CWE-642 · Access Control
External Control of Critical State Data
20CVEs
SortMost likely exploited
20 CVEs with CWE-642 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2019-9496An invalid authentication sequence could result in the hostapd process terminating due to missing state validation stepsWi-Fi Alliance · hostapd with SAE support · 2019-04-17 | – | 4.6% | 2019-04-17 |
| CVE-2018-15382Cisco HyperFlex Software Static Signing Key VulnerabilityCisco · Cisco HyperFlex HX-Series · 2018-10-05 | – | 1.3% | 2018-10-05 |
| CVE-2017-0928html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized' variable causing sanitization to be bypassed.HackerOne · html-janitor node module · 2018-06-04 | – | 1.0% | 2018-06-04 |
| CVE-2020-27872This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7450 1.2.0.62_1.0.1 routers. Authentication is not required to…NETGEAR · R7450 · CVSS 8.8 · 2021-02-04 | 8.8 | 0.9% | 2021-02-04 |
| CVE-2023-0575Remote Code ExecutionYugabyteDB · YugabyteDB · CVSS 7.2 · 2023-02-09 | 7.2 | 0.8% | 2023-02-09 |
| CVE-2022-32859A logic issue was addressed with improved state management. This issue is fixed in iOS 16. Deleted contacts may still appear in spotlight search results.Apple · iOS · CVSS 5.3 · 2022-11-01 | 5.3 | 0.7% | 2022-11-01 |
| CVE-2025-49090The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution before 2.1) has deficient state resolution.Matrix · Matrix specification · CVSS 7.1 · 2025-10-02 | 7.1 | 0.5% | 2025-10-02 |
| CVE-2024-58265The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery.mcginty · snow · CVSS 3.1 · 2025-07-27 | 3.1 | 0.5% | 2025-07-27 |
| CVE-2024-8754External Control of Critical State Data in GitLabGitLab · GitLab · CVSS 6.4 · 2024-09-12 | 6.4 | 0.4% | 2024-09-12 |
| CVE-2023-29403Unsafe behavior in setuid/setgid binaries in runtimeGo standard library · runtime · CVSS 7.8 · 2023-06-08 | 7.8 | 0.4% | 2023-06-08 |
| CVE-2020-26186Dell Inspiron 5675 BIOS versions prior to 1.4.1 contain a UEFI BIOS RuntimeServices overwrite vulnerability. A local attacker with access to system memory may exploit this vulnera…Dell · CPG BIOS · CVSS 6.8 · 2021-01-08 | 6.8 | 0.4% | 2021-01-08 |
| CVE-2026-65355An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6…Apple · iOS and iPadOS · CVSS 4.3 · 2026-09-14 | 4.3 | 0.3% | 2026-09-14 |
| CVE-2026-84518This issue was addressed through improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious website may be able to determ…Apple · Safari · CVSS 4.3 · 2026-09-14 | 4.3 | 0.3% | 2026-09-14 |
| CVE-2026-65352An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 26.6.1. A website m…Apple · iOS and iPadOS · CVSS 4.3 · 2026-09-14 | 4.3 | 0.3% | 2026-09-14 |
| CVE-2024-22387External Control of Critical State Data (CWE-642) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated user to modify device I/O connections…Gallagher · Controller 6000 and Controller 7000 · CVSS 6.8 · 2024-07-11 | 6.8 | 0.3% | 2024-07-11 |
| CVE-2026-50053Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL ParametersZimbra · Zimbra Collaboration Suite · CVSS 8.7 · 2026-10-23 | 8.7 | 0.3% | 2026-10-23 |
| CVE-2025-54566hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue to CVE-2024-26327.QEMU · QEMU · CVSS 4.2 · 2025-07-25 | 4.2 | 0.3% | 2025-07-25 |
| CVE-2020-1976GlobalProtect on MacOS: Local denial-of-service (DoS) vulnerability.Palo Alto Networks · GlobalProtect · CVSS 4.7 · 2020-02-12 | 4.7 | 0.3% | 2020-02-12 |
| CVE-2022-22154Junos Fusion: A Satellite Device can be controlled by rewiring it to a foreign AD causing a DoSJuniper Networks · Junos OS · CVSS 6.8 · 2022-01-19 | 6.8 | 0.3% | 2022-01-19 |
| CVE-2025-26787An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2. The Admin CLI command used to configure Certificate access to the initi…Keyfactor · Signserver · CVSS 4.7 · 2025-12-22 | 4.7 | 0.1% | 2025-12-22 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.