recorded together · two weakness classes
Input Validation and Logic and Misconfiguration and Insecure Design
24 CVEs
24 CVEs name a weakness of both Input Validation and Logic and Misconfiguration and Insecure Design, too few to compare with chance. The pairing most often behind it is CWE-20 (Improper Input Validation) with CWE-693 (Protection Mechanism Failure), in 5 CVEs.
Every dot is a CVE whose record names a weakness from both classes, neither being the other's parent in the CWE hierarchy. The named ones come first: exploited in the wild, then those with a public check, then the likeliest to be.
- CVEs that carry a weakness of both
- 24
- Chance alone would give
- about 34
- So they are recorded together
- too few CVEs to say
A CVE counts when its record names a weakness from each class, neither being the other's parent. It says the two kinds of flaw are recorded together in one vulnerability more or less often than chance: not that one causes the other, and it follows how the people who file CVEs choose CWEs.
How this is weighed, and the sources
Chance is what the two classes' shares of all CVEs that carry weaknesses of two or more classes would give if weaknesses paired at random. A line is drawn on the dial from 25 CVEs and 1.15 times chance. Weaknesses are the CWEs the CVE List and NVD record; exploitation is CISA KEV, likelihood is EPSS.
Every one of the 24 is a mark on the map. Named now: 1 to 24, most at risk first.
- includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arb…
- OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functions
- Interpretation conflict in the Sun Java Virtual Machine (JVM) allows user-assisted remote attackers to conduct a multi-pin DNS rebinding attack and execute arbitrary JavaScript in…
- Unpreventable top-level navigation in Electron
- isolated-vm has vulnerable CachedDataOptions in API
- A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS T…
- Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for
- Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
- mcp-shell: Secure Mode Allowlist Bypass via Default `/bin/bash` Executable
- @bytebase/dbhub's read-only mode does not prevent database writes
- Dash: Users can write to config despire permissions (OIDC tested)
- free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors
- net-imap vulnerable to STARTTLS stripping via invalid response timing
- Improper Certificate Verification in Szafir SDK
- SCRAM: Silent channel-binding authentication downgrade via unsupported certificate algorithms
- Silent channel-binding authentication downgrade via unsupported certificate algorithms
- (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minb…
- Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured
- pam_usb: getenv() used in PAM context allows environment variable injection into local-check logic
- mport audit can inspect the wrong package when options are present
- Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot
- Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot
- In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a logic error in the code. This could lead to local escalation o…
- Sandboxie-Plus: Sandbox containment bypass
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.