CWE-1254
7 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 7Published CVEs6 of them scored
- 6Last 12 monthspublished in the last year
- 0Critical4 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-126129
The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being…
Auth0 · Auth0 ASP.NET Core Authentication
Not scored - CVE-2026-28929
A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe…
Apple · iOS and iPadOS
High7.5 - CVE-2026-34572
CI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
ci4-cms-erp · ci4ms
High8.8 - CVE-2026-34570
CI4MS: Account Deletion Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
ci4-cms-erp · ci4ms
High8.8 - CVE-2026-27007
OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation
openclaw · openclaw
Medium4.8 - CVE-2013-10031
Plack::Middleware::Session versions before 0.17 for Perl may be vulnerable to HMAC comparison timing attacks
MIYAGAWA · Plack::Middleware::Session
High7.5 - CVE-2022-39308
GoCD API authentication of user access tokens subject to timing attack during comparison
gocd · gocd
Medium6.5