Skip to content
Noroxi

CWE-1025 · 18 records

Comparison Using Wrong Factors

CVEs in this class

18 records

  • CVE-2025-71377
    34Monitor

    stoatchat before 20250210-1 Unrestricted Message History Fetch

    HighCVSS 8.7No exploitEPSS 0%

    stoatchat · stoatchatJul 16, 2026

  • CVE-2023-54390
    34Monitor

    PocketMine-MP before 5.3.1 Denial of Service via LoginPacket

    HighCVSS 8.7No exploitEPSS 0%

    pmmp · pocketmine-mpSep 9, 2026

  • CVE-2024-20342
    34Monitor

    Cisco Firepower Threat Defense Software Rate Filter Bypass Vulnerability

    HighCVSS 8.6No exploitEPSS 0%

    cisco · snortOct 23, 2024

  • CVE-2026-75840
    34Monitor

    ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped Regex

    HighCVSS 8.7No exploitEPSS 0%

    arcadedata · arcadedbAug 18, 2026

  • CVE-2026-100248
    33Monitor

    The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin.

    HighCVSS 8.4No exploitEPSS 0%

    rattadan · cosmowarp contractSep 25, 2026

  • CVE-2026-9800
    32Monitor

    Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison

    HighCVSS 8.1No exploitEPSS 0%

    redhat · build of keycloakJun 25, 2026

  • CVE-2026-104048
    32Monitor

    Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation

    HighCVSS 8.1No exploitEPSS 0%

    fedoraproject · sssdOct 6, 2026

  • CVE-2026-123592
    32Monitor

    Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Name Hash Collision

    HighCVSS 8.2No exploit

    hickory-dns · hickory-dnsToday

  • CVE-2026-29811
    30Monitor

    CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normal

    HighCVSS 7.7No exploitEPSS 0%

    cyberpanel · cyberpanelSep 13, 2026

  • CVE-2026-114649
    30Monitor

    Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache

    HighCVSS 7.6No exploitEPSS 0%

    mongodb · c# driverOct 22, 2026

  • CVE-2026-93854
    28Monitor

    In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2

    HighCVSS 7.2No exploitEPSS 0%

    openstack · blazarSep 18, 2026

  • CVE-2026-40880
    28Monitor

    Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks

    HighCVSS 7.2No exploitEPSS 0%

    zfnd · zebra-consensusApr 21, 2026

  • CVE-2025-32464
    27Monitor

    HAProxy 2.2 through 3.1.6, in certain uncommon configurations, has a sample_conv_regsub heap-based buffer overflow because of mishandling of

    MediumCVSS 6.8No exploitEPSS 0%

    haproxy · haproxyApr 8, 2025

  • CVE-2026-14441
    27Monitor

    Logic flaw in SANnav Java cache key handling object comparison handling

    MediumCVSS 6.9No exploitEPSS 0%

    brocade · sannavSep 24, 2026

  • CVE-2025-2888
    22Monitor

    Improper timestamp caching during snapshot rollback in tough

    MediumCVSS 5.7No exploitEPSS 0%

    amazon · toughMar 27, 2025

  • CVE-2025-2887
    22Monitor

    Failure to detect delegated target rollback in tough

    MediumCVSS 5.7No exploitEPSS 0%

    amazon · toughMar 27, 2025

  • CVE-2026-40227
    22Monitor

    In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API call with an array or map that has a null element.

    MediumCVSS 5.5No exploitEPSS 0%

    systemd project · systemdApr 10, 2026

  • CVE-2025-27839
    12Monitor

    operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation (genuin

    LowCVSS 3.2No exploitEPSS 0%

    tangem · sdkMar 7, 2025

All vulnerability classes