Skip to content
OpenAdvisories

Weakness (CWE)

CWE-440: Expected Behavior Violation

Base Draft

A feature, API, or function does not perform according to its specification.

Source: MITRE CWE-440

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-114049

    vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense

    vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to constrain other clients' outputs by leaving stale allowed_token_ids rows. Attackers can submit concurrent constrained generate requests, including v…

    vllm-project vLLM
  • Low 3.7
    CVE-2026-35191

    QUIC Unvalidated Amplification Credit may be Over Accounted

    Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplificatio…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu
  • Low 3.7
    CVE-2026-41354

    OpenClaw < 2026.4.2 - Insufficient Scope in Zalo Webhook Replay Dedupe Keys

    OpenClaw before 2026.4.2 contains an insufficient scope vulnerability in Zalo webhook replay dedupe keys that allows legitimate events from different conversations or senders to collide. Attackers can exploit weak deduplication scoping to cause silent message…

    OpenClaw OpenClaw openclaw npm
  • Low 3.1
    CVE-2025-8850

    Insecure API Design in danny-avila/librechat

    In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow. The system allows users to disable 2FA without requiring a valid OTP or backup code, bypassing the intended verification process. This vul…

    danny-avila danny-avila/librechat
  • Low 3.1
    CVE-2024-58265

    Unauthenticated Nonce Increment in snow

    The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery.

    mcginty snow rust-snow rust-snow Debian Ubuntu crates.io
  • Low 3.7
    CVE-2025-46712

    Erlang/OTP SSH Has Strict KEX Violations

    Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25), Erlang/OTP SSH fails to enforce strict KEX handshake hardening measures by allowing…

    erlang OTP erlang erlang Debian Ubuntu Alpine
  • Low 2.9
    CVE-2023-26819

    cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a": true, "b": [ null,99999999999999…

    cJSON Project cJSON cjson cjson Debian Ubuntu
  • Low 3.9
    CVE-2024-38806

    UAA Failure to Remove Shadow User’s Access

    Failure to properly synchronize user's permissions in UAA in Cloud Foundry Foundation v40.17.0 https://github.com/cloudfoundry/cf-deployment/releases/tag/v40.17.0 , potentially resulting in users retaining access rights they should not have. This can allow th…

  • Low —
    GHSA-mrr8-v49w-3333

    sweetalert2 contains potentially undesirable behavior

    `sweetalert2` versions from 11.6.14 to before 11.22.4 have potentially undesirable behavior. The package outputs audio and/or video messages that do not pertain to the functionality of the package when run on specific tlds. This functionality is documented on…

    sweetalert2 npm