CWE-841 Improper Enforcement of Behavioral Workflow
Description
The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-841 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-r4fx-v8hh-22mv | CVE-2026-92942 | HIGH |
vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block) |
2026-10-05 | |
| GHSA-26r5-4mm2-px5c | CVE-2026-82406 | HIGH |
Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace |
2026-09-23 | |
| GHSA-v358-wf77-39xv | CVE-2026-55763 | HIGH |
klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits |
2026-08-28 | |
| GHSA-2j82-37xg-f9wp | CVE-2026-43974 | HIGH | - |
gun has an Unexpected Status Code or Return Value vulnerability |
2026-07-29 |
| GHSA-5597-7rmh-97q5 | CVE-2026-53637 | MODERATE | - |
Sylius: Cart FormComponent allows modification or deletion of an already-completed order |
2026-07-09 |
| GHSA-mc5j-f6wx-h9qh | CVE-2026-48505 | HIGH | - |
Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission |
2026-06-25 |
| GHSA-vcgp-9326-pqcp | CVE-2026-42246 | HIGH |
net-imap vulnerable to STARTTLS stripping via invalid response timing |
2026-05-14 | |
| GHSA-qx5f-ghc2-7g5c | CVE-2026-42303 | MODERATE |
Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection |
2026-05-13 | |
| GHSA-xhw7-j96h-c3g5 | CVE-2026-43937 | HIGH |
YAFNET: Pre-Handler Authorization Bypass on Admin Pages Enables Blind SQL Execution via `/Admin/RunSql` |
2026-05-13 | |
| GHSA-62mf-vhhw-xmf8 | CVE-2025-48376 | LOW |
DNN site Import could use an external source with a crafted request |
2025-05-23 | |
| GHSA-m9gv-6p22-qgmj | CVE-2024-39325 | MODERATE | - |
ai-controller-frontend payment status in basket isn't reset |
2024-07-05 |
| GHSA-v4g2-cm5v-cxv7 | CVE-2024-37296 | MODERATE | - |
Digital products download without proper payment status check |
2024-06-11 |
| GHSA-x3rq-r3cm-5vc4 | CVE-2022-0524 | HIGH |
Publify Business Logic Errors |
2023-08-25 | |
| GHSA-c7xw-p58w-h6fj | CVE-2023-0105 | MODERATE |
Keycloak: Impersonation and lockout possible through incorrect handling of email trust |
2023-07-18 | |
| GHSA-vhvq-jh34-3fc8 | - | MODERATE |
Duplicate Advisory: Keycloak allows impersonation and lockout due to email trust not being handled correctly |
2023-07-18 |