Skip to content
BackEsc
Sign in

CWE-697 · weakness in Input Validation and Logic

Incorrect Comparison

125 CVEs · 1 exploited

Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.

exploited in the wild
1
check available
1
likely to be exploited
3

Every one of the 125 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. Unraid 6.8.0 allows authentication bypass.CVE-2020-5849Unraid · CVSS 7.5 · 93% likely

    Unraid

  2. SureTriggers – All-in-One Automation Platform ≤ 1.0.78 - Authentication BypassCVE-2025-3102brainstormforce · CVSS 8.1 · 76% likely

    Brainstorm Force

  3. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Auth…CVE-2020-8864D-Link · CVSS 8.8 · 82% likely

    D-Link

  4. Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parse…CVE-2023-32571Dynamic-Linq · 35% likely
  5. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authentication is not requi…CVE-2020-8862D-Link · CVSS 8.8 · 13% likely

    D-Link

  6. SolarWinds Platform Exposed Dangerous Method VulnerabilityCVE-2023-23845SolarWinds · CVSS 6.8 · 5.4% likely

    SolarWinds

  7. SolarWinds Platform Exposed Dangerous Method VulnerabilityCVE-2023-23840SolarWinds · CVSS 6.8 · 5.4% likely

    SolarWinds

  8. Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some p…CVE-2016-100034.8% likely
  9. An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. Thi…CVE-2020-15811Squid-Cache · 3.8% likely

    Squid-Cache

  10. xattr.c in the ext2 and ext3 file system code for Linux kernel 2.6 does not properly compare the name_index fields when sharing xattr blocks, which could prevent default ACLs from…CVE-2005-28013.4% likely
  11. SolarWinds Platform Deserialization of Untrusted Data VulnerabilityCVE-2023-33225SolarWinds · CVSS 7.2 · 3.2% likely

    SolarWinds

  12. NETGEAR WAC104 devices before 1.0.4.15 are affected by an authentication bypass vulnerability in /usr/sbin/mini_httpd, allowing an unauthenticated attacker to invoke any action by…CVE-2021-35973Netgear · CVSS 9.8 · 3.1% likely

    NETGEAR

  13. SolarWinds Platform Incorrect Comparison VulnerabilityCVE-2023-23843SolarWinds · CVSS 7.2 · 2.6% likely

    SolarWinds

  14. Talk 4 in Coral before 4.12.1 allows remote attackers to discover e-mail addresses and other sensitive information via GraphQL because permission checks use an incorrect data type.CVE-2021-35970Voxmedia · 2.3% likely
  15. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-1935 1.03 routers. Authentication is not required to exploit…CVE-2022-43621D-Link · CVSS 8.8 · 2.1% likely

    D-Link

  16. Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20_multi?AC5V1.0 Firmware V15.03.06.48_multi and so on. an attacker can obtain se…CVE-2021-44971Tenda · 2.1% likely

    Tenda

  17. An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about client…CVE-2022-41317Squid-Cache · CVSS 6.5 · 1.8% likely

    Squid-Cache

  18. before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versu…CVE-2021-3116Proxy.py Project · 1.7% likely
  19. An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects.…CVE-2021-34141Numpy · 1.7% likely
  20. An issue was discovered in Proofpoint Email Protection through 2019-09-08. By collecting scores from Proofpoint email headers, it is possible to build a copy-cat Machine Learning…CVE-2019-20634Proofpoint · CVSS 3.7 · 1.6% likely

    Proofpoint

  21. RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server r…CVE-2021-27293Restsharp · 1.5% likely
  22. secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two st…CVE-2015-9238HackerOne · 1.4% likely

    HackerOne

  23. An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.…CVE-2021-39917GitLab · CVSS 4.3 · 1.4% likely

    GitLab

  24. The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.CVE-2020-13485Verbb · 1.4% likely

    Verbb

  25. Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/dart.py.CVE-2020-23478Leoeditor · 1.2% likely
  26. oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/admin/administrators.ph…CVE-2020-23360Oscommerce · 1.2% likely

    Os Commerce

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in