By weakness (CWE)

CWE-1287: related vulnerabilities

CVEs classified under CWE-1287. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

4 published vulnerabilities

• CVE-2026-49941HIGH 7.5

  Net::CIDR::Set, a Perl library for managing IP address ranges, contains a flaw in how it parses IP addresses. When the library receives an improperly formatted IP address, instead of rejecting it, the code enters an infinite loop trying to process it. An attacker can exploit this by sending malformed input to applications using the vulnerable library, causing them to hang and become unresponsive. This is a denial-of-service vulnerability affecting versions up to and including 0.20.

• CVE-2026-11460HIGH 7.3

  Boost Serialization, a widely-used C++ library for object serialization, contains a validation flaw that allows remote attackers to send specially crafted input that bypasses security checks. The vulnerability affects all versions up to 1.91 and can lead to information disclosure, data tampering, or service disruption. No patch currently exists, and the vendor has indefinitely postponed fixing it despite being notified in August 2025 and exceeding the 90-day disclosure deadline.

• CVE-2024-6858MEDIUM 6.5

  Arista EOS switches running in 802.1X authentication mode contain a logic flaw that can allow unauthorized devices to bypass port access controls. If an unauthenticated device is present on a port configured for multi-auth, and there is an EAPOL-capable (Extensible Authentication Protocol over LAN) device in the fallback VLAN, the unauthenticated device may be granted network access when it should remain blocked. This creates an authentication bypass condition specific to the multi-auth scenario and fallback VLAN configuration.

• CVE-2026-47675MEDIUM 4.3

  Hono, a JavaScript web framework, contains a flaw in how it sanitizes cookie options. While the framework validates certain cookie parameters (domain and path) to prevent malicious characters from breaking the Set-Cookie header, it fails to apply the same checks to sameSite and priority options. If an application passes user-controlled input directly into these parameters, an attacker could inject additional cookie attributes into the response header, potentially manipulating cookie behavior or setting unintended security policies.