CWE-691 · weakness in Input Validation and Logic
Insufficient Control Flow Management
40 CVEs
Out of date: the sync last ran 5 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
Every one of the 40 is a mark on the map. Named now: 1 to 26, most at risk first.
- Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
- Cisco IOS and IOS XE Software Web Services Denial of Service Vulnerability
- Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
- Insufficient Control Flow Management in RDT400 in SICK APU allows an unprivileged remote attacker to potentially enable hidden functionality via HTTP requests.
- Insufficient control flow management in AmdCpmGpioInitSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to escalation of privileges.
- Discourse-Jira could make SSRF attack by setting Jira URL to an arbitrary location
- Zoom Clients for iOS - Insufficient Control Flow Management
- Vyper's `slice()` may elide side-effects when output length is 0
- Cisco IOS XR Software Security Hardening Release: September 2026
- Cisco IOS XE Software Security Hardening Release
- Vyper's `concat()` builtin may elide side-effects for zero-length arguments
- An issue was discovered in openRISC OR1200 commit 83ac6b. An inaccurate update of program counter (PC) values when SPR changes can lead to a Denial of Service (DoS).
- Insufficient control flow management in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via network access.
- Evmos is missing precompile checks
- An issue was discovered in Open5GS v2.7.2. When a UE switches between two gNBs and sends a handover request at a specific time, it may cause an exception in the AMF's internal sta…
- Insufficient control flow management in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially execute arbitrary c…
- Insufficient control flow management in the firmware for some Intel(R) Processors may allow an unauthenticated user to potentially enable escalation of privilege via physical acce…
- In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible.
- Vulnerability in Snow Inventory Java Scanner
- Insufficient control flow management for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow a privileged user to potentially enable information disclosure…
- Insufficient control flow management for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via local access.
- In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible
- Insufficient control flow management in some Intel(R) VROC software before version 8.6.0.3001 may allow an authenticated user to potentially enable escalation of privilege via loc…
- Insufficient control flow management for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: Device Drivers may allow a denial of service.…
- Insufficient control flow management in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially ena…
- Insufficient control flow management in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a privileged user to potentially enable denial of service via loca…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.