CWE-453.

Microsoft QUIC Security Feature Bypass Vulnerability

• Microsoft Windows 11 version 23H2
• Microsoft Windows 11 Version 24H2
• CWE-453

libsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variable

• libsndfile
• Memory corruption
• CWE-453

vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts

• CWE-453
• CWE-829

<3.11.7 · fixed in 3.11.7

Duplicate Advisory: vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts

• CWE-453

<=3.11.6 · no fixed version yet

WonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variable

• WonderTrader
• Memory corruption
• CWE-453

In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value.

• Google Android
• CWE-453

OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls

• Privilege escalation
• CWE-453

<2026.3.31 · fixed in 2026.3.31

Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret in github.com/ossf/allstar

• Hard-coded credentials
• CWE-453

<0.0.0-20250721181116-e004ecb540d6 · fixed in 0.0.0-20250721181116-e004ecb540d6

In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default value.

• Google Android
• CWE-453

Donetick Has Weak Default JWT Secret

• donetick
• CWE-453
• CWE-1188

Dpanel's hard-coded JWT secret leads to remote code execution in github.com/donknap/dpanel

• Hard-coded credentials
• CWE-453

<1.6.1 · fixed in 1.6.1

Windows Remote Desktop Services Remote Code Execution Vulnerability

• Microsoft Windows Server 2012
• Microsoft Windows Server 2012 (Server Core installation)
• CWE-453

Filestash configured to skip TLS certificate verification when using the FTPS protocol

• Weak cryptography or TLS
• CWE-453

<=0.4 · no fixed version yet

NFS server misconfiguration allows file access outside the exported directory

• fogproject
• CWE-453

fgr Vulnerable to Insecure Default Variable Initialization

• CWE-453

<=0.3.2 · no fixed version yet

Skype for Consumer Remote Code Execution Vulnerability

• Microsoft Skype for Consumer
• CWE-453

SoftEther VPN: An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of…

• SoftEther VPN
• CWE-453

Ghost: An insecure default vulnerability exists in the Post Creation functionality of Ghost…

• Ghost
• CWE-453

Ghost: An insecure default vulnerability exists in the Post Creation functionality of Ghost…

• Ghost
• CWE-453

Ghost: An insecure default vulnerability exists in the Post Creation functionality of Ghost…

• Ghost
• CWE-453

Ghost: An insecure default vulnerability exists in the Post Creation functionality of Ghost…

• Ghost
• CWE-453

JetBrains TeamCity: In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default…

• JetBrains TeamCity
• CWE-453

A flaw was found in Openshift.

• openshift
• CWE-453
• CWE-1188

DotNetNuke Default Machine Key Exposure

• CWE-453

<4.8.2 · fixed in 4.8.2

GE UR family insecure default variable initialization

• GE UR family
• CWE-453

CORS misconfiguration in socket.io

• CWE-346
• CWE-453

<2.4.0 · fixed in 2.4.0