Skip to content
BackEsc
Sign in

CWE-684 · weakness in Input Validation and Logic

Incorrect Provision of Specified Functionality

31 CVEs

Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

Every one of the 31 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Incorrect cipher key & IV length processingCVE-2023-5363OpenSSL · CVSS 7.5 · 3.9% likely

    OpenSSL

  2. In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request…CVE-2025-47227ScriptCase · CVSS 7.5 · 1.9% likely

    Scriptcase

  3. Incorrect Provision of Specified Functionality in qutebrowserCVE-2020-11054qutebrowser · CVSS 3.5 · 1.5% likely
  4. Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibilityCVE-2026-34478Apache Software Foundation · CVSS 6.9 · 1.0% likely

    Apache

  5. A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGG…CVE-2023-24845Siemens · CVSS 9.1 · 0.7% likely

    Siemens

  6. bt: mesh: vulnerability in provisioning protocol implementation on provisionee sideCVE-2023-4258zephyrproject-rtos · CVSS 8.6 · 0.6% likely

    Zephyrproject-Rtos

  7. FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configuration. But, REST-APIs…CVE-2024-50357Century Systems Co., Ltd. · CVSS 9.8 · 0.6% likely

    Century Systems Co., Ltd.

  8. Incorrect Provision of Specified Functionality vulnerability in MESbookCVE-2024-6425MESbook · CVSS 9.1 · 0.5% likely
  9. ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parserCVE-2026-52735ZcashFoundation · CVSS 9.3 · 0.5% likely

    ZcashFoundation

  10. Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011.CVE-2026-44597torproject · CVSS 3.7 · 0.4% likely

    Torproject

  11. Incorrect Provision of Specified Functionality in GitLabCVE-2024-6502GitLab · CVSS 5.7 · 0.4% likely

    GitLab

  12. Incorrect Provision of Specified Functionality in GitLabCVE-2024-5005GitLab · CVSS 4.3 · 0.4% likely

    GitLab

  13. Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keysCVE-2026-119078Apache Software Foundation · CVSS 9.1 · 0.4% likelycovered by CyberSIXT

    Apache1 article1 article this week: Apache fixes two Commons Codec flaws in version 1.23.0

  14. app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmp_name.CVE-2025-66384MISP · CVSS 8.2 · 0.4% likely

    MISP

  15. Akamai Rate Control alpha before 2025 allows attackers to send requests above the stipulated thresholds because the rate is measured separately for each edge node.CVE-2025-54568Akamai · CVSS 3.7 · 0.4% likely

    Akamai

  16. In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a…CVE-2026-40684Exim · CVSS 5.9 · 0.4% likely

    Exim

  17. In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an inco…CVE-2026-40685Exim · CVSS 6.5 · 0.3% likely

    Exim

  18. Incorrect Provision of Specified Functionality in GitLabCVE-2024-8974GitLab · CVSS 2.6 · 0.3% likely

    GitLab

  19. An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 through 7.0.15, 6.4 all versions may a…CVE-2025-58325Fortinet · CVSS 7.8 · 0.3% likely

    Fortinet

  20. hw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related issue to CVE-2024-26327.CVE-2025-54567QEMU · CVSS 4.2 · 0.3% likely

    QEMU

  21. Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web or…CVE-2026-106361Google · CVSS 6.5 · 0.3% likely

    Google

  22. Incorrect provision of specified functionality in Proxy in Google Chrome on on Windows prior to 152.0.7977.65 allowed an adjacent attacker to potentially obtain sensitive informat…CVE-2026-79126Google · CVSS 5.9 · 0.2% likely

    Google

  23. Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce itCVE-2026-1257290.2% likely
  24. Cisco IOS XR Software Layer 2 Services Denial of Service VulnerabilityCVE-2024-20317Cisco · CVSS 7.4 · 0.2% likely

    Cisco

  25. Possible dos from guest to host invringh_kiov_advance in vhost driver at drivers/vhost/vringh.cCVE-2023-5158Linux · CVSS 6.5 · 0.2% likely

    Linux

  26. Technitium DNS Server before 15.0 allows DNS traffic amplification via cyclic name server delegation.CVE-2026-42255Technitium · CVSS 7.2 · 0.2% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in