CWE-394 · Input Validation and Logic
Unexpected Status Code or Return Value
17CVEs
SortMost likely exploited
17 CVEs with CWE-394 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-123158In CISA KEVExploitedsshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a stri…OpenBSD · OpenSSH · CVSS 8.1 · 2026-11-05 | 8.1 | 19% | 2026-11-05 |
| CVE-2018-20802Post-auth queries on compound index may crash mongodMongoDB Inc. · MongoDB Server · CVSS 6.5 · 2020-11-23 | 6.5 | 1.6% | 2020-11-23 |
| CVE-2019-0066Junos OS: A malformed IPv4 packet received by Junos in an NG-mVPN scenario may cause the routing protocol daemon (rpd) process to coreJuniper Networks · Junos OS · CVSS 7.5 · 2019-10-09 | 7.5 | 1.4% | 2019-10-09 |
| CVE-2019-20924Invariant in IndexBoundsBuilderMongoDB Inc. · MongoDB Server · CVSS 6.5 · 2020-11-23 | 6.5 | 1.3% | 2020-11-23 |
| CVE-2026-25085Copeland XWEB and XWEB Pro Unexpected Status Code or Return ValueCopeland · Copeland XWEB 300D PRO · CVSS 8.6 · 2026-02-27 | 8.6 | 0.8% | 2026-02-27 |
| CVE-2023-48429A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2). The Web UI of affected devices does not check the length of parameters in certain conditions.…Siemens · SINEC INS · CVSS 2.7 · 2023-12-12 | 2.7 | 0.6% | 2023-12-12 |
| CVE-2023-25948Server Data type confusion - info leakHoneywell · Experion Server · CVSS 7.5 · 2023-07-13 | 7.5 | 0.6% | 2023-07-13 |
| CVE-2024-1713Plv8 Deferred Trigger Privilege EscalationPlv8 · Plv8 · CVSS 7.2 · 2024-03-14 | 7.2 | 0.6% | 2024-03-14 |
| CVE-2025-23013In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be deployed to support aut…Yubico · pam-u2f · CVSS 7.3 · 2025-01-15 | 7.3 | 0.4% | 2025-01-15 |
| CVE-2025-12516Lack of Graceful Error Handling - HTTP 5xx ErrorAzure Access Technology · BLU-IC2 · CVSS 10 · 2025-10-30 | 10.0 | 0.4% | 2025-10-30 |
| CVE-2025-12515Systemic Internal Server Errors - HTTP 500 ResponseAzure Access Technology · BLU-IC2 · CVSS 10 · 2025-10-30 | 10.0 | 0.4% | 2025-10-30 |
| CVE-2025-22854Possible thread exhaustion from processing http responses in PingFederate Google AdapterPing Identity · PingFederate · CVSS 6.9 · 2025-06-15 | 6.9 | 0.4% | 2025-06-15 |
| CVE-2023-28975Junos OS: The kernel will crash when certain USB devices are insertedJuniper Networks · Junos OS · CVSS 4.6 · 2023-04-17 | 4.6 | 0.3% | 2023-04-17 |
| CVE-2026-76956In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks,…libexpat project · libexpat · CVSS 5.9 · 2026-08-20 | 5.9 | 0.3% | 2026-08-20 |
| CVE-2026-107785Crux Agent silently fails SKA preshared key rotation when SHA-512 peering is negotiatedSirius Computer, Inc. · Crux Agent · CVSS 6.3 · 2026-10-09 | 6.3 | 0.1% | 2026-10-09 |
| CVE-2025-48510Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability.AMD · AMD μProf · CVSS 7.1 · 2025-11-24 | 7.1 | 0.1% | 2025-11-24 |
| CVE-2026-73064In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only…trustedfirmware · Mbed TLS · CVSS 2.9 · 2026-09-24 | 2.9 | 0.1% | 2026-09-24 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.