CWE-453 Insecure Default Variable Initialization
Description
The product, by default, initializes an internal variable with an insecure or less secure value than is possible.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-453 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-jxxv-8r27-vm4p | CVE-2026-92950 | HIGH |
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts |
2026-10-01 | |
| GHSA-hc6q-4vvg-jf79 | - | CRITICAL |
Duplicate Advisory: vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts |
2026-10-01 | |
| GHSA-9gp8-hjxr-6f34 | CVE-2026-41330 | MODERATE |
OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls |
2026-04-24 | |
| GHSA-j752-cjcj-w847 | CVE-2025-30206 | CRITICAL |
Dpanel's hard-coded JWT secret leads to remote code execution |
2025-04-23 | |
| GHSA-4jmm-c6jw-g796 | CVE-2024-41255 | HIGH |
Filestash configured to skip TLS certificate verification when using the FTPS protocol |
2024-09-06 | |
| GHSA-879p-8gw4-mcpw | - | LOW |
fgr Vulnerable to Insecure Default Variable Initialization |
2024-03-15 | |
| GHSA-grw3-hjjm-5cjm | CVE-2008-6540 | MODERATE |
DotNetNuke Default Machine Key Exposure |
2023-09-22 | |
| GHSA-fxwf-4rqh-v8g3 | CVE-2020-28481 | MODERATE |
CORS misconfiguration in socket.io |
2023-09-11 |