CWE-682 · Input Validation and Logic
Incorrect Calculation
137CVEs
SortMost likely exploited
137 CVEs with CWE-682 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2022-30780Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c…Lighttpd · Lighttpd · 2022-06-11 | – | 57% | 2022-06-11 |
| CVE-2016-7433NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecified impact via unknown vectors, related to a "root distance th…Ntp · Ntp · 2017-01-13 | – | 9.8% | 2017-01-13 |
| CVE-2018-8319A Security Feature Bypass vulnerability exists in MSR JavaScript Cryptography Library that is caused by incorrect arithmetic computations, aka "MSR JavaScript Cryptography Library…Microsoft · Microsoft Research JavaScript Cryptography Library · 2018-07-11 | – | 7.7% | 2018-07-11 |
| CVE-2023-35641Internet Connection Sharing (ICS) Remote Code Execution VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 8.8 · 2023-12-12 | 8.8 | 7.2% | 2023-12-12 |
| CVE-2020-0022In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation. This could lead to remote code execution over Blu…Google · Android · CVSS 8.8 · 2020-02-13 | 8.8 | 6.1% | 2020-02-13 |
| CVE-2022-30600A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.Moodle · moodle · 2022-05-18 | – | 5.1% | 2022-05-18 |
| CVE-2021-45960In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes,…Libexpat Project · Libexpat · CVSS 8.8 · 2022-01-01 | 8.8 | 4.7% | 2022-01-01 |
| CVE-2019-17514library/glob.html in the Python 2 and 3 documentation before 2016 has potentially misleading information about whether sorting occurs, as demonstrated by irreproducible cancer-res…Python · Python · 2019-10-12 | – | 4.7% | 2019-10-12 |
| CVE-2021-44847A stack-based buffer overflow in handle_request function in DHT.c in toxcore 0.1.9 through 0.1.11 and 0.2.0 through 0.2.12 (caused by an improper length calculation during the han…Toktok · Toxcore · 2021-12-13 | – | 4.1% | 2021-12-13 |
| CVE-2023-2163Incorrect Verifier Branch Pruning Logic Leads To Arbitrary Read/Write In Linux Kernel and Lateral Privilege EscalationLinux · Linux Kernel · CVSS 10 · 2023-09-20 | 10.0 | 3.6% | 2023-09-20 |
| CVE-2018-18225In Wireshark 2.6.0 to 2.6.3, the CoAP dissector could crash. This was addressed in epan/dissectors/packet-coap.c by ensuring that the piv length is correctly computed.Wireshark · Wireshark · 2018-10-12 | – | 2.9% | 2018-10-12 |
| CVE-2021-3114In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowest limb during the final complete reducti…Golang · Go · 2021-01-26 | – | 2.7% | 2021-01-26 |
| CVE-2011-1573net/sctp/sm_make_chunk.c in the Linux kernel before 2.6.34, when addip_enable and auth_enable are used, does not consider the amount of zero padding during calculation of chunk le…Linux · Linux Kernel · 2012-02-02 | – | 2.7% | 2012-02-02 |
| CVE-2017-5462A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS library has been updated…Mozilla · Thunderbird · 2018-06-11 | – | 2.6% | 2018-06-11 |
| CVE-2020-27616ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process.Qemu · Qemu · 2020-11-06 | – | 2.5% | 2020-11-06 |
| CVE-2022-23066Solana rBPF - Incorrect Calculation in sdiv instructionsolana-labs · rbpf · CVSS 9.1 · 2022-05-09 | 9.1 | 2.5% | 2022-05-09 |
| CVE-2017-8326libimageworsener.a in ImageWorsener before 1.3.1 has "left shift cannot be represented in type int" undefined behavior issues, which might allow remote attackers to cause a denial…Entropymine · Imageworsener · 2017-04-29 | – | 2.4% | 2017-04-29 |
| CVE-2017-8932A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 causes incorrect results to be generated f…Golang · Go · 2017-07-06 | – | 2.2% | 2017-07-06 |
| CVE-2017-11537When ImageMagick 7.0.6-1 processes a crafted file in convert, it can lead to a Floating Point Exception (FPE) in the WritePALMImage() function in coders/palm.c, related to an inco…Imagemagick · Imagemagick · 2017-07-23 | – | 1.9% | 2017-07-23 |
| CVE-2020-26240Erroneous Proof of Work calculation in gethethereum · go-ethereum · CVSS 5.3 · 2020-11-25 | 5.3 | 1.9% | 2020-11-25 |
| CVE-2021-44504An issue was discovered in FIS GT.M through V7.0-000 (related to the YottaDB code base). Using crafted input, an attacker can cause a size variable, stored as an signed int, to eq…Fisglobal · Gt.m · 2022-04-15 | – | 1.8% | 2022-04-15 |
| CVE-2022-31104Miscompilation of `i8x16.swizzle` and `select` with v128 inputs in Wasmtimebytecodealliance · wasmtime · CVSS 4.8 · 2022-06-27 | 4.8 | 1.8% | 2022-06-27 |
| CVE-2021-31440This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.11.15. An attacker must first obtain the ability to execute low-privil…Linux · Kernel · CVSS 8.8 · 2021-05-21 | 8.8 | 1.8% | 2021-05-21 |
| CVE-2020-28393An unauthenticated remote attacker could create a permanent denial-of-service condition by sending specially crafted OSPF packets. Successful exploitation requires OSPF to be enab…Siemens · SCALANCE XM-400, XR-500 · 2021-05-12 | – | 1.6% | 2021-05-12 |
| CVE-2011-3062Off-by-one error in the OpenType Sanitizer in Google Chrome before 18.0.1025.142 allows remote attackers to cause a denial of service or possibly have unspecified other impact via…Google · Chrome · 2012-03-30 | – | 1.6% | 2012-03-30 |
| CVE-2018-20999An issue was discovered in the orion crate before 0.11.2 for Rust. reset() calls cause incorrect results.Orion Project · Orion · 2019-08-26 | – | 1.6% | 2019-08-26 |
| CVE-2022-28048STB v2.27 was discovered to contain an integer shift of invalid size in the component stbi__jpeg_decode_block_prog_ac.Stb Project · Stb · 2022-04-15 | – | 1.6% | 2022-04-15 |
| CVE-2017-13151A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63874456.Google Inc. · Android · 2017-12-06 | – | 1.4% | 2017-12-06 |
| CVE-2023-35642Internet Connection Sharing (ICS) Denial of Service VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 6.5 · 2023-12-12 | 6.5 | 1.3% | 2023-12-12 |
| CVE-2021-3004The _deposit function in the smart contract implementation for Stable Yield Credit (yCREDIT), an Ethereum token, has certain incorrect calculations. An attacker can obtain more yC…Stableyieldcredit Project · Stableyieldcredit · 2021-01-03 | – | 1.3% | 2021-01-03 |
| CVE-2017-0679A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36996978.Google Inc. · Android · 2017-07-06 | – | 1.3% | 2017-07-06 |
| CVE-2022-22138Denial of Service (DoS)Fast String Search Project · fast-string-search · CVSS 7.5 · 2022-06-17 | 7.5 | 1.2% | 2022-06-17 |
| CVE-2017-9725In all Qualcomm products with Android releases from CAF using the Linux kernel, during DMA allocation, due to wrong data type of size, allocation size gets truncated which makes a…Google · Android · 2017-09-21 | – | 1.2% | 2017-09-21 |
| CVE-2020-26241Shallow copy bug in gethethereum · go-ethereum · CVSS 6.5 · 2020-11-25 | 6.5 | 1.2% | 2020-11-25 |
| CVE-2021-29945The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash. *Note: This issue only affected x86-32 platforms. Other pl…Mozilla · Firefox ESR · 2021-06-24 | – | 1.2% | 2021-06-24 |
| CVE-2023-2423Rockwell Automation Armor PowerFlex Vulnerable to Denial-Of-ServiceRockwell Automation · Armor PowerFlex · CVSS 8.6 · 2023-08-08 | 8.6 | 1.2% | 2023-08-08 |
| CVE-2022-29978There is a floating point exception error in sixel_encoder_do_resize, encoder.c:633 in libsixel img2sixel 1.8.6. Remote attackers could leverage this vulnerability to cause a deni…Saitoha · Libsixel · 2022-05-11 | – | 1.0% | 2022-05-11 |
| CVE-2018-14439espritblock eos4j, an unofficial SDK for EOS, through 2018-07-12 mishandles floating-point numbers with more than four digits after the decimal point, which might allow attackers…Eblock · Eos4j · 2018-07-20 | – | 1.0% | 2018-07-20 |
| CVE-2022-23628Array literal misordering in github.com/open-policy-agent/opaopen-policy-agent · opa · CVSS 6.3 · 2022-02-09 | 6.3 | 1.0% | 2022-02-09 |
| CVE-2018-11790When loading a document with Apache Open Office 4.1.5 and earlier with smaller end line termination than the operating system uses, the defect occurs. In this case OpenOffice runs…Apache Software Foundation · Apache OpenOffice · 2019-01-31 | – | 1.0% | 2019-01-31 |
| CVE-2021-44491An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can cause a calculation of the size of calls to memset in op_fnj3 in sr_port/op_fnj3.…Yottadb · Yottadb · 2022-04-15 | – | 1.0% | 2022-04-15 |
| CVE-2021-44490An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can cause a calculation of the size of calls to memset in op_fnj3 in sr_port/op_fnj3.…Yottadb · Yottadb · 2022-04-15 | – | 1.0% | 2022-04-15 |
| CVE-2017-0819A vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63045918.Google Inc. · Android · 2017-10-03 | – | 1.0% | 2017-10-03 |
| CVE-2019-5853Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Google · Chrome · 2019-11-25 | – | 1.0% | 2019-11-25 |
| CVE-2021-41329Datalust Seq before 2021.2.6259 allows users (with view filters applied to their accounts) to see query results not constrained by their view filter. This information exposure, ca…Datalust · Seq · 2021-09-27 | – | 1.0% | 2021-09-27 |
| CVE-2022-23011On certain hardware BIG-IP platforms, in version 15.1.x before 15.1.4 and 14.1.x before 14.1.3, virtual servers may stop responding while processing TCP traffic due to an issue in…F5 · BIG-IP · 2022-01-25 | – | 0.9% | 2022-01-25 |
| CVE-2022-31169Cranelift vulnerable to miscompilation of constant values in division on AArch64bytecodealliance · wasmtime · CVSS 5.9 · 2022-07-21 | 5.9 | 0.9% | 2022-07-21 |
| CVE-2020-26265Consensus flaw during block processingethereum · go-ethereum · CVSS 5.3 · 2020-12-11 | 5.3 | 0.9% | 2020-12-11 |
| CVE-2019-20051A floating-point exception was discovered in PackLinuxElf::elf_hash in p_lx_elf.cpp in UPX 3.95. The vulnerability causes an application crash, which leads to denial of service.Upx · Upx · 2019-12-27 | – | 0.9% | 2019-12-27 |
| CVE-2022-23028On BIG-IP AFM version 16.x before 16.1.0, 15.1.x before 15.1.5, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when global AFM SYN cookie protection (TCP Half Open flood vect…F5 · BIG-IP AFM · 2022-01-25 | – | 0.9% | 2022-01-25 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.