The code uses a function that has inconsistent implementations across operating systems and versions.
Volume of CVEs assigned to CWE-474 and their average CVSS base score over time.
Top CVEs that have been assigned this CWE. A single CVE can have multiple CWE assignments, though many have just one.
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-11102HIGH Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a malicious file. | Jun 4, 2026 | 8.8 | 36 | NO | NO |
CVE-2026-25960CRITICAL vLLM is an inference and serving engine for large language models (LLMs). The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the load_from_url_async method | Mar 9, 2026 | 9.8 | 33 | NO | NO |
CVE-2026-24010HIGH Horilla is a free and open source Human Resource Management System (HRMS). A critical File Upload vulnerability in versions prior to 1.5.0, with Social Engineering, allows authenti | Jan 22, 2026 | 8.0 | 29 | NO | NO |
CVE-2026-0902HIGH Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium secu | Jan 20, 2026 | 8.8 | 29 | NO | NO |
CVE-2026-11097MEDIUM Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium se | Jun 4, 2026 | 6.5 | 27 | NO | NO |
CVE-2024-5836HIGH Inappropriate Implementation in DevTools in Google Chrome prior to 126.0.6478.54 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code | Jun 11, 2024 | 8.8 | 27 | NO | NO |
CVE-2024-1694HIGH Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to bypass discretionary access control via a malicious file. (Chromium | Jun 7, 2024 | 7.8 | 23 | NO | NO |
CVE-2024-5839MEDIUM Inappropriate Implementation in Memory Allocator in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. ( | Jun 11, 2024 | 6.5 | 21 | NO | NO |
CVE-2021-0294MEDIUM A vulnerability in Juniper Networks Junos OS, which only affects the release 18.4R2-S5, where a function is inconsistently implemented on Juniper Networks Junos QFX5000 Series and | Jul 15, 2021 | 5.3 | 20 | NO | NO |
Cacti is an open source performance and fault management framework. In versions 1.2.30 and below, the locale-dependent decimal formatting in rrdtool_function_update() can corrupt R | Jun 24, 2026 | 2.5 | 19 | NO | NO |
Exploit activity across CVEs assigned to this CWE, including CVEs that carry other CWE assignments.
Social posts that mention CVE IDs assigned to this CWE. This is assigned-CVE activity, not mentions of the CWE label itself.
Media articles that mention CVE IDs assigned to this CWE. This is assigned-CVE coverage, not mentions of the CWE label itself.