CWE-837 · weakness in Input Validation and Logic
Improper Enforcement of a Single, Unique Action
18 CVEs
Out of date: the sync last ran 3 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- likely to be exploited
- 1
Every one of the 18 is a mark on the map. Named now: 1 to 18, most at risk first.
- While assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in logic implementation allows an authenticated user to reset it's…
- Thecosy IceCMS Love resource improper enforcement of a single, unique action
- Keycloak: potential bypass of brute force protection
- Thecosy IceCMS Like improper enforcement of a single, unique action
- Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sent to the server as a GET parameter and t…
- Thecosy IceCMS Comment Like improper enforcement of a single, unique action
- Improper Enforcement of Unique Constraint in lunary-ai/lunary
- phpkobo Ajax Poll Script ajax-poll.php improper enforcement of a single, unique action
- MyBB: Default CAPTCHA missing invalidation
- PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket
- The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness.
- Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TROVE-2026-009.
- Payload: Order confirmation validation issue in Payload Ecommerce
- Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders
- Zoom Workplace Clients for Windows - Improper Action Enforcement
- InventoryGUI vulnerable to item duplication via Bundle items when using GuiStorageElement
- InventoryGui affected by item duplication in GUIs which use GuiStorageElement
- InventoryGui allows item duplication in GUIs which use GuiStorageElement
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.