CWE-1025
21 CVEs classified under CWE-1025. Browse by severity and year.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-78619 | Critical | 9.8 | 2026-08-25 | Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user ide… |
CVE-2025-25306 | Critical | 9.3 | 2025-03-10 | Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the `id` and `url`… |
CVE-2026-9800 | High | 8.1 | 2026-06-25 | A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and… |
CVE-2026-40880 | High | 8.1 | 2026-04-21 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and zebra-consensus version 5.0.2, a logic error in Zebra's transaction verificat… |
CVE-2026-29811 | High | 7.7 | 2026-09-13 | CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias")… |
CVE-2026-79677 | High | 7.5 | 2026-09-23 | Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of l… |
CVE-2023-54390 | High | 7.5 | 2026-09-09 | PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arr… |
CVE-2026-75840 | High | 7.5 | 2026-08-18 | ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expr… |
CVE-2026-104048 | Medium | 6.8 | 2026-10-06 | A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifie… |
CVE-2025-32464 | Medium | 6.8 | 2025-04-09 | HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the replacement of… |
CVE-2026-48860 | Medium | 6.5 | 2026-06-10 | Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN… |
CVE-2026-40227 | Medium | 6.2 | 2026-04-10 | In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element. |
CVE-2024-20342 | Medium | 5.8 | 2024-10-23 | Multiple Cisco products are affected by a vulnerability in the rate filtering feature of the Snort detection engine that could allow an unauthenticated, remote… |
CVE-2026-21691 | Medium | 5.4 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2025-2888 | Medium | 4.5 | 2025-03-27 | During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform the next update, th… |
CVE-2025-2887 | Medium | 4.5 | 2025-03-27 | During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to fetch a target from an incorrect source… |
CVE-2025-27839 | Low | 3.2 | 2025-03-08 | operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation (genuineness check) that c… |
CVE-2026-100248 | | 2026-09-25 | The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin. | |
CVE-2026-14441 | | 2026-09-24 | A logic flaw in Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structure… | |
CVE-2026-93854 | | 2026-09-18 | In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id}… |
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-104048 | Medium | 6.8 | 2026-10-06 | A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifie… |
CVE-2026-100248 | | 2026-09-25 | The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin. | |
CVE-2026-14441 | | 2026-09-24 | A logic flaw in Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structure… | |
CVE-2026-79677 | High | 7.5 | 2026-09-23 | Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of l… |
CVE-2026-93854 | | 2026-09-18 | In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id}… | |
CVE-2026-29811 | High | 7.7 | 2026-09-13 | CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias")… |
CVE-2023-54390 | High | 7.5 | 2026-09-09 | PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper null value handling in arr… |
CVE-2026-78619 | Critical | 9.8 | 2026-08-25 | Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user ide… |
CVE-2026-75840 | High | 7.5 | 2026-08-18 | ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expr… |
CVE-2025-71377 | | 2026-07-16 | stoatchat (delta) versions before 20250210-1 (0.8.2) contain a logic error in the query messages route. When fetching messages 'nearby' another message, the da… | |
CVE-2026-9800 | High | 8.1 | 2026-06-25 | A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and… |
CVE-2026-48860 | Medium | 6.5 | 2026-06-10 | Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated bypass of the distribution-over-TLS LAN… |
CVE-2026-40880 | High | 8.1 | 2026-04-21 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and zebra-consensus version 5.0.2, a logic error in Zebra's transaction verificat… |
CVE-2026-40227 | Medium | 6.2 | 2026-04-10 | In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element. |
CVE-2026-21691 | Medium | 5.4 | 2026-01-07 | iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color manage… |
CVE-2025-32464 | Medium | 6.8 | 2025-04-09 | HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of the replacement of… |
CVE-2025-2888 | Medium | 4.5 | 2025-03-27 | During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform the next update, th… |
CVE-2025-2887 | Medium | 4.5 | 2025-03-27 | During a target rollback, the client fails to detect the rollback for delegated targets. This could cause the client to fetch a target from an incorrect source… |
CVE-2025-25306 | Critical | 9.3 | 2025-03-10 | Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the `id` and `url`… |
CVE-2025-27839 | Low | 3.2 | 2025-03-08 | operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation (genuineness check) that c… |
CVE-2024-20342 | Medium | 5.8 | 2024-10-23 | Multiple Cisco products are affected by a vulnerability in the rate filtering feature of the Snort detection engine that could allow an unauthenticated, remote… |