CWE-697 in Input Validation and Logic
- CVEs
- 125
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2024-53861Issuer field partial matches allowed in pyjwt | jpadilla · pyjwt | Unlikely | 2.2 | 0.8% | 2024-11-29 |
| CVE-2023-41936Jenkins Google Login Plugin 1.7 and earlier uses a non-constant time comparison function when checking whether the provided and expected token are equal, potentially allowing atta… | Jenkins Project · Jenkins Google Login Plugin | Unlikely | – | 0.8% | 2023-09-06 |
| CVE-2023-41935Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b_1154b_3fb_, uses a non-constant time comparison function when checking whether the provided and expecte… | Jenkins Project · Jenkins Azure AD Plugin | Unlikely | – | 0.8% | 2023-09-06 |
| CVE-2022-29944An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of paths installed by intents. An existing intents does not redirect to a new path, even if a new intent th… | Opennetworking · Onos | Unlikely | 5.3 | 0.8% | 2023-04-20 |
| CVE-2020-25580In FreeBSD 12.2-STABLE before r369346, 11.4-STABLE before r369345, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 a regression in the login.access(5) rule processor has the eff… | Freebsd · FreeBSD | Unlikely | – | 0.8% | 2021-03-26 |
| CVE-2023-23766Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling | GitHub · Enterprise Server | Unlikely | 4.5 | 0.7% | 2023-09-22 |
| CVE-2025-20343Cisco Identity Services Engine Radius Suppression Denial of Service Vulnerability | Cisco · Cisco Identity Services Engine Software | Unlikely | 8.6 | 0.7% | 2025-11-05 |
| CVE-2020-10027ARC Platform Uses Signed Integer Comparison When Validating Syscall Numbers | zephyrproject-rtos · zephyr | Unlikely | 7.8 | 0.7% | 2020-05-11 |
| CVE-2020-10024ARM Platform Uses Signed Integer Comparison When Validating Syscall Numbers | zephyrproject-rtos · zephyr | Unlikely | 7.8 | 0.7% | 2020-05-11 |
| CVE-2026-73309XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint | XenForo · XenForo | Unlikely | 7.4 | 0.7% | 2026-09-08 |
| CVE-2023-46658Jenkins MSTeams Webhook Trigger Plugin 0.1.1 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, pote… | Jenkins Project · Jenkins MSTeams Webhook Trigger Plugin | Unlikely | – | 0.7% | 2023-10-25 |
| CVE-2023-46657Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are equal, potentially allowing a… | Jenkins Project · Jenkins Gogs Plugin | Unlikely | – | 0.7% | 2023-10-25 |
| CVE-2023-46656Jenkins Multibranch Scan Webhook Trigger Plugin 1.0.9 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are eq… | Jenkins Project · Jenkins Multibranch Scan Webhook Trigger Plugin | Unlikely | – | 0.7% | 2023-10-25 |
| CVE-2026-75110MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET | MemTensor · MemOS | Unlikely | 9.8 | 0.7% | 2026-08-17 |
| CVE-2024-39534Junos OS Evolved: Connections to the network and broadcast address accepted | Juniper Networks · Junos OS Evolved | Unlikely | 5.4 | 0.7% | 2024-10-11 |
| CVE-2023-23762Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling | GitHub · Enterprise Server | Unlikely | 6.5 | 0.6% | 2023-04-07 |
| CVE-2015-10129planet-freo auth.inc.php comparison | Samwilson · planet-freo | Unlikely | 3.7 | 0.6% | 2024-02-04 |
| CVE-2023-23765Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling | GitHub · Enterprise Server | Unlikely | 4.8 | 0.6% | 2023-08-30 |
| CVE-2026-22660FlaskBB Logic Flaw Authorization Group Deletion via Bulk AJAX Endpoint | flaskbb · flaskbb | Unlikely | 7.2 | 0.6% | 2026-07-10 |
| CVE-2026-56101OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS | OpenBSD · OpenBSD | Unlikely | 5.3 | 0.6% | 2026-09-08 |
| CVE-2023-22435Server bad parsing implementation - stack overflow in server::get_db_path_for_driver | Honeywell · Experion Server | Unlikely | 7.5 | 0.6% | 2023-07-13 |
| CVE-2025-48952NetAlertX has Password Bypass Vulnerability due to Loose Comparison in PHP | jokob-sk · NetAlertX | Unlikely | 9.4 | 0.6% | 2025-07-04 |
| CVE-2022-26691A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may… | Apple · macOS | Unlikely | – | 0.6% | 2022-05-26 |
| CVE-2023-23764Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling | GitHub · Enterprise Server | Unlikely | 4.8 | 0.6% | 2023-07-27 |
| CVE-2026-61795Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation | projectcapsule · capsule | Unlikely | 6.8 | 0.6% | 2026-09-18 |
| CVE-2022-35091SWFTools commit 772e55a2 was discovered to contain a floating point exception (FPE) via DCTStream::readMCURow() at /xpdf/Stream.cc.ow() | Swftools · Swftools | Unlikely | 5.5 | 0.6% | 2022-09-23 |
| CVE-2026-33816CVE-2026-33816 in github.com/jackc/pgx | github.com/jackc/pgx/v5 · github.com/jackc/pgx/v5/pgproto3 | Unlikely | 9.8 | 0.6% | 2026-04-07 |
| CVE-2025-54336In Plesk Obsidian 18.0.70, _isAdminPasswordValid uses an == comparison. Thus, if the correct password is "0e" followed by any digit string, then an attacker can login with any oth… | – | Unlikely | 9.8 | 0.6% | 2025-08-19 |
| CVE-2023-46660Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token hashes are equal, potentially allo… | Jenkins Project · Jenkins Zanata Plugin | Unlikely | – | 0.6% | 2023-10-25 |
| CVE-2021-44078An issue was discovered in split_region in uc.c in Unicorn Engine before 2.0.0-rc5. It allows local attackers to escape the sandbox. An attacker must first obtain the ability to e… | Unicorn-Engine · Unicorn Engine | Unlikely | – | 0.5% | 2021-12-26 |
| CVE-2026-67207Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreController | wolfcms · wolfcms | Unlikely | 8.8 | 0.5% | 2026-07-30 |
| CVE-2026-48032Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers | kerberosmansour · hulumi | Unlikely | 8.3 | 0.5% | 2026-07-24 |
| CVE-2015-6964MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses into the list that MultiBit uses to send fees to the developers… | Multibit · Multibit Hd | Unlikely | 5.3 | 0.5% | 2023-09-25 |
| CVE-2026-34210mppx has Stripe charge credential replay via missing idempotency check | wevm · mppx | Unlikely | 6.0 | 0.5% | 2026-03-31 |
| CVE-2021-1904Child process can leak information from parent process due to numeric pids are getting compared and these pid can be reused in Snapdragon Auto, Snapdragon Compute, Snapdragon Conn… | Qualcomm, Inc. · Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consum… | Unlikely | 6.2 | 0.5% | 2021-09-08 |
| CVE-2024-23903Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook token are… | Jenkins Project · Jenkins GitLab Branch Source Plugin | Unlikely | 5.3 | 0.5% | 2024-01-24 |
| CVE-2026-93957olivier-ls PHP-FTS Filter Matching SearchEngine.php matchesSingleFilter comparison | olivier-ls · PHP-FTS | Unlikely | 4.3 | 0.5% | 2026-09-20 |
| CVE-2022-36148fdkaac commit 53fe239 was discovered to contain a floating point exception (FPE) via wav_open at /src/wav_reader.c. | Fdkaac Project · Fdkaac | Unlikely | – | 0.5% | 2022-08-16 |
| CVE-2022-35434jpeg-quantsmooth before commit 8879454 contained a floating point exception (FPE) via /jpeg-quantsmooth/jpegqs+0x4f5d6c. | Jpeg Quant Smooth Project · Jpeg Quant Smooth | Unlikely | – | 0.5% | 2022-08-16 |
| CVE-2022-38230XPDF commit ffaf11c was discovered to contain a floating point exception (FPE) via DCTStream::decodeImage() at /xpdf/Stream.cc. | Xpdf Project · Xpdf | Unlikely | – | 0.5% | 2022-08-16 |
| CVE-2022-34999JPEGDEC commit be4843c was discovered to contain a FPE via DecodeJPEG at /src/jpeg.inl. | Bitbanksoftware · Jpegdec | Unlikely | – | 0.5% | 2022-08-16 |
| CVE-2026-73258Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart | cesanta · mongoose | Unlikely | 6.5 | 0.5% | 2026-08-20 |
| CVE-2026-20333Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Incorrect Comparison… | Cisco · Cisco Secure Firewall Adaptive Security Appliance (ASA) Software | Unlikely | 8.8 | 0.5% | 2026-09-16 |
| CVE-2026-91997evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass | evolution-foundation · evolution-api | Unlikely | 5.3 | 0.4% | 2026-09-15 |
| CVE-2025-9401HuangDou UTCMS Login login.php comparison | HuangDou · UTCMS | Unlikely | 3.7 | 0.4% | 2025-08-25 |
| CVE-2026-57222Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6 | OISF · suricata | Unlikely | 5.3 | 0.4% | 2026-09-18 |
| CVE-2021-20219A denial of service vulnerability was found in n_tty_receive_char_special in drivers/tty/n_tty.c of the Linux kernel. In this flaw a local attacker with a normal user privilege co… | Linux · kernel | Unlikely | – | 0.4% | 2021-03-23 |
| CVE-2026-50029js-toml has silent type confusion via falsy-primitive duplicate-key bypass | sunnyadn · js-toml | Unlikely | 5.3 | 0.4% | 2026-08-14 |
| CVE-2023-27579TensorFlow has Floating Point Exception in TFLite in conv kernel | tensorflow · tensorflow | Unlikely | 7.5 | 0.4% | 2023-03-24 |
| CVE-2023-25675TensorFlow has Segfault in Bincount with XLA | tensorflow · tensorflow | Unlikely | 7.5 | 0.4% | 2023-03-24 |
Data as of 2026-11-15.