Advisories · Weakness
CWE-1025.
Every Advisory and CVE whose sources give the weakness CWE-1025, newest first.
- CVSS 8.1 High
Keycloak vulnerable to authorization bypass via incorrect uri comparison
- CWE-1025
<26.0.10 · fixed in 26.0.10
GHSA-f5p5-6xmx-p252 · CVE-2026-9800 - CVSS 7.6 High
Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
- MongoDB C# Driver
- CWE-1025
- CVSS 6.8 Medium
Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- CWE-1025
- CVSS 8.4 High
The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin.
- Rattadan Cosmowarp Contract
- CWE-1025
- CVSS 6.9 Medium
Logic flaw in SANnav Java cache key handling object comparison handling
- Brocade SANnav
- CWE-1025
- CVSS 7.5 High
Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout
- Apache Software Foundation Apache Tomcat
- Denial of service
- CWE-1025
- CVSS 7.2 High
OpenStack Blazar: In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level…
- OpenStack Blazar
- CWE-1025
- CVSS 7.7 High
CyberPanel: CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e…
- CyberPanel
- CWE-1025
- CVSS 9.8 CriticalCritical · CVSS 9+
Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically
- CWE-305
- CWE-1025
- CVSS 8.7 High
ArcadeDB before 26.8.1 Arbitrary File Read via Unescaped Regex
- ArcadeData arcadedb
- CWE-1025
- CVSS 8.7 High
stoatchat before 20250210-1 Unrestricted Message History Fetch
- stoatchat
- CWE-1025
- CVSS 8.1 High
Duplicate Advisory: Keycloak vulnerable to authorization bypass via incorrect uri comparison
- CWE-1025
* · no fixed version yet
GHSA-79qw-g39g-mfxc - CVSS 7.5 High
Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist
- Erlang OTP
- Broken access control
- CWE-1025
- CVSS 7.2 High
Zebra: Cached Mempool Verification Bypasses Consensus Rules for Ahead-of-Tip Blocks
- CWE-1025
<5.0.2 · fixed in 5.0.2
GHSA-xvj8-ph7x-65gf · CVE-2026-40880 - CVSS 6.2 Medium
systemd: In systemd 260 before 261, a local unprivileged user can trigger an assert via an IPC API…
- systemd
- CWE-1025
- CVSS 5.4 Medium
iccDEV has Type Confusion in CIccTag:IsTypeCompressed()
- InternationalColorConsortium iccDEV
- Memory corruption
- CWE-20
- CVSS 6.8 Medium
HAProxy: HAProxy 2.2 through 3.1.6, in certain uncommon configurations…
- HAProxy
- CWE-1025
- CVSS 5.7 Medium
tough timestamp metadata is cached when it fails snapshot rollback check
- CWE-1025
<0.20.0 · fixed in 0.20.0
GHSA-76g3-38jv-wxh4 · CVE-2025-2888 - CVSS 5.7 Medium
tough failure to detect delegated target rollback
- CWE-1025
<0.20.0 · fixed in 0.20.0
GHSA-q6r9-r9pw-4cf7 · CVE-2025-2887 - CVSS 9.3 CriticalCritical · CVSS 9+
Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes
- misskey
- CWE-346
- CWE-441
- CVSS 3.2 Low
Tangem SDK: operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has…
- Tangem SDK
- CWE-1025
- CVSS 5.8 Medium
Cisco Firepower Threat Defense Software Rate Filter Bypass Vulnerability
- Cisco Firepower Threat Defense Software
- CWE-1025
- CVSS 8.7 High
PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (again)
- CWE-1025
<4.23.1 || >=5.0.0, <5.3.1 · fixed in 4.23.1, 5.3.1
GHSA-92jh-gwch-jq38 · CVE-2023-54390