CWE-358: Improperly Implemented Security Check for Standard
Filter
The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.
What the weakness is: CWE-358 at MITRE. All weaknesses
Ask an AI about CWE-358
Show the prompt
Explain CWE-358: Improperly Implemented Security Check for Standard and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/358.html and https://cve.bz/cve/cwe/358?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.3CVE-2026-123600EPSS 0.2%
Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 and hickory-net 0.26.0-alpha.1 before 0.26.2 contain a DNSSEC validation flaw in DnssecDnsHandle that accepts NSEC3-signed NODATA responses for zone-apex queries as secure without an …
- 6.3CVE-2026-123579EPSS 0.2%
DNSSEC validation in Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 does not distinguish NODATA responses from wildcard-expanded positive responses. For a query that should return NODATA in a z…
- 7.6CVE-2026-123542EPSS 0.2%
OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never validating the code verifier when device codes are exchanged for tokens. Attackers who obtain an approved device code from client logs or shared d…
- 4.2CVE-2026-108178EPSS 0.2%
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a token to be accepted that should be rejected due to an improperly implemented security check. Under certain conditions, token validation is incomplete, …
- 6.5CVE-2026-96303EPSS 0.7%
Improperly implemented security check for standard in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature over a network.
- 6.5CVE-2026-85805EPSS 0.6%
Improperly implemented security check for standard in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network.
- 8.8CVE-2026-70174EPSS 0.9%
Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.
- 9.8CVE-2026-96760EPSS 0.4%
Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for…
- 3.7CVE-2026-46582EPSS 0.2%
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation trea…
- 5.9CVE-2026-65058EPSS 0.4%
Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum sign_tx / sign_tx_eip1559 flow. For contract interactions, the device confirms only the initial calldata chunk while the signature commits to t…
- 7.8CVE-2026-49783EPSS 0.3%
Improperly implemented security check for standard in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
- 5.1CVE-2026-54431EPSS 0.2%
In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2_token_ver…
- 8.7CVE-2026-12577EPSS 0.4%
DVP80ES3 with Improperly Implemented Security Check for Standard vulnerability.
- 7.3CVE-2026-57915EPSS 0.5%
It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue.
- 9.3CVE-2026-48797EPSS 0.3%
Backpropagate is a Python library for fine-tuning large language models on a single GPU. In versions 1.1.0 and 1.1.1, the optional Reflex web UI exposes a training control plane without authentication: dataset upload, model load, training …
- 9.8CVE-2026-50628EPSS 0.7%
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security che…
- 6.5CVE-2026-11127EPSS 0.2%
Inappropriate implementation in WebAPKs in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafted WebAPK. (Chromium security severity: Medium)
- 6.1CVE-2026-11122EPSS 0.2%
Inappropriate implementation in Keyboard in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
- 6.1CVE-2026-44475EPSS 0.1%
Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella…
- 3.7CVE-2026-44474EPSS 0.1%
Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core didn't enforce security rules on concurrent running of security procedures defined in TS 33.501 §6.9.5.1 — it could send a NAS Security Mode Command while an …
- 7.1CVE-2026-44473EPSS 0.2%
Ella Core is a 5G core designed for private networks. Prior to 1.10.0, a radio with a valid NG Setup can send a forged PDUSessionResourceSetupResponse carrying any UE's AMF-UE-NGAP-ID. Ella Core does not verify the message arrived on the S…
- 5.4CVE-2026-42082EPSS 0.3%
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not enforce the concurrent security procedure rules defined in 3GPP TS 33.501 §6.9.5.1. The AMF does not check for ongoing N2 handover…
- 7.1CVE-2026-42081EPSS 0.3%
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values, as mandated by …
- 7.6CVE-2026-40597EPSS 0.5%
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, given any pre-existing XSS / HTML injection vulnerability, an attacker can bypass the Content Security Policy's script-src directive by uploading …
- 8.8CVE-2026-44513EPSS 1.1%
Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, a trust_remote_code bypass in DiffusionPipeline.from_pretrained allows arbitrary remote code execution despite the user passing trust_remote_code=False (or omitt…
- 7.5CVE-2026-45109EPSS 0.9%
Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.18 and 16.2.6, it was found that the fix addressing CVE-2026-44575 did not apply to middleware.ts with Turbopack. This vulnerability is fixed…
- 5.5CVE-2026-28914EPSS 0.2%
A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks.
- 4.6CVE-2025-31983EPSS 0.1%
HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers to inject malicious scripts increasing the risk of cross-site scripting (XSS) and potential exposure…
- 6.1CVE-2025-31970EPSS 0.1%
HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability where the Content-Security-Policy does not define strict directives for object-src and base-uri, which could allow an attacker to exploit injection vec…
- 7.1CVE-2026-22618EPSS 0.2%
A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was set with an insecure attribute, potentially exposing users to web‑based attacks. This security issue has been fixed in…
- 4.3CVE-2026-5894EPSS 0.2%
Inappropriate implementation in PDF in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
- 3.5CVE-2026-35679EPSS 0.2%
Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain conditions, which potentially could have resulted in the draining of user funds from the Sprout pool. It was sometimes not verifying Sprout proofs.
- 7.2CVE-2026-29103EPSS 0.5%
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. A Critical Remote Code Execution (RCE) vulnerability exists in SuiteCRM 7.15.0 and 8.9.2, allowing authenticated administrators to ex…
- 5.5CVE-2026-2645EPSS 0.1%
In wolfSSL 5.8.2 and earlier, a logic flaw existed in the TLS 1.2 server state machine implementation. The server could incorrectly accept the CertificateVerify message before the ClientKeyExchange message had been received. This issue aff…
- 4.9CVE-2025-13333EPSS 0.4%
IBM WebSphere Application Server 9.0, and 8.5 could provide weaker than expected security during system administration of security settings.
- 8.8CVE-2026-1486EPSS 0.5%
A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFr…
- 6.3CVE-2025-66607EPSS 0.2%
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The response header contains an insecure setting. Users could be redirected to malicious sites by an attacker. The affected products and versions…
- 2.1CVE-2025-66603EPSS 0.3%
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The web server accepts the OPTIONS method. An attacker could potentially use this information to carry out other attacks. The affected products a…
- 6.3CVE-2025-66601EPSS 0.2%
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not specify MIME types. When an attacker performs a content sniffing attack, malicious scripts could be executed. The affected …
- 8.8CVE-2025-66600EPSS 0.4%
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product lacks HSTS (HTTP Strict Transport Security) configuration. When an attacker performs a Man in the middle (MITM) attack, communications …
- 9.1CVE-2025-69234EPSS 0.3%
Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.
- 5.3CVE-2025-62002EPSS 0.3%
BullWall Ransomware Containment considers the number of files modified to trigger detection. An authenticated attacker could encrypt a single (possibly large) file without triggering detection if thresholds are configured to require multip…
- 5.5CVE-2025-66323EPSS 0.09%
Vulnerability of improper criterion security check in the card module. Impact: Successful exploitation of this vulnerability may affect availability.
- 3.3CVE-2025-58308EPSS 0.09%
Vulnerability of improper criterion security check in the call module. Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
- 7.5CVE-2025-62585EPSS 0.4%
Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.
- 9.8CVE-2025-62583EPSS 0.5%
Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.
- 4.3CVE-2025-25255EPSS 0.4%
An Improperly Implemented Security Check for Standard vulnerability [CWE-358] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.11, FortiProxy 7.2 all versions, FortiProxy 7…
- 6.1CVE-2025-31969EPSS 0.2%
HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP). These can result in malicious resources getting loaded and browsers may come across certain types of attacks, such as cross-site scripting and clickjacking.
- 7.5CVE-2025-59147EPSS 0.4%
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Versions 7.0.11 and below, as well as 8.0.0, are vulnerable to detection bypass when crafted traffic sen…
- 8.1CVE-2025-10457EPSS 0.4%
The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching.