CWE-252 in Input Validation and Logic
- CVEs
- 182
- Exploited
- 0
- Public check
- 0
- Likely
- 3
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2021-38114libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init_vlc function, a similar issue to CVE-2013-0868. | Ffmpeg · Ffmpeg | Unlikely | – | 1.0% | 2021-08-04 |
| CVE-2023-24825RIOT-OS vulnerable to NULL pointer dereference in gnrc_pktbuf_mark | RIOT-OS · RIOT | Unlikely | 7.5 | 1.0% | 2023-05-30 |
| CVE-2021-28675An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could… | Python · Pillow | Unlikely | – | 1.0% | 2021-06-02 |
| CVE-2021-37625Incorrect Check of Function Return Value in Skytable | skytable · skytable | Unlikely | 7.5 | 0.9% | 2021-08-05 |
| CVE-2021-34585CODESYS V2 web server: crafted requests could trigger a pointer dereference with an invalid address (DoS) | CODESYS · CODESYS V2 | Unlikely | 7.5 | 0.9% | 2021-10-26 |
| CVE-2023-44322A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8… | Siemens · RUGGEDCOM RM1224 LTE(4G) EU | Unlikely | 3.7 | 0.9% | 2023-11-14 |
| CVE-2022-38936An issue has been found in PBC through 2022-8-27. A SEGV issue detected in the function pbc_wmessage_integer in src/wmessage.c:137. | Pbc Project · Pbc | Unlikely | 7.5 | 0.9% | 2022-09-23 |
| CVE-2025-55146An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Se… | Ivanti · Connect Secure | Unlikely | 4.9 | 0.8% | 2025-09-09 |
| CVE-2024-37039CWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the device when an attacker sends a specially crafted HTTP request. | Schneider Electric · Sage 1410 | Unlikely | 5.9 | 0.8% | 2024-06-12 |
| CVE-2021-29853IBM Planning Analytics 2.0 could expose information that could be used to to create attacks by not validating the return values from some methods or functions. IBM X-Force ID: 205… | IBM · Planning Analytics Local | Unlikely | 4.3 | 0.8% | 2021-09-01 |
| CVE-2026-110353HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in… | HAProxy · HAProxy | Unlikely | 7.5 | 0.7% | 2026-10-22 |
| CVE-2026-11972tarfile opened in streaming mode mishandles EOF | Python Software Foundation · CPython | Unlikely | 8.2 | 0.7% | 2026-06-23 |
| CVE-2026-22861iccDEV has a heap-buffer-overflow in SIccCalcOp::Describe() at IccProfLib/IccMpeCalc.cpp | InternationalColorConsortium · iccDEV | Unlikely | 8.8 | 0.7% | 2026-01-13 |
| CVE-2023-3247Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP | PHP Group · PHP | Unlikely | 2.6 | 0.7% | 2023-07-22 |
| CVE-2023-44182Junos OS and Junos OS Evolved: An Unchecked Return Value in multiple users interfaces affects confidentiality and integrity of device operations | Juniper Networks · Junos OS | Unlikely | 7.3 | 0.7% | 2023-10-12 |
| CVE-2017-0599A remote denial of service vulnerability in libhevc in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated a… | Google Inc. · Android | Unlikely | – | 0.7% | 2017-05-12 |
| CVE-2019-9372In libskia, there is a possible crash due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is… | Google · Android | Unlikely | – | 0.7% | 2019-09-27 |
| CVE-2026-121639WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service | WatchGuard · AuthPoint Authentication Gateway | Unlikely | 9.2 | 0.7% | 2026-11-04 |
| CVE-2026-40092nimiq-keys: Unchecked Ed25519 signature length in TaggedPublicKey::verify causes remote node panic via DHT | nimiq · core-rs-albatross | Unlikely | 7.5 | 0.6% | 2026-05-20 |
| CVE-2025-58903An Unchecked Return Value vulnerability [CWE-252] in Fortinet FortiOS version 7.6.0 through 7.6.3 and before 7.4.8 API allows an authenticated user to cause a Null Pointer Derefer… | Fortinet · FortiOS | Unlikely | 2.5 | 0.6% | 2025-10-14 |
| CVE-2023-25733The return value from `gfx::SourceSurfaceSkia::Map()` wasn't being verified which could have potentially lead to a null pointer dereference. This vulnerability affects Firefox < 1… | Mozilla · Firefox | Unlikely | 7.5 | 0.6% | 2023-06-19 |
| CVE-2022-43765DoS in APROLs Tbase server | B&R Industrial Automation · B&R APROL | Unlikely | 7.5 | 0.6% | 2023-02-08 |
| CVE-2022-43763Lack of checking preconditions in APROL | B&R Industrial Automation · B&R APROL | Unlikely | 7.5 | 0.6% | 2023-02-08 |
| CVE-2023-52687crypto: safexcel - Add error handling for dma_map_sg() calls | Linux · Linux | Unlikely | 9.8 | 0.6% | 2024-05-17 |
| CVE-2024-42491A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used | asterisk · asterisk | Unlikely | 5.7 | 0.6% | 2024-09-05 |
| CVE-2023-37902Vyper's ecrecover can return undefined data if signature does not verify | vyperlang · vyper | Unlikely | 5.3 | 0.6% | 2023-07-25 |
| CVE-2026-26080HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected. | HAProxy · HAProxy | Unlikely | 3.7 | 0.5% | 2026-07-20 |
| CVE-2025-46672NASA CryptoLib before 1.3.2 does not check the OTAR crypto function returned status, potentially leading to spacecraft hijacking. | NASA · CryptoLib | Unlikely | 3.5 | 0.5% | 2025-04-27 |
| CVE-2024-38427In International Color Consortium DemoIccMAX before 85ce74e, a logic flaw in CIccTagXmlProfileSequenceId::ParseXml in IccXML/IccLibXML/IccTagXml.cpp results in unconditionally ret… | – | Unlikely | 8.8 | 0.5% | 2024-06-16 |
| CVE-2026-35468nimiq/core-rs-albatross: Panic in history index request handlers when a full node runs without the history index | nimiq · core-rs-albatross | Unlikely | 5.3 | 0.5% | 2026-04-03 |
| CVE-2024-45419Zoom Apps - Improper Input Validation | Zoom Communications Inc. · Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers | Unlikely | 8.1 | 0.5% | 2024-11-19 |
| CVE-2025-66565Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values | gofiber · utils | Unlikely | 9.3 | 0.5% | 2025-12-09 |
| CVE-2022-25718Cryptographic issue in WLAN due to improper check on return value while authentication handshake in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Conne… | Qualcomm, Inc. · Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Conne… | Unlikely | 9.1 | 0.5% | 2022-10-19 |
| CVE-2026-21920Junos OS: SRX Series: If a specific request is processed by the DNS subsystem flowd will crash | Juniper Networks · Junos OS | Unlikely | 7.5 | 0.5% | 2026-01-15 |
| CVE-2026-29905Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed image upload. The application fails to… | Getkirby · Kirby | Unlikely | 6.5 | 0.5% | 2026-03-26 |
| CVE-2017-6964dmcrypt-get-device, as shipped in the eject package of Debian and Ubuntu, does not check the return value of the (1) setuid or (2) setgid function, which might cause dmcrypt-get-d… | Debian · Debian Linux | Unlikely | – | 0.5% | 2017-03-28 |
| CVE-2025-62785Wazuh fillData NULL pointer dereference causes analysisd crash | wazuh · wazuh | Unlikely | 6.9 | 0.4% | 2025-10-29 |
| CVE-2007-5191mount and umount in util-linux and loop-aes-utils call the setuid and setgid functions in the wrong order and do not check the return values, which might allow attackers to gain p… | Kernel · Util-Linux | Unlikely | – | 0.4% | 2007-10-04 |
| CVE-2022-30783An invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic between NTFS-3G and the kernel in NTFS-3G through 2021.8.22 when using libfuse-lite. | Tuxera · Ntfs-3g | Unlikely | – | 0.4% | 2022-05-26 |
| CVE-2024-8110Denial of Service (DoS) vulnerability has been found in Dual-redundant Platform for Computer. If a computer on which the affected product is installed receives a large number of U… | Yokogawa Electric Corporation · Dual-redundant Platform for Computer (PC2CKM) | Unlikely | 7.5 | 0.4% | 2024-09-17 |
| CVE-2021-31366Junos OS: MX Series: In subscriber management / BBE configuration authd can crash if a subscriber with a specific username tries to login leading to a DoS | Juniper Networks · Junos OS | Unlikely | 6.5 | 0.4% | 2021-10-19 |
| CVE-2026-67409RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS | rabbitmq · rabbitmq-server | Unlikely | 8.2 | 0.4% | 2026-09-25 |
| CVE-2023-40303GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd. This is, for ex… | Gnu · Inetutils | Unlikely | – | 0.4% | 2023-08-14 |
| CVE-2025-62789Wazuh vulnerable to NULL pointer dereference in fim_alert line 712 | wazuh · wazuh | Unlikely | 6.9 | 0.4% | 2025-10-29 |
| CVE-2026-28691ImageMagick has an uninitialized pointer dereference in JBIG decoder | ImageMagick · ImageMagick | Unlikely | 7.5 | 0.4% | 2026-03-09 |
| CVE-2026-118263Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests | labstack · echo | Unlikely | 6.3 | 0.4% | 2026-10-28 |
| CVE-2025-64169Wazuh NULL pointer dereference in fim_alert line 666 | wazuh · wazuh | Unlikely | 5.1 | 0.4% | 2025-11-21 |
| CVE-2025-0518Unchecked sscanf return value which leads to memory data leak | FFmpeg · FFmpeg | Unlikely | 4.8 | 0.4% | 2025-01-16 |
| CVE-2026-34065nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals | nimiq · nimiq-primitives | Unlikely | 7.5 | 0.4% | 2026-04-22 |
| CVE-2025-25724list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafte… | libarchive · libarchive | Unlikely | 4.0 | 0.4% | 2025-03-02 |
Data as of 2026-11-14.