cve.bz

CWE-454: External Initialization of Trusted Variables or Data Stores

Filter

The product initializes critical internal variables or data stores using inputs that can be modified by untrusted actors.

What the weakness is: CWE-454 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Ask an AI about CWE-454

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-454: External Initialization of Trusted Variables or Data Stores and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/454.html and https://cve.bz/cve/cwe/454?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.1CVE-2026-54003EPSS 0.7%

    Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP …

  2. 6.3CVE-2026-48980EPSS 0.2%

    pam_usb provides hardware authentication for Linux using removable media. In versions prior to 0.9.2, getenv() environment variables XRDP_SESSION, DISPLAY and TMUX allow environment variable injection into local-check logic. These environ…

  3. 8.1CVE-2026-26148EPSS 0.4%

    External initialization of trusted variables or data stores in Azure Entra ID allows an unauthorized attacker to elevate privileges locally.

  4. 5.5CVE-2025-36244EPSS 0.1%

    IBM AIX 7.2, 7.3, IBM VIOS 3.1, and 4.1, when configured to use Kerberos network authentication, could allow a local user to write to files on the system with root privileges due to improper initialization of critical variables.