Advisories · Weakness

CWE-391.

Every Advisory and CVE whose sources give the weakness CWE-391, newest first.

CVE-2026-67080 CVE record

CVSS 6.5 Medium

HCL BigFix AEX is affected by multiple security vulnerabilities.
- HCL Software BigFix AEX
- Information disclosure
- CWE-391
Not analysed yet 28 Oct 2026
CVE-2026-56727 CVE record

CVSS 7.1 High

Zammad: PGP signature spoofing via unvalidated verification return
- zammad
- Authentication bypass
- Weak cryptography or TLS
Not analysed yet 25 Sept 2026
openssl-encrypt PyPI

CVSS 9.3 CriticalCritical · CVSS 9+

openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret fro...
- CWE-391
<1.4.0 · fixed in 1.4.0

GHSA-p3gq-pcg9-qvfv · CVE-2026-74900 Not analysed yet 17 Aug 2026
picklescan PyPI

CVSS 9.8 Critical

Duplicate Advisory: Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass
- CWE-391
* · no fixed version yet

GHSA-5rph-q42j-36j9 Withdrawn Not analysed yet 17 Jun 2026
picklescan PyPI

CVSS 9.3 CriticalCritical · CVSS 9+

Picklescan has pickle parsing logic flaw that leads to malicious pickle file bypass
- Insecure deserialization
- CWE-391
<0.0.27 · fixed in 0.0.27

GHSA-9gvj-pp9x-gcfr · CVE-2025-71325 Not analysed yet 12 Aug 2025
org.apache.tomcat:tomcat-catalina Maven

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Tomcat - Authentication Bypass
- CWE-391
- CWE-754
<9.0.96 || >=10.1.0-M1, <10.1.30 || >=11.0.0-M1, <11.0.1 · fixed in 9.0.96, 10.1.30, 11.0.1

GHSA-xcpr-7mr4-h4xq · CVE-2024-52316 Not analysed yet 18 Nov 2024
CVE-2022-20849 CVE record

CVSS 6.1 Medium

Cisco IOS XR Software Broadband Network Gateway PPPoE Denial of Service Vulnerability
- Cisco IOS XR Software
- CWE-391
Not analysed yet 15 Nov 2024
CVE-2024-23326 CVE record

CVSS 5.9 Medium

Envoy incorrectly accepts HTTP 200 response for entering upgrade mode
- envoy
- CWE-391
Not analysed yet 4 Jun 2024
CVE-2023-32871 CVE record

CVSS 5.3 Medium

In DA, there is a possible permission bypass due to an incorrect status check.
- MediaTek, Inc. MT2737, MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT6781, MT6785, MT6789, MT6833, MT6835, MT6853, MT6853T, MT6855, MT6873, MT6877, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6893, MT6895, MT6897, MT6980, MT6983, MT6985, MT6989, MT6990, MT8167, MT8167S, MT8168, MT8173, MT8175, MT8185, MT8188, MT8195, MT8321, MT8362A, MT8365, MT8385, MT8390, MT8395, MT8755, MT8765, MT8766, MT8768, MT8775, MT8781, MT8786, MT8788, MT8789, MT8791, MT8791T, MT8797, MT8798
- CWE-391
Not analysed yet 6 May 2024
froxlor/froxlor Packagist

CVSS 5.3 Medium

Froxlor contains Unchecked Error Condition
- CWE-391
- CWE-754
<2.0.10 · fixed in 2.0.10

GHSA-3chw-8jq2-w769 · CVE-2023-0572 Not analysed yet 30 Jan 2023
CVE-2022-22160 CVE record

CVSS 6.5 Medium

Junos OS: MX Series: The bbe-smgd process crashes if an unsupported configuration exists and a PPPoE client sends a specific message
- Juniper Networks Junos OS
- CWE-391
Not analysed yet 19 Jan 2022
CVE-2020-14383 CVE record

A flaw was found in samba's DNS server.
- samba
- CWE-391
Not analysed yet 2 Dec 2020
ecdsa PyPI

CVSS 3.7 Low

Duplicate Advisory: possible DoS caused by malformed signature decoding in Pure-Python ECDSA
- CWE-391
<0.13.3 · fixed in 0.13.3

GHSA-2mrj-435v-c2cr · CVE-2019-14853 Withdrawn Not analysed yet 2 Dec 2019
grunt-gh-pages npm

grunt-gh-pages before 0.10.0 may allow unencrypted GitHub credentials to be written to a log file
- CWE-391
<0.10.0 · fixed in 0.10.0

GHSA-rrj3-qmh8-72pf · CVE-2016-10526 Not analysed yet 18 Feb 2019
CVE-2018-1091 CVE record

In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POW…
- Linux kernel v4.13 and newer
- CWE-391
Not analysed yet 27 Mar 2018
CVE-2017-12187 CVE record

The X.Org Foundation xorg-x11-server: xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing…
- The X.Org Foundation xorg-x11-server
- CWE-391
Not analysed yet 24 Jan 2018
CVE-2017-12186 CVE record

The X.Org Foundation xorg-x11-server: xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension…
- The X.Org Foundation xorg-x11-server
- CWE-391
Not analysed yet 24 Jan 2018
CVE-2017-12185 CVE record

xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
- CWE-391
Not analysed yet 24 Jan 2018
CVE-2017-12184 CVE record

The X.Org Foundation xorg-x11-server: xorg-x11-server before 1.19.5 was missing length validation in XINERAMA extension…
- The X.Org Foundation xorg-x11-server
- CWE-391
Not analysed yet 24 Jan 2018
CVE-2017-12183 CVE record

The X.Org Foundation xorg-x11-server: xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing…
- The X.Org Foundation xorg-x11-server
- CWE-391
Not analysed yet 24 Jan 2018
CVE-2017-12182 CVE record

The X.Org Foundation xorg-x11-server: xorg-x11-server before 1.19.5 was missing length validation in XFree86 DRI extension…
- The X.Org Foundation xorg-x11-server
- CWE-391
Not analysed yet 24 Jan 2018
CVE-2017-12181 CVE record

The X.Org Foundation xorg-x11-server: xorg-x11-server before 1.19.5 was missing length validation in XFree86 DGA extension…
- The X.Org Foundation xorg-x11-server
- CWE-391
Not analysed yet 24 Jan 2018
CVE-2017-12180 CVE record

The X.Org Foundation xorg-x11-server: xorg-x11-server before 1.19.5 was missing length validation in XFree86 VidModeExtension…
- The X.Org Foundation xorg-x11-server
- CWE-391
Not analysed yet 24 Jan 2018
CVE-2017-12179 CVE record

The X.Org Foundation xorg-x11-server: xorg-x11-server before 1.19.5 was vulnerable to integer overflow in…
- The X.Org Foundation xorg-x11-server
- CWE-391
Not analysed yet 24 Jan 2018
CVE-2017-12178 CVE record

The X.Org Foundation xorg-x11-server: xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy…
- The X.Org Foundation xorg-x11-server
- CWE-391
Not analysed yet 24 Jan 2018
CVE-2017-12177 CVE record

The X.Org Foundation xorg-x11-server: xorg-x11-server before 1.19.5 was vulnerable to integer overflow in ProcDbeGetVisualInfo…
- The X.Org Foundation xorg-x11-server
- CWE-391
Not analysed yet 24 Jan 2018
CVE-2017-12176 CVE record

The X.Org Foundation xorg-x11-server: xorg-x11-server before 1.19.5 was missing extra length validation in…
- The X.Org Foundation xorg-x11-server
- CWE-391
Not analysed yet 24 Jan 2018
CVE-2017-7496 CVE record

Red Hat, Inc. fedora-arm-installer: fedora-arm-installer up to and including 1.99.16 is vulnerable to local privilege…
- Red Hat, Inc. fedora-arm-installer
- CWE-391
Not analysed yet 26 Jun 2017