CWE-841 · Improper Enforcement of Behavioral Workflow
54 CVEs classified under CWE-841 (Improper Enforcement of Behavioral Workflow). Browse by severity and year.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-30783 | Critical | 9.8 | 2026-03-05 | A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Client signaling, API sync loop, config m… |
CVE-2026-3130 | Critical | 9.8 | 2026-03-03 | Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a… |
CVE-2025-48481 | Critical | 9.8 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an attacker with an unactivated email invitation containing invite_hash… |
CVE-2022-2105 | Critical | 9.4 | 2022-06-24 | Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, including a “root” user level meant only for… |
CVE-2022-2102 | Critical | 9.4 | 2022-06-24 | Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modif… |
CVE-2026-34582 | Critical | 9.1 | 2026-04-07 | Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished… |
CVE-2026-43937 | High | 8.8 | 2026-05-12 | YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5, Any admin OnPost… handler executes its side effects before the ResultFilterAttribute rewri… |
CVE-2025-48476 | High | 8.8 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, when adding and editing user records using the fill() method, there is… |
CVE-2025-48477 | High | 8.1 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application's logic requires the user to perform a correct sequence… |
CVE-2024-51738 | High | 8.1 | 2025-01-20 | Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order and… |
CVE-2024-0410 | High | 7.7 | 2024-02-22 | An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A devel… |
CVE-2026-41259 | High | 7.5 | 2026-04-23 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Mastodon allows restricting new user sign-up… |
CVE-2026-30574 | High | 7.5 | 2026-03-27 | A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-sales.php file. The application fails to verify if th… |
CVE-2024-46307 | High | 7.5 | 2024-10-09 | A loop hole in the payment logic of Sparkshop v1.16 allows attackers to arbitrarily modify the number of products. |
CVE-2022-1667 | High | 7.5 | 2022-06-24 | Client-side JavaScript controls may be bypassed by directly running a JS function to reboot the PLC (e.g., from the browser console) or by loading the correspo… |
CVE-2026-48505 | High | 7.4 | 2026-06-22 | Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, a flaw in the handling of recovery co… |
CVE-2026-42246 | High | 7.4 | 2026-05-09 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-mi… |
CVE-2025-52469 | High | 7.1 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, a logic vulnerability in the friend request workflow of Chamilo’s social network module allo… |
CVE-2023-5921 | High | 7.1 | 2023-11-22 | Improper Enforcement of Behavioral Workflow vulnerability in DECE Software Geodi allows Functionality Bypass. This issue affects Geodi: before 8.0.0.27396. |
CVE-2026-46540 | Medium | 6.5 | 2026-06-10 | Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, when LightBlockchain::r… |