CWE-684 · Input Validation and Logic
Incorrect Provision of Specified Functionality
31CVEs
SortMost likely exploited
31 CVEs with CWE-684 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-5363Incorrect cipher key & IV length processingOpenSSL · OpenSSL · CVSS 7.5 · 2023-10-24 | 7.5 | 3.9% | 2023-10-24 |
| CVE-2025-47227In the Production Environment extension in Netmake ScriptCase through 9.12.006 (23), the Administrator password reset mechanism is mishandled. Making both a GET and a POST request…ScriptCase · ScriptCase · CVSS 7.5 · 2025-07-05 | 7.5 | 1.9% | 2025-07-05 |
| CVE-2020-11054Incorrect Provision of Specified Functionality in qutebrowserqutebrowser · qutebrowser · CVSS 3.5 · 2020-05-07 | 3.5 | 1.5% | 2020-05-07 |
| CVE-2026-34478Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibilityApache Software Foundation · Apache Log4j Core · CVSS 6.9 · 2026-04-10 | 6.9 | 1.0% | 2026-04-10 |
| CVE-2023-24845A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGG…Siemens · RUGGEDCOM i800 · CVSS 9.1 · 2023-08-08 | 9.1 | 0.7% | 2023-08-08 |
| CVE-2023-4258bt: mesh: vulnerability in provisioning protocol implementation on provisionee sidezephyrproject-rtos · Zephyr · CVSS 8.6 · 2023-09-25 | 8.6 | 0.6% | 2023-09-25 |
| CVE-2024-50357FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configuration. But, REST-APIs…Century Systems Co., Ltd. · FutureNet NXR-G110 series · CVSS 9.8 · 2024-11-29 | 9.8 | 0.6% | 2024-11-29 |
| CVE-2024-6425Incorrect Provision of Specified Functionality vulnerability in MESbookMESbook · MESbook · CVSS 9.1 · 2024-07-01 | 9.1 | 0.5% | 2024-07-01 |
| CVE-2026-52735ZEBRA: Consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parserZcashFoundation · zebra · CVSS 9.3 · 2026-08-18 | 9.3 | 0.5% | 2026-08-18 |
| CVE-2026-44597Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011.torproject · Tor · CVSS 3.7 · 2026-05-07 | 3.7 | 0.4% | 2026-05-07 |
| CVE-2024-6502Incorrect Provision of Specified Functionality in GitLabGitLab · GitLab · CVSS 5.7 · 2024-08-22 | 5.7 | 0.4% | 2024-08-22 |
| CVE-2024-5005Incorrect Provision of Specified Functionality in GitLabGitLab · GitLab · CVSS 4.3 · 2024-10-11 | 4.3 | 0.4% | 2024-10-11 |
| CVE-2026-119078Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keysApache Software Foundation · Apache Commons Codec · CVSS 9.1 · 2026-11-09 | 9.1 | 0.4% | 2026-11-09 |
| CVE-2025-66384app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmp_name.MISP · MISP · CVSS 8.2 · 2025-11-28 | 8.2 | 0.4% | 2025-11-28 |
| CVE-2025-54568Akamai Rate Control alpha before 2025 allows attackers to send requests above the stipulated thresholds because the rate is measured separately for each edge node.Akamai · Rate Control · CVSS 3.7 · 2025-07-25 | 3.7 | 0.4% | 2025-07-25 |
| CVE-2026-40684In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a…Exim · Exim · CVSS 5.9 · 2026-04-30 | 5.9 | 0.4% | 2026-04-30 |
| CVE-2026-40685In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an inco…Exim · Exim · CVSS 6.5 · 2026-04-30 | 6.5 | 0.3% | 2026-04-30 |
| CVE-2024-8974Incorrect Provision of Specified Functionality in GitLabGitLab · GitLab · CVSS 2.6 · 2024-09-26 | 2.6 | 0.3% | 2024-09-26 |
| CVE-2025-58325An Incorrect Provision of Specified Functionality vulnerability [CWE-684] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2.5 through 7.2.10, 7.0.0 through 7.0.15, 6.4 all versions may a…Fortinet · FortiOS · CVSS 7.8 · 2025-10-14 | 7.8 | 0.3% | 2025-10-14 |
| CVE-2025-54567hw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related issue to CVE-2024-26327.QEMU · QEMU · CVSS 4.2 · 2025-07-25 | 4.2 | 0.3% | 2025-07-25 |
| CVE-2026-106361Incorrect provision of specified functionality in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web or…Google · Chrome · CVSS 6.5 · 2026-10-06 | 6.5 | 0.3% | 2026-10-06 |
| CVE-2026-79126Incorrect provision of specified functionality in Proxy in Google Chrome on on Windows prior to 152.0.7977.65 allowed an adjacent attacker to potentially obtain sensitive informat…Google · Chrome · CVSS 5.9 · 2026-08-25 | 5.9 | 0.2% | 2026-08-25 |
| CVE-2026-125729Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforce itPlack-Middleware-CSP · 2026-11-10 | – | 0.2% | 2026-11-10 |
| CVE-2024-20317Cisco IOS XR Software Layer 2 Services Denial of Service VulnerabilityCisco · Cisco IOS XR Software · CVSS 7.4 · 2024-09-11 | 7.4 | 0.2% | 2024-09-11 |
| CVE-2023-5158Possible dos from guest to host invringh_kiov_advance in vhost driver at drivers/vhost/vringh.cLinux · kernel · CVSS 6.5 · 2023-09-25 | 6.5 | 0.2% | 2023-09-25 |
| CVE-2026-42255Technitium DNS Server before 15.0 allows DNS traffic amplification via cyclic name server delegation.Technitium · DnsServer · CVSS 7.2 · 2026-04-26 | 7.2 | 0.2% | 2026-04-26 |
| CVE-2026-106390Incorrect provision of specified functionality in SanitizerAPI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML p…Google · Chrome · CVSS 4.3 · 2026-10-06 | 4.3 | 0.2% | 2026-10-06 |
| CVE-2026-35381uutils coreutils cut Local Logic Error and Data Integrity Issue in Output FilteringUutils · coreutils · CVSS 3.3 · 2026-04-22 | 3.3 | 0.2% | 2026-04-22 |
| CVE-2025-55174In KDE Skanpage before 25.08.0, an attempt at file overwrite can result in the contents of the new file at the beginning followed by the partial contents of the old file at the en…KDE · Skanpage · CVSS 3.2 · 2025-11-26 | 3.2 | 0.2% | 2025-11-26 |
| CVE-2026-35379uutils coreutils tr Local Logic Error and Data Integrity Issue in Character Class HandlingUutils · coreutils · CVSS 3.3 · 2026-04-22 | 3.3 | 0.1% | 2026-04-22 |
| CVE-2022-23728Attacker can reset the device with AT Command in the process of rebooting the device. The LG ID is LVE-SMP-210011.Google · LG mobile devices · 2022-01-21 | – | 0.1% | 2022-01-21 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.