CWE-697 不充分的比较 类弱点 66 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-697 属于逻辑错误类漏洞，指产品在安全相关上下文中执行了错误的实体比较。攻击者通常利用此缺陷，通过构造特定输入绕过身份验证或权限检查，从而获取未授权访问。开发者应避免此类问题，需确保比较逻辑涵盖所有必要因素，验证比较对象类型一致，并采用经过安全审计的标准库函数进行严谨的安全决策判断。
public class Truck { private String make; private String model; private int year; public boolean equals(Object o) { if (o == null) return false; if (o == this) return true; if (!(o instanceof Truck)) return false; Truck t = (Truck) o; return (this.make.equals(t.getMake()) && this.model.equals(t.getModel())); } }/* Ignore CWE-259 (hard-coded password) and CWE-309 (use of password system for authentication) for this example. */ char *username = "admin"; char *pass = "password"; int AuthenticateUser(char *inUser, char *inPass) { if (strncmp(username, inUser, strlen(inUser))) { logEvent("Auth failure of username using strlen of inUser"); return(AUTH_FAIL); } if (! strncmp(pass, inPass, strlen(inPass))) { logEvent("Auth success of password using strlen of inUser"); return(AUTH_SUCCESS); } else { logEvent("Auth fail of password using sizeof"); return(AUTH_FAIL); } } int main (int argc, char **argv) { int ap pa pas pass| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2026-71855 | Suricata流处理IPv4/IPv6哈希冲突导致状态复用漏洞 — suricata | 5.9 | Medium | 2026-09-18 |
| CVE-2026-57222 | Suricata ippair哈希碰撞致状态复用错误漏洞 — suricata | 5.3 | Medium | 2026-09-18 |
| CVE-2026-61795 | Capsule租户正则校验缺陷致Webhook绕过 — capsule | 6.8 | Medium | 2026-09-18 |
| CVE-2026-61672 | Capsule租户绕过命名空间标签强制校验 — capsule | 7.1 | High | 2026-09-18 |
| CVE-2026-20333 | 思科安全防火墙及管理中心软件比较不当漏洞 — Cisco Secure Firewall Adaptive Security Appliance (ASA) Software | 8.8 | High | 2026-09-16 |
| CVE-2026-91997 | Evolution-Api 2.3.7 指标白名单绕过 — evolution-api | 5.3 | Medium | 2026-09-15 |
| CVE-2026-56101 | OpenBSD 处理逻辑错误漏洞 — OpenBSD | 5.3 | Medium | 2026-09-08 |
| CVE-2026-73309 | XenForo 处理逻辑错误漏洞 — XenForo | 7.4 | High | 2026-09-08 |
| CVE-2026-80227 | Ash Framework AshSql 处理逻辑错误漏洞 — ash_sql | 2.1 | Low | 2026-08-30 |
| CVE-2026-73258 | Cesanta Mongoose 处理逻辑错误漏洞 — mongoose | 6.5 | Medium | 2026-08-20 |
| CVE-2026-75110 | OpenMem MemOS 处理逻辑错误漏洞 — MemOS | 9.8 | Critical | 2026-08-17 |
| CVE-2026-50029 | Sunny Yang js-toml 处理逻辑错误漏洞 — js-toml | 5.3 | Medium | 2026-08-14 |
| CVE-2026-67207 | Wolf CMS 0.8.3.1 备份恢复控制器权限绕过漏洞 — wolfcms | 8.8 | High | 2026-07-30 |
| CVE-2026-48032 | Kerberosmansour Hulumi 处理逻辑错误漏洞 — hulumi | 8.3 | High | 2026-07-24 |
| CVE-2026-65903 | Cure53 DOMPurify 处理逻辑错误漏洞 — DOMPurify | 6.1 | Medium | 2026-07-23 |
| CVE-2026-22660 | FlaskBB 处理逻辑错误漏洞 — flaskbb | 7.2 | High | 2026-07-10 |
| CVE-2026-14686 | HdrHistogram 处理逻辑错误漏洞 — HdrHistogram | 3.3 | Low | 2026-07-05 |
| CVE-2026-10097 | wolfSSL 加密问题漏洞 — wolfSSL | - | - | 2026-06-25 |
| CVE-2026-9369 | Hermes Agent 安全漏洞 — hermes-agent | 5.3 | Medium | 2026-05-24 |
| CVE-2026-35040 | fast-jwt 安全漏洞 — fast-jwt | 5.3 | Medium | 2026-04-09 |
| CVE-2026-34574 | Parse Server 安全漏洞 — parse-server | 7.1AI | High AI | 2026-03-31 |
| CVE-2026-34210 | mppx 安全漏洞 — mppx | 7.5 | - | 2026-03-31 |
| CVE-2026-32322 | rs-soroban-sdk 安全漏洞 — rs-soroban-sdk | 5.3 | Medium | 2026-03-12 |
| CVE-2025-20343 | Cisco Identity Services Engine 安全漏洞 — Cisco Identity Services Engine Software | 8.6 | High | 2025-11-05 |
| CVE-2025-12192 | WordPress plugin The Events Calendar 安全漏洞 — The Events Calendar | 5.3 | Medium | 2025-11-05 |
| CVE-2025-47416 | CRESTRON TOUCHSCREENS x70 安全漏洞 — TOUCHSCREEN x70 | 9.8AI | Critical AI | 2025-09-09 |
| CVE-2025-9401 | UTCMS 安全漏洞 — UTCMS | 3.7 | Low | 2025-08-25 |
| CVE-2025-48952 | NetAlertX 安全漏洞 — NetAlertX | 9.4 | Critical | 2025-07-04 |
| CVE-2025-3102 | WordPress plugin SureTriggers 安全漏洞 — OttoKit: All-in-One Automation Platform | 8.1 | High | 2025-04-10 |
| CVE-2024-53861 | pyjwt 安全漏洞 — pyjwt | 2.2 | Low | 2024-11-29 |
CWE-697（不充分的比较） 是常见的弱点类别，本平台收录该类弱点关联的 66 条 CVE 漏洞。