CWE-682: Incorrect Calculation
The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
65 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2026-54754 — Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)
- CVE-2026-25634 — iccDEV memcpy-param-overlap in CIccTagMultiProcessElement::Apply()
- CVE-2026-53671 — PREVAIL: Context-write no-op in do_mem_store allows unsafe eBPF programs to pass verification
- CVE-2026-53670 — PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification
- CVE-2026-44498 — ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops
- CVE-2026-71479 — New API: Integer overflow in quota billing yields negative charges (self-crediting)
- CVE-2026-24783 — soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives
- CVE-2026-76043 — Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code
- CVE-2026-53706 — PREVAIL: ALU32 pointer arithmetic accepted without is64 gate — verifier emits false PASS for pointer-corrupting programs
- CVE-2026-20275 — Cisco IOS XR Software Security Hardening Release: September 2026
- CVE-2026-20270 — Cisco IOS XE Software Security Hardening Release
- CVE-2026-21911 — Junos OS Evolved: Flapping management interface causes MAC learning on label-switched interfaces to stop
- CVE-2025-54427 — Polkadot Frontier contains missing `check_inherent` for `note_min_gas_price_target` inflates gas price
- CVE-2026-47247 — libheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation
- CVE-2026-33487 — goxmldsig has validateSignature Loop Variable Capture Signature Bypass
- CVE-2024-34704 — era-compiler-solidity contains a `xor(zext(cmp), -1)` misoptimization
- CVE-2026-28410 — The Graph: Revocable vesting contracts allows early access to locked tokens
- CVE-2026-55597 — ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments
- CVE-2026-10773 — Out-of-bounds read in DHCPv4 client message-type name lookup (net_dhcpv4_msg_type_name)
- CVE-2026-86736 — snipe-it before 8.7.0 Checkout Request Counter Integrity Failure
Recently published
- CVE-2026-86736 — snipe-it before 8.7.0 Checkout Request Counter Integrity Failure
- CVE-2026-53706 — PREVAIL: ALU32 pointer arithmetic accepted without is64 gate — verifier emits false PASS for pointer-corrupting programs
- CVE-2026-53670 — PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification
- CVE-2026-53671 — PREVAIL: Context-write no-op in do_mem_store allows unsafe eBPF programs to pass verification
- CVE-2026-20275 — Cisco IOS XR Software Security Hardening Release: September 2026
- CVE-2026-54754 — Klever-Go: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)
- CVE-2026-76043 — Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code
- CVE-2026-71479 — New API: Integer overflow in quota billing yields negative charges (self-crediting)
- CVE-2026-20763 — Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may all
- CVE-2026-20270 — Cisco IOS XE Software Security Hardening Release
- CVE-2026-10773 — Out-of-bounds read in DHCPv4 client message-type name lookup (net_dhcpv4_msg_type_name)
- CVE-2026-47247 — libheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation
- CVE-2026-55597 — ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments
- CVE-2026-10512 — X25519 x86_64 assembly final reduction leaves non-canonical field element
- CVE-2026-44074 — Bitwise OR of errno values
- CVE-2026-7836 — hextoint macro uppercase bug
- CVE-2023-7346 — Ledger Bitcoin App 2.1.0 Address Derivation Error via Miniscript
- CVE-2026-44498 — ZEBRA: Block Validator Undercounts Coinbase and P2SH Sigops
- CVE-2026-33487 — goxmldsig has validateSignature Loop Variable Capture Signature Bypass
- CVE-2026-28410 — The Graph: Revocable vesting contracts allows early access to locked tokens
More specific weaknesses
- CWE-128 — Wrap-around Error
- CWE-131 — Incorrect Calculation of Buffer Size
- CWE-1335 — Incorrect Bitwise Shift of Integer
- CWE-1339 — Insufficient Precision or Accuracy of a Real Number
- CWE-135 — Incorrect Calculation of Multi-Byte String Length
- CWE-190 — Integer Overflow or Wraparound
- CWE-191 — Wrap or Wraparound
- CWE-193 — Off-by-one Error
- CWE-369 — Divide By Zero
- CWE-468 — Incorrect Pointer Scaling
- CWE-469 — Use of Pointer Subtraction to Determine Size