CWE-480 · weakness in Input Validation and Logic
Use of Incorrect Operator
11 CVEs
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
Every one of the 11 is a mark on the map. Named now: 1 to 11, most at risk first.
- Use of Incorrect Operator in polonel/trudesk
- DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text
- Keystone: `graphql.maxTake` bypass with negative `take`
- Envoy: Abnormal process termination in DNS UDP filter
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
- Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Incorrect Operator vulnerability. An unauthentica…
- Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.
- Junos OS Evolved: When a control-plane firewall filter refers to a prefix-list with more than 10 entries it's not matching
- Hickory DNS 0.26.0-beta.1 before 0.26.2 NSEC3 Proof of Nonexistence Forgery
- pf silently ignores certain rules
- pyzipper: Encryption bypass for small files encrypted with pyzipper
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.