CWE-440 · Expected Behavior Violation
41 CVEs classified under CWE-440 (Expected Behavior Violation). Browse by severity and year.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-41035 | Critical | 9.8 | 2021-10-25 | In Eclipse Openj9 before version 0.29.0, the JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods. |
CVE-2019-6569 | Critical | 9.1 | 2019-03-26 | The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network. An attacker could… |
CVE-2024-32971 | Critical | 9.0 | 2024-05-02 | Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. The affected versions of Apollo Rout… |
CVE-2025-8850 | High | 8.8 | 2025-10-30 | In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow. The system allows users to disable 2FA… |
CVE-2018-12550 | High | 8.1 | 2019-03-27 | When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only comments or blank lines… |
CVE-2023-4807 | High | 7.8 | 2023-09-08 | Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications on the Window… |
CVE-2024-30246 | High | 7.6 | 2024-03-29 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. A malicious user could exploit this issue on purpose to delete… |
CVE-2022-3281 | High | 7.5 | 2022-10-17 | WAGO Series PFC100/PFC200, Series Touch Panel 600, Compact Controller CC100 and Edge Controller in multiple versions are prone to a loss of MAC-Address-Filteri… |
CVE-2023-32731 | High | 7.4 | 2023-06-09 | When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be ski… |
CVE-2026-42752 | Medium | 6.5 | 2026-06-15 | Unauthenticated Bypass Vulnerability in Stripe Payments <= 2.0.98 versions. |
CVE-2025-52953 | Medium | 6.5 | 2025-07-11 | An Expected Behavior Violation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated a… |
CVE-2025-6211 | Medium | 6.5 | 2025-07-10 | A vulnerability in the DocugamiReader class of the run-llama/llama_index repository, up to version 0.12.28, involves the use of MD5 hashing to generate IDs for… |
CVE-2023-6129 | Medium | 6.5 | 2024-01-09 | Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on Po… |
CVE-2023-2088 | Medium | 6.5 | 2023-05-12 | A flaw was found in OpenStack due to an inconsistency between Cinder and Nova. This issue can be triggered intentionally or by accident. A remote, authenticate… |
CVE-2019-5108 | Medium | 6.5 | 2019-12-23 | An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP… |
CVE-2019-5062 | Medium | 6.5 | 2019-12-12 | An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By… |
CVE-2019-5061 | Medium | 6.5 | 2019-12-12 | An exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates for stations, before… |
CVE-2024-47762 | Medium | 5.8 | 2024-10-03 | Backstage is an open framework for building developer portals. Configuration supplied through APP_CONFIG_* environment variables, for example APP_CONFIG_backen… |
CVE-2025-13940 | Medium | 5.5 | 2025-12-04 | An Expected Behavior Violation [CWE-440] vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS boot time system integrity che… |
CVE-2022-3344 | Medium | 5.5 | 2022-10-25 | A flaw was found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail to intercept the shutdown of a cooperative nested gues… |