CWE-453 · Misconfiguration and Insecure Design
Insecure Default Variable Initialization
22CVEs
0exploited
0with a public check
0likely (EPSS 10%+)
SortMost likely exploited
22 CVEs with CWE-453 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-21411Skype for Consumer Remote Code Execution VulnerabilityMicrosoft · Skype for Consumer · CVSS 8.8 · 2024-03-12 | 8.8 | 2.6% | 2024-03-12 |
| CVE-2021-27426GE UR family insecure default variable initializationGE · UR family · CVSS 9.8 · 2022-03-23 | 9.8 | 1.2% | 2022-03-23 |
| CVE-2024-49120Windows Remote Desktop Services Remote Code Execution VulnerabilityMicrosoft · Windows Server 2012 · CVSS 8.1 · 2024-12-10 | 8.1 | 1.1% | 2024-12-10 |
| CVE-2022-47197An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject…Ghost Foundation · Ghost · CVSS 9 · 2023-01-19 | 9.0 | 1.0% | 2023-01-19 |
| CVE-2022-47194An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject…Ghost Foundation · Ghost · CVSS 9 · 2023-01-19 | 9.0 | 0.8% | 2023-01-19 |
| CVE-2022-3262A flaw was found in Openshift. A pod with a DNSPolicy of "ClusterFirst" may incorrectly resolve the hostname based on a service provided. This flaw allows an attacker to supply an…Redhat · openshift · CVSS 8.1 · 2022-12-08 | 8.1 | 0.8% | 2022-12-08 |
| CVE-2022-47196An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject…Ghost Foundation · Ghost · CVSS 9 · 2023-01-19 | 9.0 | 0.7% | 2023-01-19 |
| CVE-2022-47195An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject…Ghost Foundation · Ghost · CVSS 9 · 2023-01-19 | 9.0 | 0.7% | 2023-01-19 |
| CVE-2025-47945Donetick Has Weak Default JWT Secretdonetick · donetick · CVSS 9.1 · 2025-05-17 | 9.1 | 0.7% | 2025-05-17 |
| CVE-2026-103577Microsoft QUIC Security Feature Bypass VulnerabilityMicrosoft · Windows 11 version 23H2 · CVSS 7.5 · 2026-10-13 | 7.5 | 0.6% | 2026-10-13 |
| CVE-2023-27516An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. A specially crafted network packet can lead to un…SoftEther VPN · SoftEther VPN · CVSS 7.3 · 2023-10-12 | 7.3 | 0.5% | 2023-10-12 |
| CVE-2025-61926Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secretossf · allstar · CVSS 4.6 · 2025-10-09 | 4.6 | 0.5% | 2025-10-09 |
| CVE-2022-46831In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to access AWS resources…JetBrains · TeamCity · CVSS 6.6 · 2022-12-08 | 6.6 | 0.5% | 2022-12-08 |
| CVE-2024-39916NFS server misconfiguration allows file access outside the exported directoryFOGProject · fogproject · CVSS 6.4 · 2024-07-12 | 6.4 | 0.3% | 2024-07-12 |
| CVE-2024-41255filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init func…Filestash · Filestash · CVSS 7.5 · 2024-07-31 | 7.5 | 0.3% | 2024-07-31 |
| CVE-2026-92950vm2 before 3.11.7 Sandbox Escape via CLI requirepatriksimek · vm2 · CVSS 8.6 · 2026-09-17 | 8.6 | 0.2% | 2026-09-17 |
| CVE-2026-0082In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value. This could lead to local escala…Google · Android · CVSS 10 · 2026-06-17 | 10.0 | 0.2% | 2026-06-17 |
| CVE-2026-41330OpenClaw < 2026.3.31 - Environment Variable Override via Host Exec PolicyOpenClaw · OpenClaw · CVSS 4.4 · 2026-04-20 | 4.4 | 0.1% | 2026-04-20 |
| CVE-2026-95404In multiple locations, there is a possible way to modify coprocessor instruction and data memory from non-secure software due to an insecure default value. This could lead to loca…Google · Android · CVSS 6.7 · 2026-11-10 | 6.7 | 0.1% | 2026-11-10 |
| CVE-2026-59596In multiple functions of mpu.c, there is a possible way to execute code from non-secure memory in the security coprocessor due to an insecure default value. This could lead to loc…Google · Android · CVSS 8.4 · 2026-11-10 | 8.4 | 0.1% | 2026-11-10 |
| CVE-2026-57013In access_control_enable of multiple files, there is a possible way to release secure coprocessors from reset via unclaimed firewall registers due to an insecure default value. Th…Google · Android · CVSS 6.7 · 2026-11-10 | 6.7 | 0.1% | 2026-11-10 |
| CVE-2025-48563In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default value. This could lead to local escalation of privilege with…Google · Android · CVSS 7.8 · 2025-09-04 | 7.8 | 0.1% | 2025-09-04 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.