CWE-1025

CWE-1025 · 7 records · 5 with a public proof-of-concept

Records the NVD classes under CWE-1025, highest CVSS first.

  1. HIGH 7.8CVE-2026-125271public PoC2026-11-10

    Incorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server before 1.5.1 might allow an actor to execute AWS API operations across AWS services that the operator's security policy was configured to deny or…

    AI risk analysis on Exploit-DB.ai →

  2. HIGH 7.5CVE-2026-796772026-09-23

    Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 …

    AI risk analysis on Exploit-DB.ai →

  3. MEDIUM 6.8CVE-2026-114649public PoC2026-10-22

    The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a …

    AI risk analysis on Exploit-DB.ai →

  4. MEDIUM 6.8CVE-2026-104048public PoC2026-10-06

    A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same …

    sssd · openshift container platform · enterprise linux

    AI risk analysis on Exploit-DB.ai →

  5. MEDIUM 5.9CVE-2026-123592public PoC2026-11-08

    The hickory-net crate in Hickory DNS 0.26.0-beta.1 before 0.26.2 allows DNSSEC validation bypass because Name's Hash ignores label lengths and ValidationCacheKey compares only that hash. An attacker controlling an unsigned delegation whose name differs from a …

    AI risk analysis on Exploit-DB.ai →

  6. UNSCOREDCVE-2026-100248public PoC2026-09-25

    The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin.

    AI risk analysis on Exploit-DB.ai →

  7. UNSCOREDCVE-2026-144412026-09-24

    A logic flaw in Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structures. The issue has been remediated by updating the internal comparison routines to ensure accurate obje…

    AI risk analysis on Exploit-DB.ai →