Skip to content
OpenAdvisories

Weakness (CWE)

CWE-475: Undefined Behavior for Input to API

Base Incomplete

The behavior of this function is undefined unless its control parameter is set to a specific value.

Source: MITRE CWE-475

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-73797

    HPE NonStop TSQLFIL - Memory corruption vulnerability

    A security vulnerability in HPE NonStop TSQLFIL may cause address space corruption when a specific API is called.

    Hewlett Packard Enterprise HPE NonStop TSQLFIL
  • Medium 5.3
    CVE-2026-8391

    Other issue in the JavaScript Engine component

    Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 6.3
    CVE-2026-21690

    iccDEV has Type Confusion in CIccTagXmlTagData::ToXml()

    iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in `CIccTagXmlTagData::…

    InternationalColorConsortium iccDEV
  • Medium 4.3
    CVE-2025-47866

    An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an at…

    Trend Micro Trend Micro Apex Central
  • Medium 5.4
    CVE-2024-3099

    Denial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflow

    A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service (DoS) as an authenticated user might not be able to use the intended model, as it…

    MLflow mlflow/mlflow mlflow PyPI
  • Medium 5.3
    CVE-2023-52533

    In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote…

    Unisoc (Shanghai) Technologies T760/T770/T820/S8000
  • Medium 4.3
    CVE-2023-4874

    Undefined Behavior for Input to API in Mutt

    Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12

    mutt mutt mutt mutt Debian Ubuntu
  • Medium 6.5
    CVE-2023-2253

    distribution catalog API endpoint can lead to OOM via malicious user input

    A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`). This vulnerability allows a malicious user to submit an unreasonably large value for…

    docker-registry docker-registry github.com/distribution/distribution github.com/docker/distribution Debian Ubuntu Go
  • Medium 5.5
    CVE-2022-29207

    Undefined behavior when users supply invalid resource handles in TensorFlow

    TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid. In graph mode, it would have been imposs…

    TensorFlow TensorFlow tensorflow tensorflow-cpu PyPI