cve.bz

CWE-475: Undefined Behavior for Input to API

Filter

The behavior of this function is undefined unless its control parameter is set to a specific value.

What the weakness is: CWE-475 at MITRE. All weaknesses

Ask an AI about CWE-475

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-475: Undefined Behavior for Input to API and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/475.html and https://cve.bz/cve/cwe/475?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2026-73797EPSS 0.1%

    A security vulnerability in HPE NonStop TSQLFIL may cause address space corruption when a specific API is called.

  2. 8.6CVE-2026-19311EPSS 0.6%

    Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data sou…

  3. 7.5CVE-2026-42009EPSS 1.3%

    A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not corre…

  4. 5.3CVE-2026-8391EPSS 0.3%

    Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

  5. 7.1CVE-2026-34379EPSS 0.3%

    OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9, a misaligned memory write vulnerability exists i…

  6. 6.3CVE-2026-21690EPSS 0.2%

    iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in …

  7. 7.5CVE-2025-47866EPSS 0.3%

    An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affected installations.

  8. 9.8CVE-2025-47865EPSS 1.8%

    A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code execution on affected installations.

  9. 7.5CVE-2024-10569EPSS 0.7%

    A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. The component uses pd.read_csv to process input values, which can accept compressed files. An attacker can exploit this by …

  10. 5.4CVE-2024-3099EPSS 0.4%

    A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service (DoS) as an authenticated user might not be able to use the i…

  11. 7.5CVE-2024-20380EPSS 1.1%

    A vulnerability in the HTML parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to an issue in the C to Rust foreign function interf…

  12. 5.3CVE-2023-52533EPSS 0.4%

    In modem-ps-nas-ngmm, there is a possible undefined behavior due to incorrect error handling. This could lead to remote information disclosure no additional execution privileges needed

  13. 5.7CVE-2023-4875EPSS 0.6%

    Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12

  14. 6.5CVE-2023-4874EPSS 0.8%

    Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12

  15. 6.5CVE-2023-2253EPSS 0.9%

    A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`). This vulnerability allows a malicious user to submit an unreason…

  16. 5.5CVE-2022-29207EPSS 0.3%

    TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid. In graph mode, it wo…

  17. 7.5CVE-2020-7925EPSS 1.7%

    Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause a denial of service. This issue affects MongoDB Server v4.4…