CWE-391 · Input Validation and Logic
25CVEs
SortMost likely exploited
25 CVEs with CWE-391 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-52316Apache Tomcat: Authentication bypass when using Jakarta Authentication APIApache Software Foundation · Apache Tomcat · CVSS 9.8 · 2024-11-18 | 9.8 | 6.2% | 2024-11-18 |
| CVE-2017-12183xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.The X.Org Foundation · xorg-x11-server · 2018-01-24 | – | 4.5% | 2018-01-24 |
| CVE-2017-12180xorg-x11-server before 1.19.5 was missing length validation in XFree86 VidModeExtension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.The X.Org Foundation · xorg-x11-server · 2018-01-24 | – | 4.5% | 2018-01-24 |
| CVE-2017-12178xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy function allowing malicious X client to cause X server to crash or possibly execute arbitrary c…The X.Org Foundation · xorg-x11-server · 2018-01-24 | – | 4.4% | 2018-01-24 |
| CVE-2017-12179xorg-x11-server before 1.19.5 was vulnerable to integer overflow in (S)ProcXIBarrierReleasePointer functions allowing malicious X client to cause X server to crash or possibly exe…The X.Org Foundation · xorg-x11-server · 2018-01-24 | – | 4.4% | 2018-01-24 |
| CVE-2017-12177xorg-x11-server before 1.19.5 was vulnerable to integer overflow in ProcDbeGetVisualInfo function allowing malicious X client to cause X server to crash or possibly execute arbitr…The X.Org Foundation · xorg-x11-server · 2018-01-24 | – | 4.4% | 2018-01-24 |
| CVE-2017-12186xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.The X.Org Foundation · xorg-x11-server · 2018-01-24 | – | 4.3% | 2018-01-24 |
| CVE-2017-12182xorg-x11-server before 1.19.5 was missing length validation in XFree86 DRI extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.The X.Org Foundation · xorg-x11-server · 2018-01-24 | – | 4.2% | 2018-01-24 |
| CVE-2017-12181xorg-x11-server before 1.19.5 was missing length validation in XFree86 DGA extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.The X.Org Foundation · xorg-x11-server · 2018-01-24 | – | 4.2% | 2018-01-24 |
| CVE-2017-12185xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.X.org · X Server · 2018-01-24 | – | 4.2% | 2018-01-24 |
| CVE-2017-12184xorg-x11-server before 1.19.5 was missing length validation in XINERAMA extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.The X.Org Foundation · xorg-x11-server · 2018-01-24 | – | 4.2% | 2018-01-24 |
| CVE-2017-12176xorg-x11-server before 1.19.5 was missing extra length validation in ProcEstablishConnection function allowing malicious X client to cause X server to crash or possibly execute ar…The X.Org Foundation · xorg-x11-server · 2018-01-24 | – | 4.2% | 2018-01-24 |
| CVE-2017-12187xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.The X.Org Foundation · xorg-x11-server · 2018-01-24 | – | 3.3% | 2018-01-24 |
| CVE-2019-14853An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at…Python-Ecdsa Project · python-ecdsa · CVSS 3.7 · 2019-11-26 | 3.7 | 2.4% | 2019-11-26 |
| CVE-2020-14383A flaw was found in samba's DNS server. An authenticated user could use this flaw to the RPC server to crash. This RPC server, which also serves protocols other than dnsserver, wi…Samba · samba · 2020-12-02 | – | 2.2% | 2020-12-02 |
| CVE-2016-10526A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.…HackerOne · grunt-gh-pages node module · 2018-05-31 | – | 1.6% | 2018-05-31 |
| CVE-2023-0572Unchecked Error Condition in froxlor/froxlorfroxlor · froxlor/froxlor · CVSS 5.3 · 2023-01-29 | 5.3 | 0.7% | 2023-01-29 |
| CVE-2025-71325picklescan - Detection Bypass via STACK_GLOBAL Opcode Parsing Logic Flawpicklescan · picklescan · CVSS 9.8 · 2026-06-17 | 9.8 | 0.6% | 2026-06-17 |
| CVE-2026-74900openssl_encrypt before 1.4.0 Weak Shared Secret via PQC Simulation Modejahlives · openssl_encrypt · CVSS 9.8 · 2026-08-17 | 9.8 | 0.6% | 2026-08-17 |
| CVE-2018-1091In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be triggered from unprivileged userspace during…Linux · Linux kernel v4.13 and newer · 2018-03-27 | – | 0.4% | 2018-03-27 |
| CVE-2022-22160Junos OS: MX Series: The bbe-smgd process crashes if an unsupported configuration exists and a PPPoE client sends a specific messageJuniper Networks · Junos OS · CVSS 6.5 · 2022-01-19 | 6.5 | 0.4% | 2022-01-19 |
| CVE-2024-23326Envoy incorrectly accepts HTTP 200 response for entering upgrade modeenvoyproxy · envoy · CVSS 5.9 · 2024-06-04 | 5.9 | 0.4% | 2024-06-04 |
| CVE-2022-20849Cisco IOS XR Software Broadband Network Gateway PPPoE Denial of Service VulnerabilityCisco · Cisco IOS XR Software · CVSS 6.1 · 2024-11-15 | 6.1 | 0.3% | 2024-11-15 |
| CVE-2017-7496fedora-arm-installer up to and including 1.99.16 is vulnerable to local privilege escalation due to lack of checking the error condition of mount operation failure on unsafely cre…Red Hat, Inc. · fedora-arm-installer · 2017-06-26 | – | 0.3% | 2017-06-26 |
| CVE-2023-32871In DA, there is a possible permission bypass due to an incorrect status check. This could lead to local escalation of privilege with no additional execution privileges needed. Use…MediaTek, Inc. · MT2737, MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6789,… · CVSS 5.3 · 2024-05-06 | 5.3 | 0.1% | 2024-05-06 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.