CWE-1025 · Input Validation and Logic
Comparison Using Wrong Factors
21CVEs
SortMost likely exploited
21 CVEs with CWE-1025 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-9681HSTS subdomain overwrites parent cache entrycurl · curl · CVSS 5.9 · 2024-11-06 | 5.9 | 2.0% | 2024-11-06 |
| CVE-2025-32464HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the replacement of multiple short patt…HAProxy · HAProxy · CVSS 6.8 · 2025-04-09 | 6.8 | 0.8% | 2025-04-09 |
| CVE-2025-71377stoatchat before 20250210-1 Unrestricted Message History Fetchstoatchat · stoatchat · CVSS 8.7 · 2026-07-16 | 8.7 | 0.7% | 2026-07-16 |
| CVE-2026-9800Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparisonRed Hat · Red Hat build of Keycloak 26.4 · CVSS 8.1 · 2026-06-25 | 8.1 | 0.7% | 2026-06-25 |
| CVE-2023-54390PocketMine-MP before 5.3.1 Denial of Service via LoginPacketpmmp · PocketMine-MP · CVSS 7.5 · 2026-09-09 | 7.5 | 0.6% | 2026-09-09 |
| CVE-2024-20342Cisco Firepower Threat Defense Software Rate Filter Bypass VulnerabilityCisco · Cisco Firepower Threat Defense Software · CVSS 5.8 · 2024-10-23 | 5.8 | 0.5% | 2024-10-23 |
| CVE-2026-75840ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped RegexArcadeData · arcadedb · CVSS 7.5 · 2026-08-18 | 7.5 | 0.4% | 2026-08-18 |
| CVE-2026-93854In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id} and DELETE /v2/lease…OpenStack · Blazar · CVSS 7.2 · 2026-09-18 | 7.2 | 0.4% | 2026-09-18 |
| CVE-2026-100248The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin.Rattadan · Cosmowarp Contract · CVSS 8.4 · 2026-09-25 | 8.4 | 0.4% | 2026-09-25 |
| CVE-2026-125271AWS API MCP Server Security Policy Bypass via Incorrect Operation Name NormalizationAWS · aws-api-mcp-server · CVSS 7.8 · 2026-11-10 | 7.8 | 0.4% | 2026-11-10 |
| CVE-2025-27839operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation (genuineness check) that causes verification r…Tangem · SDK · CVSS 3.2 · 2025-03-07 | 3.2 | 0.4% | 2025-03-07 |
| CVE-2026-14441Logic flaw in SANnav Java cache key handling object comparison handlingBrocade · SANnav · CVSS 6.9 · 2026-09-24 | 6.9 | 0.4% | 2026-09-24 |
| CVE-2026-29811CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query fi…CyberPanel · CyberPanel · CVSS 7.7 · 2026-09-13 | 7.7 | 0.3% | 2026-09-13 |
| CVE-2025-2888Improper timestamp caching during snapshot rollback in toughAWS · tough · CVSS 5.7 · 2025-03-27 | 5.7 | 0.3% | 2025-03-27 |
| CVE-2025-2887Failure to detect delegated target rollback in toughAWS · tough · CVSS 5.7 · 2025-03-27 | 5.7 | 0.3% | 2025-03-27 |
| CVE-2026-104048Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluationRed Hat · Red Hat Enterprise Linux 10 · CVSS 6.8 · 2026-10-06 | 6.8 | 0.3% | 2026-10-06 |
| CVE-2026-123592Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Name Hash Collisionhickory-dns · hickory-dns · CVSS 5.9 · 2026-11-08 | 5.9 | 0.3% | 2026-11-08 |
| CVE-2026-40880Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip BlocksZcashFoundation · zebrad · CVSS 7.2 · 2026-04-21 | 7.2 | 0.3% | 2026-04-21 |
| CVE-2026-48860Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_distErlang · OTP · CVSS 7.5 · 2026-06-10 | 7.5 | 0.2% | 2026-06-10 |
| CVE-2026-40227In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element.systemd · systemd · CVSS 6.2 · 2026-04-10 | 6.2 | 0.2% | 2026-04-10 |
| CVE-2026-114649Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cacheMongoDB · C# Driver · CVSS 6.8 · 2026-10-22 | 6.8 | 0.2% | 2026-10-22 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.