CWE-253 · Input Validation and Logic
Incorrect Check of Function Return Value
22CVEs
SortMost likely exploited
22 CVEs with CWE-253 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2017-7474It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restr…Red Hat, Inc. · Keycloak Node.js adapter · 2017-05-12 | – | 2.5% | 2017-05-12 |
| CVE-2024-43521Windows Hyper-V Denial of Service VulnerabilityMicrosoft · Windows Server 2012 · CVSS 7.5 · 2024-10-08 | 7.5 | 2.4% | 2024-10-08 |
| CVE-2020-6107An exploitable information disclosure vulnerability exists in the dev_read functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause an uninitializ…F2fs-Tools Project · F2fs-Tools · CVSS 4.4 · 2020-10-15 | 4.4 | 1.5% | 2020-10-15 |
| CVE-2022-24880Potential Captcha Validate Bypass in flask-session-captchaTethik · flask-session-captcha · CVSS 5.3 · 2022-04-25 | 5.3 | 1.2% | 2022-04-25 |
| CVE-2026-15686Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution VulnerabilityAdminer · Adminer · CVSS 7.2 · 2026-08-20 | 7.2 | 1.1% | 2026-08-20 |
| CVE-2023-24487Arbitrary file readCitrix · Citrix ADC and Citrix Gateway · CVSS 6.3 · 2023-07-10 | 6.3 | 1.1% | 2023-07-10 |
| CVE-2024-1622Routinator terminates when RTR connection is reset too quickly after openingNLnet Labs · Routinator · CVSS 7.5 · 2024-02-26 | 7.5 | 1.0% | 2024-02-26 |
| CVE-2023-34449ink! vulnerable to incorrect decoding of storage value when using `DelegateCall`paritytech · ink · CVSS 5.3 · 2023-06-14 | 5.3 | 1.0% | 2023-06-14 |
| CVE-2026-35091Corosync: corosync: denial of service and information disclosure via crafted udp packetRed Hat · Red Hat Enterprise Linux 10 · CVSS 8.2 · 2026-04-01 | 8.2 | 0.9% | 2026-04-01 |
| CVE-2025-54090Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64Apache Software Foundation · Apache HTTP Server · CVSS 6.3 · 2025-07-23 | 6.3 | 0.9% | 2025-07-23 |
| CVE-2023-52040An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_41284C function.Totolink · X6000r Firmware · CVSS 8.8 · 2024-01-24 | 8.8 | 0.9% | 2024-01-24 |
| CVE-2024-32475Envoy RELEASE_ASSERT using auto_sni with :authority header > 255 bytesenvoyproxy · envoy · CVSS 7.5 · 2024-04-18 | 7.5 | 0.7% | 2024-04-18 |
| CVE-2025-57767Asterisk can crash from a specifically malformed Authorization header in an incoming SIP requestasterisk · asterisk · CVSS 7.5 · 2025-08-28 | 7.5 | 0.4% | 2025-08-28 |
| CVE-2026-59847Libssh: libssh: integrity downgrade via openssl aes-gcm tag verificationRed Hat · Red Hat Enterprise Linux 10 · CVSS 5.9 · 2026-07-21 | 5.9 | 0.3% | 2026-07-21 |
| CVE-2026-103932ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-matchowasp-modsecurity · ModSecurity · CVSS 5.8 · 2026-11-05 | 5.8 | 0.3% | 2026-11-05 |
| CVE-2026-46419Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor flow, leading to impersonation.Yubico · webauthn-server-core · CVSS 7.5 · 2026-05-14 | 7.5 | 0.3% | 2026-05-14 |
| CVE-2026-5818MCU Firmware Update Authentication Bypass on Caliptra CoreCaliptra · Core Runtime Firmware · CVSS 7.2 · 2026-06-23 | 7.2 | 0.2% | 2026-06-23 |
| CVE-2026-43863mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.mutt · mutt · CVSS 3.7 · 2026-05-04 | 3.7 | 0.2% | 2026-05-04 |
| CVE-2026-35339uutils coreutils chmod False Success Exit Code in Recursive ModeUutils · coreutils · CVSS 5.5 · 2026-04-22 | 5.5 | 0.1% | 2026-04-22 |
| CVE-2026-35340uutils coreutils chown and chgrp False Success Exit Code in Recursive ModeUutils · coreutils · CVSS 5.5 · 2026-04-22 | 5.5 | 0.1% | 2026-04-22 |
| CVE-2026-53090bpf: Fix ld_{abs,ind} failure path analysis in subprogsLinux · Linux · CVSS 7.8 · 2026-06-24 | 7.8 | 0.1% | 2026-06-24 |
| CVE-2026-0648The vulnerability stems from an incorrect error-checking logic in the CreateCounter() function (in threadx/utility/rtos_compatibility_layers/OSEK/tx_osek.c) when handling the retu…Eclipse Foundation · Eclipse ThreadX · CVSS 7.8 · 2026-01-27 | 7.8 | 0.1% | 2026-01-27 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.