CWE-394 · 15 records

Unexpected Status Code or Return Value

CVEs in this class

15 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2025-12516No exploit	Lack of Graceful Error Handling - HTTP 5xx Errorazure-access · blu-ic2 firmware · CWE-394 Pre-auth	Critical10.0	—	0.3%	Oct 30, 2025
40Plan	CVE-2025-12515No exploit	Systemic Internal Server Errors - HTTP 500 Responseazure-access · blu-ic4 firmware · CWE-394 Pre-auth	Critical10.0	—	0.3%	Oct 30, 2025
39Monitor	CVE-2026-25085No exploit	Copeland XWEB and XWEB Pro Unexpected Status Code or Return Valuecopeland · xweb 500b pro firmware · CWE-394 Pre-auth	Critical9.8	—	0.5%	Feb 26, 2026
30Monitor	CVE-2019-0066No exploit	Junos OS: A malformed IPv4 packet received by Junos in an NG-mVPN scenario may cause the routing protocol daemon (rpd) process to corejuniper · junos · CWE-394 Pre-auth Denial of service	High7.5	—	1.3%	Oct 9, 2019
30Monitor	CVE-2023-25948No exploit	Server Data type confusion - info leakhoneywell · experion server · CWE-394 Pre-auth	High7.5	—	0.5%	Jul 13, 2023
30Monitor	CVE-2026-76956No exploit	In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in beinlibexpat project · libexpat · CWE-394 Pre-auth Denial of service	High7.5	—	0.2%	Aug 20, 2026
29Monitor	CVE-2025-23013No exploit	In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur.yubico · pam-u2f · CWE-394 Auth bypass Local privilege escalation	High7.3	—	0.4%	Jan 15, 2025
28Monitor	CVE-2024-1713No exploit	Plv8 Deferred Trigger Privilege Escalationplv8 · plv8 · CWE-394	High7.2	—	0.5%	Mar 14, 2024
28Monitor	CVE-2025-48510No exploit	Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availaamd · uprof · CWE-394	High7.1	—	0.1%	Nov 24, 2025
27Monitor	CVE-2025-22854No exploit	Possible thread exhaustion from processing http responses in PingFederate Google Adapterping identity · pingfederate · CWE-394	Medium6.9	—	0.3%	Jun 15, 2025
26Monitor	CVE-2018-20802No exploit	Post-auth queries on compound index may crash mongodmongodb · mongodb · CWE-394 Denial of service	Medium6.5	—	1.5%	Nov 23, 2020
26Monitor	CVE-2019-20924No exploit	Invariant in IndexBoundsBuildermongodb · mongodb · CWE-394 Denial of service	Medium6.5	—	1.2%	Nov 23, 2020
18Monitor	CVE-2023-28975No exploit	Junos OS: The kernel will crash when certain USB devices are insertedjuniper · junos · CWE-394 Denial of service	Medium4.6	—	0.2%	Apr 17, 2023
11Monitor	CVE-2026-73064No exploit	In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into trustedfirmware · mbed tls · CWE-394	Low2.9	—	0.1%	Sep 24, 2026
10Monitor	CVE-2023-48429No exploit	A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2).siemens · sinec ins · CWE-394 Denial of service	Low2.7	—	0.5%	Dec 12, 2023

CVE-2025-12516
40Plan
Lack of Graceful Error Handling - HTTP 5xx Error
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
azure-access · blu-ic2 firmwareOct 30, 2025
CVE-2025-12515
40Plan
Systemic Internal Server Errors - HTTP 500 Response
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
azure-access · blu-ic4 firmwareOct 30, 2025
CVE-2026-25085
39Monitor
Copeland XWEB and XWEB Pro Unexpected Status Code or Return Value
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
copeland · xweb 500b pro firmwareFeb 26, 2026
CVE-2019-0066
30Monitor
Junos OS: A malformed IPv4 packet received by Junos in an NG-mVPN scenario may cause the routing protocol daemon (rpd) process to core
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Denial of service
juniper · junosOct 9, 2019
CVE-2023-25948
30Monitor
Server Data type confusion - info leak
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
honeywell · experion serverJul 13, 2023
CVE-2026-76956
30Monitor
In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in bein
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
libexpat project · libexpatAug 20, 2026
CVE-2025-23013
29Monitor
In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur.
HighCVSS 7.3No exploitEPSS 0%
- Auth bypass
- Local privilege escalation
yubico · pam-u2fJan 15, 2025
CVE-2024-1713
28Monitor
Plv8 Deferred Trigger Privilege Escalation
HighCVSS 7.2No exploitEPSS 0%
plv8 · plv8Mar 14, 2024
CVE-2025-48510
28Monitor
Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availa
HighCVSS 7.1No exploitEPSS 0%
amd · uprofNov 24, 2025
CVE-2025-22854
27Monitor
Possible thread exhaustion from processing http responses in PingFederate Google Adapter
MediumCVSS 6.9No exploitEPSS 0%
ping identity · pingfederateJun 15, 2025
CVE-2018-20802
26Monitor
Post-auth queries on compound index may crash mongod
MediumCVSS 6.5No exploitEPSS 1%
- Denial of service
mongodb · mongodbNov 23, 2020
CVE-2019-20924
26Monitor
Invariant in IndexBoundsBuilder
MediumCVSS 6.5No exploitEPSS 1%
- Denial of service
mongodb · mongodbNov 23, 2020
CVE-2023-28975
18Monitor
Junos OS: The kernel will crash when certain USB devices are inserted
MediumCVSS 4.6No exploitEPSS 0%
- Denial of service
juniper · junosApr 17, 2023
CVE-2026-73064
11Monitor
In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into
LowCVSS 2.9No exploitEPSS 0%
trustedfirmware · mbed tlsSep 24, 2026
CVE-2023-48429
10Monitor
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2).
LowCVSS 2.7No exploitEPSS 0%
- Denial of service
siemens · sinec insDec 12, 2023

All vulnerability classes