CWE-394

CWE-394 · 3 records · 2 with a public proof-of-concept

Records the NVD classes under CWE-394, highest CVSS first.

  1. HIGH 8.1CVE-2026-123158public PoC2026-11-05

    sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any p…

    openssh · alpine linux

    AI risk analysis on Exploit-DB.ai →

  2. LOW 2.9CVE-2026-73064public PoC2026-09-24

    In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.

    AI risk analysis on Exploit-DB.ai →

  3. UNSCOREDCVE-2026-1077852026-10-09

    Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering session negotiates use of SHA-512, the key produced is 64 bytes instead of the 32 bytes WireGuard requires. The agent does not validate this size…

    AI risk analysis on Exploit-DB.ai →