Advisories · Weakness

CWE-394.

Every Advisory and CVE whose sources give the weakness CWE-394, newest first.

CVE-2026-123158 CVE record

CVSS 8.1 High

OpenBSD OpenSSH: sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM…
- OpenBSD OpenSSH
- CWE-394
Not analysed yet 5 Nov 2026
CVE-2026-107785 CVE record

CVSS 6.3 Medium

Crux Agent silently fails SKA preshared key rotation when SHA-512 peering is negotiated
- Sirius Computer, Inc. Crux Agent
- CWE-252
- CWE-325
Not analysed yet 9 Oct 2026
CVE-2026-73064 CVE record

CVSS 2.9 Low

trustedfirmware Mbed TLS: In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0…
- trustedfirmware Mbed TLS
- CWE-394
Not analysed yet 24 Sept 2026
CVE-2026-76956 CVE record

CVSS 5.9 Medium

libexpat: In libexpat 2.8.2 and 2.8.3 before 2.8.4…
- libexpat
- CWE-394
Not analysed yet 20 Aug 2026
CVE-2026-25085 CVE record

CVSS 8.6 High

Copeland XWEB and XWEB Pro Unexpected Status Code or Return Value
- Copeland XWEB 300D PRO
- Copeland XWEB 500D PRO
- CWE-394
Not analysed yet 27 Feb 2026
CVE-2025-48510 CVE record

CVSS 7.1 High

Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confidentiality or availability.
- AMD μProf
- CWE-394
Not analysed yet 24 Nov 2025
CVE-2025-12516 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Lack of Graceful Error Handling - HTTP 5xx Error
- Azure Access Technology BLU-IC2
- Azure Access Technology BLU-IC4
- CWE-394
Not analysed yet 30 Oct 2025
CVE-2025-12515 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Systemic Internal Server Errors - HTTP 500 Response
- Azure Access Technology BLU-IC2
- Azure Access Technology BLU-IC4
- CWE-394
Not analysed yet 30 Oct 2025
CVE-2025-22854 CVE record

CVSS 6.9 Medium

Possible thread exhaustion from processing http responses in PingFederate Google Adapter
- Ping Identity PingFederate
- CWE-394
Not analysed yet 15 Jun 2025
CVE-2025-23013 CVE record

CVSS 7.3 High

In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur.
- Yubico pam-u2f
- CWE-394
Not analysed yet 15 Jan 2025
CVE-2024-1713 CVE record

CVSS 7.2 High

Plv8 Deferred Trigger Privilege Escalation
- Plv8
- CWE-394
Not analysed yet 14 Mar 2024
CVE-2023-48429 CVE record

CVSS 2.7 Low

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2).
- Siemens SINEC INS
- CWE-394
Not analysed yet 12 Dec 2023
CVE-2023-25948 CVE record

CVSS 7.5 High

Server Data type confusion - info leak
- Honeywell Experion Server
- Honeywell Experion Station
- CWE-394
Not analysed yet 13 Jul 2023
CVE-2023-28975 CVE record

CVSS 4.6 Medium

Junos OS: The kernel will crash when certain USB devices are inserted
- Juniper Networks Junos OS
- CWE-394
Not analysed yet 17 Apr 2023
flask-session-captcha PyPI

CVSS 5.3 Medium

Potential Captcha Validate Bypass in flask-session-captcha
- CWE-253
- CWE-394
<1.2.1 · fixed in 1.2.1

GHSA-7r87-cj48-wj45 · CVE-2022-24880 Not analysed yet 26 Apr 2022
CVE-2019-20924 CVE record

CVSS 6.5 Medium

Invariant in IndexBoundsBuilder
- MongoDB Inc. MongoDB Server
- CWE-394
Not analysed yet 23 Nov 2020
CVE-2018-20802 CVE record

CVSS 6.5 Medium

Post-auth queries on compound index may crash mongod
- MongoDB Inc. MongoDB Server
- CWE-394
Not analysed yet 23 Nov 2020
CVE-2019-0066 CVE record

CVSS 7.5 High

Junos OS: A malformed IPv4 packet received by Junos in an NG-mVPN scenario may cause the routing protocol daemon (rpd) process to core
- Juniper Networks Junos OS
- CWE-394
Not analysed yet 9 Oct 2019