CWE-841 · Input Validation and Logic
Improper Enforcement of Behavioral Workflow
84CVEs
SortMost likely exploited
84 CVEs with CWE-841 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-67279In CISA KEVExploitedSSH Pre-Authentication Rekey State Bypass in MikroTik RouterOSMikrotik · RouterOS · CVSS 6.9 · 2026-09-05 | 6.9 | 2.3% | 2026-09-05 |
| CVE-2022-1667Secheron SEPCOS Control and Protection RelaySecheron · SEPCOS Control and Protection Relay firmware package · CVSS 7.5 · 2022-06-24 | 7.5 | 1.3% | 2022-06-24 |
| CVE-2026-70079Windows DNS Denial of Service VulnerabilityMicrosoft · Windows 10 Version 1607 · CVSS 7.5 · 2026-10-13 | 7.5 | 1.3% | 2026-10-13 |
| CVE-2022-2105Secheron SEPCOS Control and Protection RelaySecheron · SEPCOS Control and Protection Relay firmware package · CVSS 9.4 · 2022-06-24 | 9.4 | 1.1% | 2022-06-24 |
| CVE-2023-4181SourceCodester Free Hospital Management System for Small Practices Redirect behavioral workflowSourceCodester · Free Hospital Management System for Small Practices · CVSS 5.4 · 2023-08-06 | 5.4 | 1.1% | 2023-08-06 |
| CVE-2022-2102Secheron SEPCOS Control and Protection RelaySecheron · SEPCOS Control and Protection Relay firmware package · CVSS 9.4 · 2022-06-24 | 9.4 | 1.0% | 2022-06-24 |
| CVE-2025-55332Windows BitLocker Security Feature Bypass VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 6.1 · 2025-10-14 | 6.1 | 0.6% | 2025-10-14 |
| CVE-2025-55330Windows BitLocker Security Feature Bypass VulnerabilityMicrosoft · Windows 11 version 22H2 · CVSS 6.1 · 2025-10-14 | 6.1 | 0.6% | 2025-10-14 |
| CVE-2025-48481FreeScout Has Business Logic Errorsfreescout-help-desk · freescout · CVSS 6.1 · 2025-05-30 | 6.1 | 0.6% | 2025-05-30 |
| CVE-2025-48476FreeScout Has Business Logic Errorsfreescout-help-desk · freescout · CVSS 7.1 · 2025-05-30 | 7.1 | 0.6% | 2025-05-30 |
| CVE-2024-37296Aimeos HTML client vulnerable to digital products download without proper payment status checkaimeos · ai-client-html · CVSS 5.3 · 2024-06-11 | 5.3 | 0.5% | 2024-06-11 |
| CVE-2025-58051Nextcloud Tables app allowed to include local file via PhpSpreadsheet when importing a tablenextcloud · security-advisories · CVSS 6.5 · 2025-10-16 | 6.5 | 0.5% | 2025-10-16 |
| CVE-2024-6128spa-cartcms Checkout Page checkout behavioral workflowSpa-Cart · spa-cartcms · CVSS 5.3 · 2024-06-18 | 5.3 | 0.5% | 2024-06-18 |
| CVE-2025-55682Windows BitLocker Security Feature Bypass VulnerabilityMicrosoft · Windows 11 Version 24H2 · CVSS 6.1 · 2025-10-14 | 6.1 | 0.5% | 2025-10-14 |
| CVE-2025-55337Windows BitLocker Security Feature Bypass VulnerabilityMicrosoft · Windows 11 Version 24H2 · CVSS 6.1 · 2025-10-14 | 6.1 | 0.5% | 2025-10-14 |
| CVE-2025-48477FreeScout Has Business Logic Errorsfreescout-help-desk · freescout · CVSS 7.1 · 2025-05-30 | 7.1 | 0.5% | 2025-05-30 |
| CVE-2026-55763Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splitsklever-io · klever-go · CVSS 8.7 · 2026-08-28 | 8.7 | 0.5% | 2026-08-28 |
| CVE-2026-78103Dimension Log Server Configuration Lock Bypass VulnerabilityWatchGuard · Dimension · CVSS 5.1 · 2026-08-27 | 5.1 | 0.5% | 2026-08-27 |
| CVE-2026-3130Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is…Devolutions · Server · CVSS 9.8 · 2026-03-03 | 9.8 | 0.5% | 2026-03-03 |
| CVE-2025-13459IBM Aspera Console Denial of ServiceIBM · Aspera Console · CVSS 2.7 · 2026-03-13 | 2.7 | 0.5% | 2026-03-13 |
| CVE-2025-2323274056675 springboot-openai-chatgpt Number of Question questionCou updateQuestionCou behavioral workflow274056675 · springboot-openai-chatgpt · CVSS 4.3 · 2025-03-15 | 4.3 | 0.5% | 2025-03-15 |
| CVE-2026-43974gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOMninenines · gun · CVSS 8.7 · 2026-06-08 | 8.7 | 0.5% | 2026-06-08 |
| CVE-2025-48478FreeScout Has Business Logic Errorsfreescout-help-desk · freescout · CVSS 7 · 2025-05-30 | 7.0 | 0.5% | 2025-05-30 |
| CVE-2024-46307A loop hole in the payment logic of Sparkshop v1.16 allows attackers to arbitrarily modify the number of products.Sparkshop · Sparkshop · CVSS 7.5 · 2024-10-09 | 7.5 | 0.5% | 2024-10-09 |
| CVE-2024-0410Improper Enforcement of Behavioral Workflow in GitLabGitLab · GitLab · CVSS 7.7 · 2024-02-21 | 7.7 | 0.5% | 2024-02-21 |
| CVE-2026-113165Inappropriate implementation in Core in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engi…Google · Chrome · CVSS 8.8 · 2026-10-20 | 8.8 | 0.4% | 2026-10-20 |
| CVE-2026-82423macrozheng mall Payment Status Endpoint paySuccess behavioral workflowmacrozheng · mall · CVSS 5.4 · 2026-08-29 | 5.4 | 0.4% | 2026-08-29 |
| CVE-2026-82406Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplaceklever-io · klever-go · CVSS 7.1 · 2026-09-23 | 7.1 | 0.4% | 2026-09-23 |
| CVE-2026-78618Dimension Business Logic Flaw Allows Chained Backend Object OperationsWatchGuard · Dimension · CVSS 6.9 · 2026-08-27 | 6.9 | 0.4% | 2026-08-27 |
| CVE-2024-39325aimeos/ai-controller-frontend doesn't reset payment status in basketaimeos · ai-controller-frontend · CVSS 5.3 · 2024-07-02 | 5.3 | 0.4% | 2024-07-02 |
| CVE-2026-19208WonderTrader TraderDD.cpp queryTrades behavioral workflowWonderTrader · CVSS 3.7 · 2026-08-07 | 3.7 | 0.4% | 2026-08-07 |
| CVE-2026-78135libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are mishandled, there can be an authenticat…strongSwan · strongSwan · CVSS 5.6 · 2026-09-11 | 5.6 | 0.4% | 2026-09-11 |
| CVE-2026-128032OpenMage magento-lts before 20.18.2 Payment Bypass via Free Payment MethodOpenMage · magento-lts · CVSS 4.4 · 2026-11-13 | 4.4 | 0.4% | 2026-11-13 |
| CVE-2026-113308Inappropriate implementation in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to…Google · Chrome · CVSS 8.8 · 2026-10-20 | 8.8 | 0.4% | 2026-10-20 |
| CVE-2026-109231Germanized for WooCommerce <= 4.1.4 - Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Changevendidero · Germanized for WooCommerce · CVSS 4.3 · 2026-10-31 | 4.3 | 0.4% | 2026-10-31 |
| CVE-2026-75081Webkul Bagisto store behavioral workflowWebkul · Bagisto · CVSS 4.3 · 2026-08-17 | 4.3 | 0.4% | 2026-08-17 |
| CVE-2026-19993Webkul Bagisto RMA State Validation update-status behavioral workflowWebkul · Bagisto · CVSS 4.3 · 2026-08-17 | 4.3 | 0.4% | 2026-08-17 |
| CVE-2026-19213WonderTrader Pending Order TraderAdapter.h _undone_qty behavioral workflowWonderTrader · CVSS 4.3 · 2026-08-07 | 4.3 | 0.4% | 2026-08-07 |
| CVE-2026-19037WonderTrader Internal Limit Order Book Cache MatchEngine.cpp update_lob behavioral workflowWonderTrader · CVSS 4.3 · 2026-08-06 | 4.3 | 0.4% | 2026-08-06 |
| CVE-2026-53637Sylius: Cart FormComponent allows modification or deletion of an already-completed orderSylius · Sylius · CVSS 6.5 · 2026-09-08 | 6.5 | 0.4% | 2026-09-08 |
| CVE-2026-79083Improper enforcement of behavioral workflow in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially exec…Google · Chrome · CVSS 7.5 · 2026-08-25 | 7.5 | 0.4% | 2026-08-25 |
| CVE-2025-48482FreeScout Has Business Logic Errorsfreescout-help-desk · freescout · CVSS 5.3 · 2025-05-30 | 5.3 | 0.4% | 2025-05-30 |
| CVE-2026-80195Kimai before 2.63.0 Team Membership Removal via APIkimai · kimai · CVSS 5.4 · 2026-08-25 | 5.4 | 0.4% | 2026-08-25 |
| CVE-2026-113094Inappropriate implementation in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions…Google · Chrome · CVSS 8.8 · 2026-10-20 | 8.8 | 0.4% | 2026-10-20 |
| CVE-2026-65126NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workflow. A successful exploit of this vulne…NVIDIA · Infrastructure Controller · CVSS 5 · 2026-09-22 | 5.0 | 0.3% | 2026-09-22 |
| CVE-2024-12543A user enumeration and subsequent data integrity vulnerability affecting barcode functionalityOpenText · OpenText Content Management · CVSS 5.9 · 2025-04-21 | 5.9 | 0.3% | 2025-04-21 |
| CVE-2025-13239Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution submit_checkout behavioral workflowBdtask · Isshue Multi Store eCommerce Shopping Cart Solution · CVSS 4.3 · 2025-11-16 | 4.3 | 0.3% | 2025-11-16 |
| CVE-2026-104626Gitea fork workflow job revival through later approvalGitea · Gitea · CVSS 8.8 · 2026-10-06 | 8.8 | 0.3% | 2026-10-06 |
| CVE-2026-57536Insufficient validation of payment status in pretix-molliepretix · pretix-mollie · CVSS 6.3 · 2026-06-25 | 6.3 | 0.3% | 2026-06-25 |
| CVE-2026-18029Insufficient validation of payment status in pretix-girosolutionpretix GmbH · pretix-girosolution · CVSS 6.3 · 2026-07-28 | 6.3 | 0.3% | 2026-07-28 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.