-2026-48497envoyproxy · CVSS 5.9 · 0.4% likely

    Envoyproxy

  5. netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiryCVE-2026-43114Linux · CVSS 9.4 · 0.4% likely

    Linux

  6. Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Incorrect Operator vulnerability. An unauthentica…CVE-2026-79643Dell · CVSS 7.3 · 0.3% likely

    Dell

  7. Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.CVE-2026-83525Apache Software Foundation · CVSS 6.5 · 0.3% likely

    Apache

  8. Junos OS Evolved: When a control-plane firewall filter refers to a prefix-list with more than 10 entries it's not matchingCVE-2025-52985Juniper Networks · CVSS 5.3 · 0.3% likely

    Juniper Networks

  9. Hickory DNS 0.26.0-beta.1 before 0.26.2 NSEC3 Proof of Nonexistence ForgeryCVE-2026-123601hickory-dns · CVSS 6.5 · 0.3% likely

    Hickory-Dns

  10. pf silently ignores certain rulesCVE-2026-4748FreeBSD · CVSS 7.5 · 0.3% likely

    FreeBSD

  11. pyzipper: Encryption bypass for small files encrypted with pyzipperCVE-2026-44722danifus · CVSS 6.2 · 0.1% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

Updated AboutDevelopersSign in