CWE-670: Always-Incorrect Control Flow Implementation
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
A kind of CWE-691 Insufficient Control Flow Management.
From the CWE List. © The MITRE Corporation.
Newest
- nestjs nestNest Fastify HEAD Request Middleware Bypass8.7 High
- dronecode px4 drone autopilot, px4 px4-autopilot +1 morePX4 Autopilot MAVLink FTP Session Validation Logic Error Allows Operations on Invalid File Descriptors4.3 Medium
github.com/cosmos/evmGoCosmos EVM: incorrect state handling during nested EVM execution paths9.3 Critical- mitsubishi electric corporation melsec iq-f series fx5-eip ethernet/ip module fx5-eip, melsec iq-f series fx5-enet/ip ethernet module fx5-enet/ip, mitsubishielectric melsec iq-f fx5-eip firmware +1 more +3 moreDenial-of-Service (DoS) vulnerability in Ethernet function of MELSEC iQ-F Series EtherNet/IP module and Ethernet module8.7 High
- stellar rs-soroban-sdkrs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide7.5 High
- nvidia dgx spark, dgx os +1 moreNVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause...3.2 Low
- ssh tectia serverSSH Tectia Server before 6.6.6 sometimes allows attackers to read and alter a user's session...7.2 High
- apple ipados, macos, tvos +4 more +6 moreA logic issue was addressed with improved state management. This issue is fixed in tvOS 26, macOS...9.8 Critical
- linux, linux kernel +1 morewifi: ath12k: Prevent sending WMI commands to firmware during firmware crash8.8 High
- kde konsoleKDE Konsole before 25.04.2 allows remote code execution in a certain scenario. It supports...8.2 High
- amazon toughTerminating targets role delegations are not respected in tough5.7 Medium
- opennetworking onosAn issue in onos v2.7.0 allows attackers to trigger unexpected behavior within a device connected...9.1 Critical
- linux, linux kernel +1 moremisc: fastrpc: fix list iterator in fastrpc_req_mem_unmap_impl7.8 High
- polytope-labs hyperbridgeCritical vulnerability in `ismp-grandpa` <v15.0.19.3 Critical
- vyperlang vyperSuccess of Certain Precompile Calls not Checked in Vyper2.3 Low
- envoyproxy envoyHTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoy7.1 High
- envoyproxy envoyHTTP/1: sending overload crashes when the request is reset beforehand in envoy7.5 High
- envoyproxy envoyHappy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoy4.5 Medium
- linux, linux kernel +1 morepmdomain: imx93-blk-ctrl: correct remove path5.5 Medium
- ngtcp2Acks not validated before logged to qlog leads to buffer overflow in ngtcp28.2 High
- winzipWinZip Mark-of-the-Web Bypass Vulnerability7.8 High
- hcl software traveler for microsoft outlook (htmo), hcltech traveler for microsoft outlook +1 moreHCL Traveler for Microsoft Outlook (HTMO) is susceptible to a control flow vulnerability5.3 Medium
- debian linux, linux kernel +1 moremm: call the security_mmap_file() LSM hook in remap_file_pages()7.8 High
- dena h2oH2O ignores headers configuration directives3.1 Low
- gradio-app gradioThe `enable_monitoring` flag set to `False` does not disable monitoring in Gradio2.3 Low
- btcd project btcdbtcd did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality7.4 High
- bytecodealliance wasmtimeWasmtime runtime crash when combining tail calls with trapping imports5.5 Medium
- cisco ios xe software, ios xe +1 moreA vulnerability in the DHCP Snooping feature of Cisco IOS XE Software on Software-Defined Access ...8.6 High
- envoyproxy envoyoghttp2 crash on OnBeginHeadersForStream in envoy7.5 High
- requarks wiki, wiki.js +1 moreDisabled user can bypass lockout by requesting password reset in wiki.js4.3 Medium
- quinn-rs quinnDenial of service in quinn-proto when using `Endpoint::retry()`7.5 High
- openzeppelin cairo-contracts, contracts +1 moreOwnableTwoStep allows a pending owner to accept ownership after the original owner has renounced ownership in cairo-contracts5.3 Medium
- rockwell automation 1756-en4, compact guardlogix 5380, compactlogix 5380 +14 more +16 moreRockwell Automation Multicast Request Causes major nonrecoverable fault on Select Controllers8.3 High
- evmosEvmos's contract balance not updating correctly after interchain transaction7.5 High
- android pixel, google android +1 morethere is a possible way to bypass due to a logic error in the code. This could lead to local...7.8 High
- linux, linux kernel +1 moreusb: config: fix iteration issue in 'usb_get_bos_descriptor()'5.5 Medium
- linux, linux kernel +1 morenet: USB: Fix wrong-direction WARNING in plusb.c5.5 Medium
- psf requests, request project request +1 moreRequests `Session` object does not verify requests after making first request with verify=False5.6 Medium
- asteriskAsterisk' res_pjsip_endpoint_identifier_ip: wrongly matches ALL unauthorized SIP requests5.8 Medium
ezsystems/ezplatformPackagisteZ Platform Rules to disable executable access are ignored on Platform.sh (eZ Cloud)No scorearticrates.io,tor-circmgrcrates.io +1 moreTor path lengths too short when "full Vanguards" configured7.3 Higharticrates.io,tor-circmgrcrates.io +1 moreTor Arti's STUB circuits incorrectly have a length of 26.2 Medium- apollographql apollo router, router +1 moreDefect in query plan cache may cause incorrect operations to be executed in Apollo Router9.1 Critical
- stsaz phiolaAn issue in phiola/src/afilter/conv.c:115 of phiola v2.0-rc22 allows a remote attacker to cause a...6.5 Medium
- oretnom23 computer laboratory management systemSourceCodester Computer Laboratory Management System config.php redirect7.3 High
- enalean tuleapTuleap deleting or moving an artifact can delete values from unrelated artifacts7.6 High
- skyhigh client proxyA malicious insider exploiting this vulnerability can circumvent existing security controls put...5.5 Medium
- xen, fedoraproject fedora +1 moreVT-d: Failure to quarantine devices in !HVM builds4.1 Medium
- checkmkDisabled automation users could still authenticate8.8 High
- openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 moreDuplicated execution of subcalls in OpenZeppelin Contracts5.9 Medium
- Show moreLoading…