CWE-1254 · Information Disclosure
Incorrect Comparison Logic Granularity
6CVEs
SortMost likely exploited
6 CVEs with CWE-1254 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2022-39308GoCD API authentication of user access tokens subject to timing attack during comparisongocd · gocd · CVSS 6.5 · 2022-10-14 | 6.5 | 0.9% | 2022-10-14 |
| CVE-2026-34572CI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)ci4-cms-erp · ci4ms · CVSS 8.8 · 2026-04-01 | 8.8 | 0.5% | 2026-04-01 |
| CVE-2026-34570CI4MS: Account Deletion Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)ci4-cms-erp · ci4ms · CVSS 8.8 · 2026-04-01 | 8.8 | 0.5% | 2026-04-01 |
| CVE-2026-28929A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. Replying to an…Apple · iOS and iPadOS · CVSS 7.5 · 2026-05-11 | 7.5 | 0.4% | 2026-05-11 |
| CVE-2013-10031Plack::Middleware::Session versions before 0.17 for Perl may be vulnerable to HMAC comparison timing attacksMIYAGAWA · Plack::Middleware::Session · CVSS 7.5 · 2025-12-09 | 7.5 | 0.3% | 2025-12-09 |
| CVE-2026-27007OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreationopenclaw · openclaw · CVSS 4.8 · 2026-02-19 | 4.8 | 0.2% | 2026-02-19 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.