CWE-672 · Other weaknesses
Operation on a Resource after Expiration or Release
85CVEs
0exploited
0with a public check
2likely (EPSS 10%+)
SortMost likely exploited
85 CVEs with CWE-672 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2020-11027Password reset links invalidation issue in WordPressWordPress · WordPress · CVSS 6.1 · 2020-04-30 | 6.1 | 14% | 2020-04-30 |
| CVE-2019-17638In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens,…The Eclipse Foundation · Eclipse Jetty · 2020-07-09 | – | 11% | 2020-07-09 |
| CVE-2020-24030ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and access to sensitive data via token reuse. NOTE: as of 2025-10-14,…Forlogic · Qualiex · 2020-09-02 | – | 2.7% | 2020-09-02 |
| CVE-2021-37204A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 200SP…Siemens · SIMATIC Drive Controller family · CVSS 7.5 · 2022-02-09 | 7.5 | 2.2% | 2022-02-09 |
| CVE-2021-42778A heap double free issue was found in Opensc before version 0.22.0 in sc_pkcs15_free_tokeninfo.Opensc Project · opensc · 2022-04-18 | – | 2.1% | 2022-04-18 |
| CVE-2020-12043The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when configured for wireless networking the FTP service operating on the WBM remains operational until the WBM is…Baxter · Baxter Sigma Spectrum Infusion Pumps · 2020-06-29 | – | 2.1% | 2020-06-29 |
| CVE-2021-37185A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (…Siemens · SIMATIC Drive Controller family · CVSS 7.5 · 2022-02-09 | 7.5 | 2.1% | 2022-02-09 |
| CVE-2019-15791Reference count underflow in shiftfsUbuntu · Shiftfs in the Linux kernel · CVSS 7.1 · 2020-04-23 | 7.1 | 1.3% | 2020-04-23 |
| CVE-2021-23995When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this could have been exploited to run arbitra…Mozilla · Firefox ESR · 2021-06-24 | – | 1.2% | 2021-06-24 |
| CVE-2020-15270Improper session expiration in Parse Serverparse-community · parse-server · CVSS 4.3 · 2020-10-22 | 4.3 | 1.2% | 2020-10-22 |
| CVE-2019-15794Reference counting error in overlayfs/shiftfs error path when used in conjuction with aufsUbuntu · Linux kernel · CVSS 7.1 · 2020-04-23 | 7.1 | 1.2% | 2020-04-23 |
| CVE-2022-22197Junos OS and Junos OS Evolved: An rpd core will be observed with proxy BGP route-target filtering enabled and certain route add and delete event happeningJuniper Networks · Junos OS · CVSS 7.5 · 2022-04-14 | 7.5 | 1.1% | 2022-04-14 |
| CVE-2026-58291Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityMicrosoft · Microsoft Edge (Chromium-based) · CVSS 6.1 · 2026-07-03 | 6.1 | 1.0% | 2026-07-03 |
| CVE-2022-30256An issue was discovered in MaraDNS Deadwood through 3.5.0021 that allows variant V1 of unintended domain name resolution. A revoked domain name can still be resolvable for a long…Maradns · Maradns · CVSS 7.5 · 2022-11-18 | 7.5 | 1.0% | 2022-11-18 |
| CVE-2019-20022An invalid memory address dereference was discovered in load_pnm in frompnm.c in libsixel before 1.8.3.Saitoha · Libsixel · 2019-12-27 | – | 0.9% | 2019-12-27 |
| CVE-2024-47571An operation on a resource after expiration or release in Fortinet FortiManager 6.4.12 through 7.4.0 allows an attacker to gain improper access to FortiGate via valid credentials.Fortinet · FortiManager · CVSS 7.9 · 2025-01-14 | 7.9 | 0.9% | 2025-01-14 |
| CVE-2017-0544An elevation of privilege vulnerability in CameraBase could enable a local malicious application to execute arbitrary code. This issue is rated as High because it is a local arbit…Google Inc. · Android · 2017-04-07 | – | 0.9% | 2017-04-07 |
| CVE-2023-48220Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry perioddecidim · decidim · CVSS 5.7 · 2024-02-20 | 5.7 | 0.8% | 2024-02-20 |
| CVE-2022-22332IBM Sterling Partner Engagement Manager 6.2.0 could allow an attacker to impersonate another user due to missing revocation mechanism for the JWT token. IBM X-Force ID: 219131.IBM · Sterling Partner Engagement Manager · CVSS 5.6 · 2022-04-01 | 5.6 | 0.8% | 2022-04-01 |
| CVE-2025-22149JWK Set's HTTP client only overwrites and appends JWK to local cache during refreshMicahParks · jwkset · CVSS 2.1 · 2025-01-09 | 2.1 | 0.8% | 2025-01-09 |
| CVE-2020-25221get_gate_page in mm/gup.c in the Linux kernel 5.7.x and 5.8.x before 5.8.7 allows privilege escalation because of incorrect reference counting (caused by gate page mishandling) of…Linux · Linux Kernel · 2020-09-10 | – | 0.7% | 2020-09-10 |
| CVE-2026-68481Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProviderApache Software Foundation · Apache CXF · CVSS 7.5 · 2026-08-06 | 7.5 | 0.7% | 2026-08-06 |
| CVE-2026-116326PostgreSQL plperl tied-object exceptions follow stale sigjmp_bufPostgreSQL · CVSS 8.8 · 2026-11-12 | 8.8 | 0.6% | 2026-11-12 |
| CVE-2022-22755By using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute JavaScript (within the bounds of the same-origin policy) eve…Mozilla · Firefox · CVSS 8.8 · 2022-12-22 | 8.8 | 0.6% | 2022-12-22 |
| CVE-2023-1902HCI Connection Creation Dangling State Reference Re-usezephyrproject-rtos · Zephyr · CVSS 5.9 · 2023-07-10 | 5.9 | 0.6% | 2023-07-10 |
| CVE-2023-1901HCI send_sync Dangling Semaphore Reference Re-usezephyrproject-rtos · Zephyr · CVSS 5.9 · 2023-07-10 | 5.9 | 0.6% | 2023-07-10 |
| CVE-2019-19480An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/pkcs15-prkey.c has an incorrect free operation in sc_pkcs15_decode_prkdf_entry.Opensc Project · Opensc · 2019-12-01 | – | 0.6% | 2019-12-01 |
| CVE-2026-31875Parse Server MFA recovery codes not consumed after useparse-community · parse-server · CVSS 8.2 · 2026-03-11 | 8.2 | 0.5% | 2026-03-11 |
| CVE-2026-43585OpenClaw < 2026.4.15 - Bearer Token Validation Bypass via Stale SecretRef ResolutionOpenClaw · OpenClaw · CVSS 8.1 · 2026-05-06 | 8.1 | 0.5% | 2026-05-06 |
| CVE-2022-45292User invites for Funkwhale v1.2.8 do not permanently expire after being used for signup and can be used again after an account has been deleted.Funkwhale · Funkwhale · CVSS 5.3 · 2022-12-09 | 5.3 | 0.5% | 2022-12-09 |
| CVE-2026-120449Outline before 1.12.0 Improper Access Control via Public Document SharesOutline · Outline · CVSS 5.3 · 2026-11-02 | 5.3 | 0.4% | 2026-11-02 |
| CVE-2025-2517Reference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security ManagerOpenText · ArcSight Enterprise Security Manager · CVSS 2.3 · 2025-04-21 | 2.3 | 0.4% | 2025-04-21 |
| CVE-2025-58149Incorrect removal of permissions on PCI device unplugXen · Xen · CVSS 7.5 · 2025-10-31 | 7.5 | 0.4% | 2025-10-31 |
| CVE-2022-27499Premature release of resource during expected lifetime in the Intel(R) SGX SDK software may allow a privileged user to potentially enable information disclosure via local access.Intel · Intel(R) SGX SDK software · CVSS 2.5 · 2022-11-11 | 2.5 | 0.4% | 2022-11-11 |
| CVE-2026-56314Capgo - Deleted Bundle Selection via Missing Deletion Filter in /updates EndpointCapgo · Capgo · CVSS 7.1 · 2026-06-22 | 7.1 | 0.4% | 2026-06-22 |
| CVE-2025-55669BIG-IP HTTP/2 vulnerabilityF5 · BIG-IP · CVSS 7.5 · 2025-10-15 | 7.5 | 0.4% | 2025-10-15 |
| CVE-2025-53901Wasmtime has host panic with `fd_renumber` WASIp1 functionbytecodealliance · wasmtime · CVSS 3.5 · 2025-07-18 | 3.5 | 0.4% | 2025-07-18 |
| CVE-2025-10060MongoDB may be susceptible to Invariant Failure in Transactions due Upsert OperationMongoDB Inc · MongoDB Server · CVSS 6.5 · 2025-09-05 | 6.5 | 0.4% | 2025-09-05 |
| CVE-2025-30351Suspended Directus user can continue to use session token to access APIdirectus · directus · CVSS 3.5 · 2025-03-26 | 3.5 | 0.4% | 2025-03-26 |
| CVE-2024-25619Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodonmastodon · mastodon · CVSS 3.1 · 2024-02-14 | 3.1 | 0.4% | 2024-02-14 |
| CVE-2026-113121Use of released resource in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy v…Google · Chrome · CVSS 8.8 · 2026-10-20 | 8.8 | 0.4% | 2026-10-20 |
| CVE-2013-10075Apache::Session versions through 1.94 for Perl re-creates deleted sessionsCHORNY · Apache::Session · CVSS 9.1 · 2026-05-08 | 9.1 | 0.4% | 2026-05-08 |
| CVE-2026-113216Use of released resource in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafte…Google · Chrome · CVSS 8.8 · 2026-10-20 | 8.8 | 0.3% | 2026-10-20 |
| CVE-2024-49955ACPI: battery: Fix possible crash when unregistering a battery hookLinux · Linux · 2024-10-21 | – | 0.3% | 2024-10-21 |
| CVE-2024-4693Qemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crashRedhat · qemu · CVSS 5.5 · 2024-05-10 | 5.5 | 0.3% | 2024-05-10 |
| CVE-2026-85044Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineering to bypass web origin policy via a…Google · Chrome · CVSS 6.5 · 2026-09-03 | 6.5 | 0.3% | 2026-09-03 |
| CVE-2025-6031Insecure device pairing in end of life Amazon Cloud CamAmazon · Cloud Cam · CVSS 7.5 · 2025-06-12 | 7.5 | 0.3% | 2025-06-12 |
| CVE-2024-49953net/mlx5e: Fix crash caused by calling __xfrm_state_delete() twiceLinux · Linux · 2024-10-21 | – | 0.3% | 2024-10-21 |
| CVE-2026-93006Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file contentRed Hat · Red Hat Ceph Storage 9 · CVSS 6.8 · 2026-10-29 | 6.8 | 0.3% | 2026-10-29 |
| CVE-2026-121256Use of released resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code ou…Google · Chrome · CVSS 8.3 · 2026-11-03 | 8.3 | 0.3% | 2026-11-03 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.