CWE-1025
24 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 24Published CVEs24 of them scored
- 18Last 12 monthspublished in the last year
- 2Critical13 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-125271
AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization
AWS · aws-api-mcp-server
High8.5 - CVE-2026-123592
Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Name Hash Collision
hickory-dns · hickory-dns
High8.2 - CVE-2026-114649
Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
MongoDB · C# Driver
High7.6 - CVE-2026-104048
Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation
Red Hat · Red Hat Enterprise Linux 10
Medium6.8 - CVE-2026-100248
The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin.
Rattadan · Cosmowarp Contract
High8.4 - CVE-2026-14441
Logic flaw in SANnav Java cache key handling object comparison handling
Brocade · SANnav
Medium6.9 - CVE-2026-79677
Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout
Apache Software Foundation · Apache Tomcat
High7.5 - CVE-2026-93854
In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id}…
OpenStack · Blazar
High7.2 - CVE-2026-29811
CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias")…
CyberPanel · CyberPanel
High7.7 - CVE-2023-54390
PocketMine-MP before 5.3.1 Denial of Service via LoginPacket
pmmp · PocketMine-MP
High8.7