CWE-358: Improperly Implemented Security Check for Standard
Base
The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.
Consequences
- Access Control: Bypass Protection Mechanism
Recent advisories
- GHSA-f749-vhgx-39h6 — Microsoft Security Advisory CVE-2026-70174 - .NET and Visual Studio Remote Code Execution Vulnerability
- GHSA-9c3j-xm6v-j7j3 — MantisBT has a Content Security Policy bypass via attachments
- GHSA-26hh-7cqf-hhc6 — Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up
- GHSA-37gf-gmxv-74wv — Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens
- CVE-2024-7965 — Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…
- GHSA-f5h4-wmp5-xhg6 — Client Spoofing within the Keycloak Device Authorisation Grant
- GHSA-cqvm-j2r2-hwpg — russh may use insecure Diffie-Hellman keys
- GHSA-372q-33vh-8mpc — Inconsistent documentation in Apache Tomcat
- GHSA-cmwx-9m2h-x7v4 — Ansible apt_key module does not properly verify key fingerprint
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor