CWE-358.

Authlib: empty signatures validation in JWS JSON deserialization

• Weak cryptography or TLS
• CWE-20

<1.9.0 · fixed in 1.9.0

Microsoft Security Advisory CVE-2026-70174 - .NET and Visual Studio Remote Code Execution Vulnerability

• CWE-358

>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2 · fixed in 8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2

Microsoft PowerShell Security Feature Bypass Vulnerability

• Microsoft PowerShell 7.4
• Microsoft PowerShell 7.5
• CWE-358

Microsoft PowerShell Security Feature Bypass Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-358

A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path

• NLnet Labs Unbound
• CWE-358

Trezor Safe improper security check in on-device display

• Trezor Safe 3
• Trezor Safe 7
• CWE-358

Secure Boot Security Feature Bypass Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-358

Improper Data Validation in liboauth2

• OpenIDC liboauth2
• CWE-358

DVP80ES3 Improperly Implemented Security Check for Standard vulnerability

• deltaww DVP80ES3
• CWE-358

Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication

• Broken access control
• CWE-358

>=1.1.0, <1.2.0 · fixed in 1.2.0

Apache Kerby has a bypass the Kerberos pre-authentication check

• Authentication bypass
• CWE-358

<2.1.2 · fixed in 2.1.2

Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control

• CWE-20
• CWE-358

>=4.2.0, <4.2.2 || <4.1.7 · fixed in 4.2.2, 4.1.7

Google Chrome: Inappropriate implementation in WebAPKs in Google Chrome on Android prior to…

• Google Chrome
• CWE-358

Google Chrome: Inappropriate implementation in Keyboard in Google Chrome prior to 149.0.7827.53 allowed…

• Google Chrome
• CWE-358

Protection mechanism failure in Apple macOS

• Apple macOS
• CWE-358
• CWE-693

MantisBT has a Content Security Policy bypass via attachments

• Cross-site scripting (XSS)
• CWE-358

<2.28.2 · fixed in 2.28.2

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

• Authentication bypass
• CWE-358

>=15.2.0, <15.5.18 || >=16.0.0, <16.2.6 · fixed in 15.5.18, 16.2.6

Ella Core has handover failures during concurrent Security Mode Command

• CWE-358

<1.10.0 · fixed in 1.10.0

Ella Core has a UE Security Capability bypass on NGAP PathSwitchRequest

• CWE-358

<1.10.0 · fixed in 1.10.0

Ella Core Vulnerable to UE Downlink Redirection via Forged PDUSessionResourceSetupResponse

• Broken access control
• CWE-358

<1.10.0 · fixed in 1.10.0

Diffusers has a `trust_remote_code` bypass via `custom_pipeline` and local custom components

• Code injection
• CWE-358

<0.38.0 · fixed in 0.38.0

Free5GC AMF has Missing Concurrent NAS SMC Validation During NGAP Handover

• CWE-358

<=1.4.3 · no fixed version yet

Free5GC AMF Bypasses UE Security Capabilities on NGAP PathSwitchRequest

• CWE-358

<=1.4.3 · no fixed version yet

HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header

• HCL BigFix Service Management (SM)
• CWE-358

HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability

• HCL DFXAnalytics
• CWE-358

Eaton IPP software: A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP)…

• Eaton IPP software
• CWE-358

Google Chrome: Inappropriate implementation in PDF in Google Chrome prior to 147.0.7727.55 allowed a…

• Google Chrome
• CWE-358

zcashd: Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain…

• zcashd
• CWE-358

SuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass

• SuiteCRM
• Code injection
• CWE-358

Acceptance of CertificateVerify Message before ClientKeyExchange in TLS 1.2

• wolfSSL
• CWE-358

IBM WebSphere Application Server could provide weaker than expected security

• IBM WebSphere Application Server
• CWE-358

Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens

• CWE-358

>=26.5.0, <26.5.3 || <26.4.9 · fixed in 26.5.3, 26.4.9

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.

• Yokogawa Electric Corporation FAST/TOOLS
• CWE-358

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.

• Yokogawa Electric Corporation FAST/TOOLS
• CWE-358

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.

• Yokogawa Electric Corporation FAST/TOOLS
• CWE-358

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.

• Yokogawa Electric Corporation FAST/TOOLS
• CWE-358

Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.

• NAVER Whale browser
• CWE-358

BullWall Ransomware Containment file count detection bypass

• BullWall Ransomware Containment
• CWE-358

Vulnerability of improper criterion security check in the card module.

• Huawei HarmonyOS
• CWE-358

Vulnerability of improper criterion security check in the call module.

• Huawei HarmonyOS
• CWE-358

Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.

• NAVER Whale browser
• CWE-358

Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.

• NAVER Whale browser
• CWE-358

Fortinet FortiOS: An Improperly Implemented Security Check for Standard vulnerability [CWE-358]…

• Fortinet FortiOS
• Fortinet FortiProxy
• CWE-358

HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP)

• HCL Software Unica Platform
• CWE-358

Suricata is Vulnerable to Detection Bypass via Crafted Multiple SYN Packets

• OISF suricata
• CWE-358

Bluetooth: Out-Of-Context le_conn_rsp Handling

• Zephyr
• CWE-358

A permissions issue was addressed with additional restrictions.

• Apple macOS
• CWE-358

Intel(R) Xeon(R) 6 Processors when using Intel(R) SGX or…: Improperly implemented security check for standard in the DDRIO configuration for some…

• Intel(R) Xeon(R) 6 Processors when using Intel(R) SGX or Intel(R) TDX
• CWE-358

Comodo Dragon HSTS security check

• Comodo Dragon
• CWE-358

Fortinet FortiOS: An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS…

• Fortinet FortiOS
• Fortinet FortiProxy
• CWE-358

SpiceDB checks involving relations with caveats can result in no permission when permission is expected in github.com/authzed/spicedb

• CWE-358

<1.44.2 · fixed in 1.44.2

Google Chrome: Inappropriate implementation in Extensions in Google Chrome prior to 135.0.7049.52…

• Google Chrome
• CWE-358

Fortinet FortiSandbox: A stack-based buffer overflow vulnerability (CWE-121) in the profile parser of…

• Fortinet FortiSandbox
• CWE-358

FortiOS 6.2 running AV engine version 6.00142 and below, FortiOS 6.4 running AV engine version 6.00144 and below and FortiClient 6.2 running AV engine version 6.00137 and below may not immediately de…

• Fortinet FortiClientWindows
• CWE-358

Microsoft Edge (Chromium-based) Spoofing Vulnerability

• Microsoft Edge (Chromium-based)
• CWE-358

Client Secret not checked with OAuth Password grant type

• arcinfo PcVue
• CWE-358

Fortinet FortiOS: An improper neutralization of special elements in output used by a downstream component…

• Fortinet FortiOS
• Fortinet FortiProxy
• CWE-358

In wifi_item_edit_content of styles.xml , there is a possible FRP bypass due to Missing check for FRP state.

• Google Android
• CWE-358

Fortinet FortiADC: An improperly implemented security check for standard vulnerability [CWE-358] in FortiADC…

• Fortinet FortiADC
• CWE-358

Google Chrome: Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a…

• Google Chrome
• CWE-358