Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
  • Support the projectPage

CWE-642

21 published CVEs are weaknesses of this kind, as the records or NVD name it.

Atom feed of new CVEsWhat CWE-642 is, at MITRE (opens in a new tab)

Newest CVEs

  • CVE-2026-50053

    Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters

    Zimbra · Zimbra Collaboration Suite

    High8.7
  • CVE-2026-84518

    This issue was addressed through improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious website…

    Apple · Safari

    Medium4.3
  • CVE-2026-65355

    An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS…

    Apple · iOS and iPadOS

    Medium4.3
  • CVE-2026-65352

    An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS…

    Apple · iOS and iPadOS

    Medium4.3
  • CVE-2026-78655

    Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session

    Punk-TOTP

    Critical9.1
  • CVE-2026-29146

    Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default

    Apache Software Foundation · Apache Tomcat

    High7.5
  • CVE-2025-26787

    An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2. The Admin CLI command used to configure Certificate…

    Product not named

    Medium4.7
  • CVE-2025-49090

    The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution before 2.1) has deficient state resolution.

    Matrix · Matrix specification

    High7.1
  • CVE-2024-58265

    The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery.

    mcginty · snow

    Low3.1
  • CVE-2025-54566

    hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue to CVE-2024-26327.

    QEMU · QEMU

    Medium4.2
All 21 in the list