CWE-696 · Input Validation and Logic
Incorrect Behavior Order
59CVEs
SortMost likely exploited
59 CVEs with CWE-696 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-120490Administrator with policy and NAT permissions can bypass Sync network protection on Scalable Platformscheckpoint · Scalable Platforms (ElasticXL, Maestro, Chassis) · CVSS 3.8 · 2026-11-12 | 3.8 | 8.4% | 2026-11-12 |
| CVE-2023-33224SolarWinds Platform Incorrect Behavior Order VulnerabilitySolarWinds · SolarWinds Platform · CVSS 7.2 · 2023-07-26 | 7.2 | 2.8% | 2023-07-26 |
| CVE-2021-22569Denial of Service of protobuf-java parsing procedureGoogle LLC · protobuf-java · CVSS 7.5 · 2022-01-07 | 7.5 | 1.8% | 2022-01-07 |
| CVE-2021-31379Junos OS: MX Series: MPC 7/8/9/10/11 cards with MAP-E: PFE halts when an attacker sends malformed IPv4 or IPv6 traffic inside the MAP-E tunnel.Juniper Networks · Junos OS · CVSS 7.5 · 2021-10-19 | 7.5 | 1.3% | 2021-10-19 |
| CVE-2026-44108Firewall bypass during shutdownPhoenix Contact · CHARX SEC-3150 · CVSS 9.8 · 2026-07-30 | 9.8 | 0.8% | 2026-07-30 |
| CVE-2025-31485GraphQL grant on a property might be cached with different objectsapi-platform · core · CVSS 7.5 · 2025-04-03 | 7.5 | 0.6% | 2025-04-03 |
| CVE-2026-65100Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encodeApache Software Foundation · Apache Traffic Server · CVSS 4.8 · 2026-07-29 | 4.8 | 0.6% | 2026-07-29 |
| CVE-2025-48965Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero.Mbed · mbedtls · CVSS 4 · 2025-07-20 | 4.0 | 0.6% | 2025-07-20 |
| CVE-2026-14169ads-tec Industrial IT: Account lockout via non-atomic user creationads-tec Industrial IT · DVG-IRF1401 · CVSS 8.1 · 2026-07-28 | 8.1 | 0.5% | 2026-07-28 |
| CVE-2025-0150Zoom Workplace Apps for iOS - Incorrect Behavior OrderZoom Communications, Inc · Zoom Workplace Apps for iOS · CVSS 7.1 · 2025-03-11 | 7.1 | 0.5% | 2025-03-11 |
| CVE-2026-35627OpenClaw < 2026.3.22 - Unauthenticated Cryptographic Work in Nostr Inbound DM HandlingOpenClaw · OpenClaw · CVSS 6.5 · 2026-04-09 | 6.5 | 0.5% | 2026-04-09 |
| CVE-2026-44919In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL.OpenStack · Ironic · CVSS 4.3 · 2026-05-14 | 4.3 | 0.5% | 2026-05-14 |
| CVE-2023-52968MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_nee…MariaDB · MariaDB · CVSS 4.9 · 2025-03-08 | 4.9 | 0.5% | 2025-03-08 |
| CVE-2026-65219Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerabilitySMCI · MBD-X12SPI · CVSS 7.4 · 2026-10-27 | 7.4 | 0.5% | 2026-10-27 |
| CVE-2026-35640OpenClaw < 2026.3.25 - Denial of Service via Unauthenticated Webhook Request ParsingOpenClaw · OpenClaw · CVSS 5.3 · 2026-04-09 | 5.3 | 0.5% | 2026-04-09 |
| CVE-2026-35652OpenClaw < 2026.3.22 - Unauthorized Action Execution via Callback DispatchOpenClaw · OpenClaw · CVSS 6.5 · 2026-04-10 | 6.5 | 0.4% | 2026-04-10 |
| CVE-2026-67217cJSON JSON Patch Non-Atomic Application Destroys Data Before ValidationDaveGamble · cJSON · CVSS 5.3 · 2026-07-29 | 5.3 | 0.4% | 2026-07-29 |
| CVE-2026-114145GitPython validates a submodule's ".git" path only after cloning into it (RCE)gitpython-developers · GitPython · CVSS 7.5 · 2026-10-21 | 7.5 | 0.4% | 2026-10-21 |
| CVE-2026-121291Security Advisory 0222Arista Networks · EOS · CVSS 8.2 · 2026-11-10 | 8.2 | 0.4% | 2026-11-10 |
| CVE-2026-56355GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.GNU · Savane · CVSS 3.7 · 2026-06-20 | 3.7 | 0.4% | 2026-06-20 |
| CVE-2024-35229ZKsync Era evaluation order of Yul function argumentsmatter-labs · era-compiler-solidity · CVSS 5.3 · 2024-05-27 | 5.3 | 0.4% | 2024-05-27 |
| CVE-2025-55114BMC Control-M/Agent improper IP address filtering orderBMC · Control-M/Agent · CVSS 5.3 · 2025-09-16 | 5.3 | 0.4% | 2025-09-16 |
| CVE-2025-9904Unallocated memory access vulnerability in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus LIPS4 Printer Driver / Generic…Canon Inc. · Generic Plus PCL6 Printer Driver · CVSS 5.3 · 2025-09-29 | 5.3 | 0.4% | 2025-09-29 |
| CVE-2026-44600Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010.torproject · Tor · CVSS 3.7 · 2026-05-07 | 3.7 | 0.4% | 2026-05-07 |
| CVE-2026-68930Russh: Channel-scoped server callbacks can be reached without an open channelEugeny · russh · CVSS 6.5 · 2026-08-03 | 6.5 | 0.4% | 2026-08-03 |
| CVE-2026-109162TYPO3 CMS - Security Misconfiguration in Form FrameworkTYPO3 · TYPO3 CMS · CVSS 6.3 · 2026-10-13 | 6.3 | 0.4% | 2026-10-13 |
| CVE-2026-123584Hickory-DNS 0.26.0 before 0.26.2 UDP Client Denial of Service via Spoofed Responseshickory-dns · hickory-dns · CVSS 5.9 · 2026-11-08 | 5.9 | 0.4% | 2026-11-08 |
| CVE-2026-41254Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.littlecms · little cms color engine · CVSS 4 · 2026-04-18 | 4.0 | 0.4% | 2026-04-18 |
| CVE-2024-30410Junos OS: EX4300 Series: Loopback filter not blocking traffic despite having discard term.Juniper Networks · Junos · CVSS 5.8 · 2024-04-12 | 5.8 | 0.4% | 2024-04-12 |
| CVE-2024-30389Junos OS: EX4300 Series: Firewall filter not blocking egress trafficJuniper Networks · Junos OS · CVSS 5.8 · 2024-04-12 | 5.8 | 0.4% | 2024-04-12 |
| CVE-2026-43002An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be e…OpenStack · Horizon · CVSS 5.3 · 2026-05-05 | 5.3 | 0.4% | 2026-05-05 |
| CVE-2026-45033GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitorgithub · copilot-cli · CVSS 8.5 · 2026-05-13 | 8.5 | 0.4% | 2026-05-13 |
| CVE-2026-112186In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into memory, with no limit on its size. The endpoints parse the b…Eclipse Foundation · Eclipse Kura · CVSS 8.7 · 2026-11-10 | 8.7 | 0.3% | 2026-11-10 |
| CVE-2026-35386In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line i…OpenBSD · OpenSSH · CVSS 3.6 · 2026-04-02 | 3.6 | 0.3% | 2026-04-02 |
| CVE-2026-82898Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs inApache Software Foundation · Apache Wicket · CVSS 2.1 · 2026-11-01 | 2.1 | 0.3% | 2026-11-01 |
| CVE-2023-23576Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site for longer than intended after a network outage when compete…Gallagher · Command Centre Server · CVSS 4.3 · 2023-12-18 | 4.3 | 0.3% | 2023-12-18 |
| CVE-2026-35636OpenClaw 2026.3.11 < 2026.3.25 - Session Isolation Bypass via sessionId ResolutionOpenClaw · OpenClaw · CVSS 6.5 · 2026-04-09 | 6.5 | 0.3% | 2026-04-09 |
| CVE-2026-73446Security Advisory 0160Arista Networks · EOS · CVSS 7.4 · 2026-09-15 | 7.4 | 0.3% | 2026-09-15 |
| CVE-2025-20012Incorrect behavior order for some Intel(R) Core™ Ultra Processors may allow an unauthenticated user to potentially enable information disclosure via physical access.Intel(R) Core™ Ultra Processors · CVSS 4.9 · 2025-05-13 | 4.9 | 0.3% | 2025-05-13 |
| CVE-2026-35637OpenClaw < 2026.3.22 - Premature Cite Expansion Before Authorization in Channel and DMOpenClaw · OpenClaw · CVSS 7.3 · 2026-04-09 | 7.3 | 0.3% | 2026-04-09 |
| CVE-2026-26287External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltrationexternal-secrets · external-secrets · CVSS 7.1 · 2026-10-06 | 7.1 | 0.2% | 2026-10-06 |
| CVE-2026-128087russh kex_done: shared-secret callback runs before server host-key verificationEugeny · russh · CVSS 3.7 · 2026-11-13 | 3.7 | 0.2% | 2026-11-13 |
| CVE-2024-45157An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used. Unlike previously documented, enabling MBEDTLS_PSA_HMAC_D…Trustedfirmware · Mbed Tls · CVSS 5.1 · 2024-09-05 | 5.1 | 0.2% | 2024-09-05 |
| CVE-2024-24853Incorrect behavior order in transition between executive monitor and SMI transfer monitor (STM) in some Intel(R) Processor may allow a privileged user to potentially enable escala…Intel(R) Processor · CVSS 7.2 · 2024-08-14 | 7.2 | 0.2% | 2024-08-14 |
| CVE-2026-33305OpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructoropenemr · openemr · CVSS 5.4 · 2026-03-19 | 5.4 | 0.2% | 2026-03-19 |
| CVE-2026-59305Partition interceptor may be improperly added while sending messageSpring · Spring Cloud Stream · CVSS 3.1 · 2026-08-27 | 3.1 | 0.2% | 2026-08-27 |
| CVE-2026-93330Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host rulese…Devolutions · Server · CVSS 4.3 · 2026-09-29 | 4.3 | 0.2% | 2026-09-29 |
| CVE-2021-47688In WhiteBeam 0.2.0 through 0.2.1 before 0.2.2, a user with local access to a server can bypass the allow-list functionality because a file can be truncated in the OpenFileDescript…WhiteBeam · WhiteBeam · CVSS 5.7 · 2025-06-23 | 5.7 | 0.2% | 2025-06-23 |
| CVE-2026-103353WordPress FluentForm plugin <= 6.2.14 - Broken Access Control vulnerabilityWP ManageNinja LLC · FluentForm · CVSS 5.3 · 2026-10-01 | 5.3 | 0.2% | 2026-10-01 |
| CVE-2026-63027Incorrect behavior order in the get_tcb_level_by_svn for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. Network adversary…Intel(R) TDX Migration Trust Domain (MigTD) · CVSS 5.3 · 2026-11-10 | 5.3 | 0.2% | 2026-11-10 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.