Skip to content
OpenAdvisories

Weakness (CWE)

CWE-475: Undefined Behavior for Input to API

Base Incomplete

The behavior of this function is undefined unless its control parameter is set to a specific value.

Source: MITRE CWE-475

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 8.1
    CVE-2026-19311

    Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin

    Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index …

    AWS GitHub OpenSearch OpenSearch
  • High 7.5
    CVE-2026-42009

    Gnutls: gnutls: denial of service via dtls packet reordering vulnerability

    A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets …

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Alpine
  • High 7.1
    CVE-2026-34379

    OpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)

    OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, a misaligned memory write vulnerability exists in LossyDctDecoder_ex…

    AcademySoftwareFoundation openexr openexr openexr Debian Ubuntu Alpine
  • High 7.5
    CVE-2025-47865

    A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacke…

    Trend Micro Trend Micro Apex Central
  • High 7.5
    CVE-2024-10569

    Zip Bomb Vulnerability in gradio-app/gradio

    A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. The component uses pd.read_csv to process input values, which can accept compressed files. An attacker can exploit this by uploading a maliciou…

    gradio-app gradio-app/gradio gradio PyPI
  • High 7.5
    CVE-2024-20380

    ClamAV HTML Parser Denial of Service Vulnerability

    A vulnerability in the HTML parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to an issue in the C to Rust foreign function interface. An attacker coul…

    Cisco ClamAV Network devices
  • High 7.5
    CVE-2020-7925

    Denial of Service when processing malformed Role names

    Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause a denial of service. This issue affects MongoDB Server v4.4 versions prior to 4…

    MongoDB MongoDB Server