CWE-390 · Input Validation and Logic
Detection of Error Condition Without Action
30CVEs
SortMost likely exploited
30 CVEs with CWE-390 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-30255HTTP/2: CPU exhaustion due to CONTINUATION frame floodenvoyproxy · envoy · CVSS 5.3 · 2024-04-04 | 5.3 | 85% | 2024-04-04 |
| CVE-2024-27919HTTP/2: memory exhaustion due to CONTINUATION frame floodenvoyproxy · envoy · CVSS 7.5 · 2024-04-04 | 7.5 | 84% | 2024-04-04 |
| CVE-2025-26465Openssh: machine-in-the-middle attack if verifyhostkeydns is enabledSiemens · OpenSSH · CVSS 6.8 · 2025-02-18 | 6.8 | 7.7% | 2025-02-18 |
| CVE-2019-5051An exploitable heap-based buffer overflow vulnerability exists when loading a PCX file in SDL2_image, version 2.0.4. A missing error handler can lead to a buffer overflow and pote…Libsdl · Simple DirectMedia · CVSS 8.8 · 2019-07-03 | 8.8 | 4.0% | 2019-07-03 |
| CVE-2021-40391An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and the forked version of Gerbv (commit 714…Gerbv Project · Gerbv · CVSS 10 · 2021-11-19 | 10.0 | 3.0% | 2021-11-19 |
| CVE-2017-7485In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL environment variable was no longer enforcing…The PostgreSQL Global Development Group · PostgreSQL · 2017-05-12 | – | 2.0% | 2017-05-12 |
| CVE-2024-12086Rsync: rsync server leaks arbitrary client filesRedhat · rsync · CVSS 6.1 · 2025-01-14 | 6.1 | 1.8% | 2025-01-14 |
| CVE-2026-43493crypto: pcrypt - Fix handling of MAY_BACKLOG requestsLinux · Linux · CVSS 9.8 · 2026-05-19 | 9.8 | 0.7% | 2026-05-19 |
| CVE-2026-53434Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM ConnectorApache Software Foundation · Apache Tomcat · CVSS 9.1 · 2026-06-29 | 9.1 | 0.6% | 2026-06-29 |
| CVE-2026-111823Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.Mage · mage-ai · CVSS 9.8 · 2026-10-16 | 9.8 | 0.6% | 2026-10-16 |
| CVE-2026-114137Django REST framework: TokenProxy.delete() reports success and revokes nothingencode · django-rest-framework · CVSS 7.4 · 2026-10-21 | 7.4 | 0.5% | 2026-10-21 |
| CVE-2024-20316A vulnerability in the data model interface (DMI) services of Cisco IOS XE Software could allow an unauthenticated, remote attacker to access resources that should have been prote…Cisco · Cisco IOS XE Software · CVSS 5.8 · 2024-03-27 | 5.8 | 0.5% | 2024-03-27 |
| CVE-2024-24789Mishandling of corrupt central directory record in archive/zipGo standard library · archive/zip · CVSS 5.3 · 2024-06-05 | 5.3 | 0.4% | 2024-06-05 |
| CVE-2025-25204`gh attestation verify` returns incorrect exit code during verification if no attestations are presentcli · cli · CVSS 6.3 · 2025-02-14 | 6.3 | 0.4% | 2025-02-14 |
| CVE-2026-104480Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membershipDiscord · libdave · CVSS 9.4 · 2026-10-02 | 9.4 | 0.4% | 2026-10-02 |
| CVE-2024-11942Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002Drupal · Drupal Core · CVSS 5.9 · 2024-12-05 | 5.9 | 0.4% | 2024-12-05 |
| CVE-2026-52989nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callersLinux · Linux · CVSS 9.8 · 2026-06-24 | 9.8 | 0.4% | 2026-06-24 |
| CVE-2026-107275@fastify/jwt vulnerable to missing token expiration when temporal options cannot be parsed@fastify/jwt · @fastify/jwt · CVSS 6.8 · 2026-10-08 | 6.8 | 0.3% | 2026-10-08 |
| CVE-2026-29810CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.CyberPanel · CyberPanel · CVSS 4.3 · 2026-09-13 | 4.3 | 0.3% | 2026-09-13 |
| CVE-2026-104002Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python)AWS · powertools-lambda-python · CVSS 5.3 · 2026-10-01 | 5.3 | 0.3% | 2026-10-01 |
| CVE-2026-76642util-linux libmount Privilege Escalation via Failed Mount Helperutil-linux · util-linux · CVSS 7.8 · 2026-09-03 | 7.8 | 0.2% | 2026-09-03 |
| CVE-2026-122192Guest access to Firecracker process memory after a failed memory discardAWS · firecracker · CVSS 7.5 · 2026-11-04 | 7.5 | 0.2% | 2026-11-04 |
| CVE-2025-46367Dell Alienware Command Center 6.x (AWCC), versions prior to 6.10.15.0, contain a Detection of Error Condition Without Action vulnerability. A low privileged attacker with local ac…Dell · Alienware Command Center · CVSS 7.8 · 2025-11-13 | 7.8 | 0.1% | 2025-11-13 |
| CVE-2025-0029Improper handling of error condition during host-induced faults can allow a local high-privileged attack to selectively drop guest DMA writes, potentially resulting in a loss of S…AMD · AMD EPYC™ 9005 Series Processors · CVSS 1.8 · 2026-02-10 | 1.8 | 0.1% | 2026-02-10 |
| CVE-2026-48792pam_usb: pusb_has_virtual_input_device() silently discards EACCES, disabling remote desktop detection under non-root executionmcdope · pam_usb · CVSS 4.4 · 2026-05-27 | 4.4 | 0.1% | 2026-05-27 |
| CVE-2026-62275Detection of error condition without action in the MigTD's vmcall_raw transport for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalati…Intel(R) TDX Migration Trust Domain (MigTD) · CVSS 5.6 · 2026-11-10 | 5.6 | 0.1% | 2026-11-10 |
| CVE-2026-102280Sandboxie-Plus: Sandbox containment bypasssandboxie-plus · Sandboxie · CVSS 6.9 · 2026-11-04 | 6.9 | 0.1% | 2026-11-04 |
| CVE-2024-49841Detection of Error Condition Without Action in HypervisorQualcomm, Inc. · Snapdragon · CVSS 7.8 · 2025-05-06 | 7.8 | 0.1% | 2025-05-06 |
| CVE-2026-59845Libssh: libssh: denial of service via unchecked proxycommand fork() failureRed Hat · Red Hat Enterprise Linux 10 · CVSS 5.3 · 2026-07-21 | 5.3 | 0.1% | 2026-07-21 |
| CVE-2025-27039Detection of Error Condition Without Action in Computer VisionQualcomm, Inc. · Snapdragon · CVSS 6.6 · 2025-10-09 | 6.6 | 0.1% | 2025-10-09 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.