CWE-393

15 published CVEs are weaknesses of this kind, as the records or NVD name it.

Critical 2High 6Medium 7Low 0Not scored 0

CVEs per yearBy the year they were published

CVE-2026-97381
Legacy Update ActiveX control accepts unauthorized hosting origins
LegacyUpdate · LegacyUpdate
Critical9.9
CVE-2026-92821
Sssd: sssd: access control bypass via premature ldap access rule evaluation
Red Hat · Red Hat Enterprise Linux 10
Medium6.8
CVE-2026-92834
Apache Thrift: C++ WebSocket server transport does not read a full request length
Apache Software Foundation · Apache Thrift
Medium6.3
CVE-2026-85087
Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op
Apache Software Foundation · Apache Thrift
Medium6.9
CVE-2026-85483
Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end
Apache Software Foundation · Apache Thrift
Medium6.3
CVE-2026-55958
Renesas TSIP TLS 1.3 transcript buffer out-of-bounds write in tsip_StoreMessage
wolfSSL · wolfSSL
High8.3
CVE-2026-53092
bpf: Fix linked reg delta tracking when src_reg == dst_reg
Linux · Linux
High7.8
CVE-2026-9058
Improper Certificate Verification in Szafir SDK
Krajowa Izba Rozliczeniowa · Szafir SDK
Critical9.3
CVE-2026-42246
net-imap vulnerable to STARTTLS stripping via invalid response timing
ruby · net-imap
High7.6
CVE-2025-24531
In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before…
OpenSC project · pam_pkcs11
Medium6.7