CWE-228 · Input Validation and Logic
Improper Handling of Syntactically Invalid Structure
23CVEs
SortMost likely exploited
23 CVEs with CWE-228 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2018-5381The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgp_packet.c:bgp_capability_msg_parse function. The par…Quagga · bgpd · CVSS 6.5 · 2018-02-19 | 6.5 | 30% | 2018-02-19 |
| CVE-2021-38443Eclipse CycloneDDS Improper Handling of Syntactically Invalid StructureEclipse · CycloneDDS · CVSS 6.6 · 2022-05-05 | 6.6 | 2.1% | 2022-05-05 |
| CVE-2020-27847A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentica…Linuxfoundation · dexidp/dex · 2021-05-28 | – | 1.7% | 2021-05-28 |
| CVE-2021-36199VideoEdgeJohnson Controls · VideoEdge · CVSS 5.3 · 2022-01-14 | 5.3 | 1.1% | 2022-01-14 |
| CVE-2026-42100DoS in Sparx Pro Cloud ServerSparx Systems · Pro Cloud Server · CVSS 7.1 · 2026-05-19 | 7.1 | 0.7% | 2026-05-19 |
| CVE-2025-22865ParsePKCS1PrivateKey panic with partial keys in crypto/x509Go standard library · crypto/x509 · CVSS 7.5 · 2025-01-28 | 7.5 | 0.6% | 2025-01-28 |
| CVE-2026-87986An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed port…mistralai · mistral-vibe · CVSS 10 · 2026-09-11 | 10.0 | 0.6% | 2026-09-11 |
| CVE-2024-21612Junos OS Evolved: Specific TCP traffic causes OFP core and restart of REJuniper Networks · Junos OS Evolved · CVSS 7.5 · 2024-01-12 | 7.5 | 0.5% | 2024-01-12 |
| CVE-2024-55594An improper handling of syntactically invalid structure in Fortinet FortiWeb at least vesrions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacke…Fortinet · FortiWeb · CVSS 5.5 · 2025-03-14 | 5.5 | 0.5% | 2025-03-14 |
| CVE-2026-34232Firebird: DoS via `op_response` packet from clientFirebirdSQL · firebird · CVSS 7.5 · 2026-04-17 | 7.5 | 0.5% | 2026-04-17 |
| CVE-2026-107299msgpack5: Reserved byte can cause unbounded stream bufferingmcollina · msgpack5 · CVSS 5.9 · 2026-10-08 | 5.9 | 0.4% | 2026-10-08 |
| CVE-2023-42784An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10 allows attacker…Fortinet · FortiWeb · CVSS 5.5 · 2025-03-11 | 5.5 | 0.4% | 2025-03-11 |
| CVE-2024-53828Ericsson Packet Core Controller (PCC) - Improper Handling of Syntactically Invalid Structure VulnerabilityEricsson · Packet Core Controller (PCC) · CVSS 5.3 · 2026-04-01 | 5.3 | 0.4% | 2026-04-01 |
| CVE-2025-0343Swift ASN.1 can be caused to crash when parsing certain BER/DER constructions. This crash is caused by a confusion in the ASN.1 library itself which assumes that certain objects c…Swift Project · Swift ASN1 · CVSS 7.5 · 2025-01-15 | 7.5 | 0.3% | 2025-01-15 |
| CVE-2026-20125A vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E could allow an authenticated, remote attacker to cause an affected device to…Cisco · IOS · CVSS 7.7 · 2026-03-25 | 7.7 | 0.3% | 2026-03-25 |
| CVE-2024-6382Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands.MongoDB Inc · MongoDB Rust Driver · CVSS 6.4 · 2024-07-02 | 6.4 | 0.3% | 2024-07-02 |
| CVE-2026-50103Improper Handling of Syntactically Invalid Structure in MZ Automation libIEC61850MZ Automation · libIEC61850 · CVSS 6.5 · 2026-07-23 | 6.5 | 0.3% | 2026-07-23 |
| CVE-2025-47736dialect/mod.rs in the libsql-sqlite3-parser crate through 0.13.0 before 14f422a for Rust can crash if the input is not valid UTF-8.gwenn · libsql-sqlite3-parser · CVSS 2.9 · 2025-05-09 | 2.9 | 0.3% | 2025-05-09 |
| CVE-2024-22809Incorrect access control in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to access the G code's shared folder and view sensitive information.Tormach · Pathpilot Controller · CVSS 6.5 · 2024-04-22 | 6.5 | 0.3% | 2024-04-22 |
| CVE-2024-22815An issue in the communication protocol of Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) via crafted commands.Tormach · Pathpilot Controller · CVSS 5.3 · 2024-04-22 | 5.3 | 0.2% | 2024-04-22 |
| CVE-2025-2529IBM Terracotta denial of serviceIBM · Terracotta · CVSS 2.9 · 2025-10-15 | 2.9 | 0.2% | 2025-10-15 |
| CVE-2026-25657Ericsson Packet Core Gateway (PCG) - Improper Handling of Syntactically Invalid Structure VulnerabilityEricsson · Packet Core Gateway (PCG) · CVSS 7.1 · 2026-06-05 | 7.1 | 0.2% | 2026-06-05 |
| CVE-2025-59174Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability where an attacker sending a large volume of specially crafted messages may cause service degra…Ericsson · Packet Core Controller · CVSS 6.5 · 2026-06-05 | 6.5 | 0.2% | 2026-06-05 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.