Skip to content
OpenAdvisories

Weakness (CWE)

CWE-394: Unexpected Status Code or Return Value

Base Draft

The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.

Source: MITRE CWE-394

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-107785

    Crux Agent silently fails SKA preshared key rotation when SHA-512 peering is negotiated

    Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering session negotiates use of SHA-512, the key produced is 64 bytes instead of the 32 bytes WireGuard requires. The agent does not validate this siz…

    Sirius Computer Crux Agent
  • Medium 5.9
    CVE-2026-76956

    In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, …

    libexpat project libexpat insighttoolkit4 expat Debian Ubuntu Alpine
  • Medium 6.9
    CVE-2025-22854

    Possible thread exhaustion from processing http responses in PingFederate Google Adapter

    Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal usage conditions.

    Ping Identity PingFederate
  • Medium 4.6
    CVE-2023-28975

    Junos OS: The kernel will crash when certain USB devices are inserted

    An Unexpected Status Code or Return Value vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated attacker with physical access to the device to cause a Denial of Service (DoS). When certain USB devices are connected to a USB port o…

    Juniper Networks Junos OS Network devices
  • Medium 5.3
    CVE-2022-24880

    Potential Captcha Validate Bypass in flask-session-captcha

    flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session. In versions prior to 1.2.1, he `captcha.validate()` function would return `None` if passed no value (e.g. by submitting an …

    Tethik flask-session-captcha flask-session-captcha PyPI
  • Medium 6.5
    CVE-2019-20924

    Invariant in IndexBoundsBuilder

    A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries which trigger an invariant in the IndexBoundsBuilder. This issue affects MongoDB Server v4.2 versions prior to 4.2.2.

    MongoDB MongoDB Server
  • Medium 6.5
    CVE-2018-20802

    Post-auth queries on compound index may crash mongod

    A user authorized to perform database queries may trigger denial of service by issuing specially crafted queries with compound indexes affecting QueryPlanner. This issue affects MongoDB Server v3.6 versions prior to 3.6.9 and MongoDB Server v4.0 versions prio…

    MongoDB MongoDB Server mongodb Ubuntu