CWE-696: Incorrect Behavior Order
The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.
A kind of CWE-691 Insufficient Control Flow Management.
From the CWE List. © The MITRE Corporation.
Newest
- rustls rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure 4.6 Medium
- hickory-dns Hickory-DNS 0.26.0 before 0.26.2 UDP Client Denial of Service via Spoofed Responses 8.2 High
- apache software foundation wicket Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in 2.1 Low
- smci mbd-x12spi Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability 7.4 High
- gitpython-developers gitpython GitPython validates a submodule's ".git" path only after cloning into it (RCE) 7.5 High
- gitea Gitea second-factor bypass through OpenID identity linking 8.8 High
- nixos nix Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because... 8.0 High
- typo3 cms TYPO3 CMS - Security Misconfiguration in Form Framework 6.3 Medium
- external-secrets External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration 7.1 High
- docling, docling-project docling-slim +1 more Docling: Plugin entry points are imported before the allow_external_plugins check 6.7 Medium
- shahjahan jewel fluentform WordPress FluentForm plugin <= 6.2.14 - Broken Access Control vulnerability 5.3 Medium
- anthropic @anthropic-ai/claude-code Claude Code selected an API key stored by Claude Code, for example from an earlier /login or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fet… 2.0 Low
- cthackers adm-zip adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypass 8.2 High
- devolutions server Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5... 4.3 Medium
- wolfssl (D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange 6.3 Medium
- arista networks eos Security Advisory 0160 7.0 High
- spring cloud stream, vmware spring cloud stream +1 more Partition interceptor may be improperly added while sending message 3.1 Low
- eugeny russh Russh: Channel-scoped server callbacks can be reached without an open channel 6.5 Medium
- phoenix contact charx sec-3000, charx sec-3050, charx sec-3100 +1 more +3 more Firewall bypass during shutdown 9.3 Critical
- cjson project cjson cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation 6.9 Medium
- apache traffic server Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode 6.3 Medium
- ads-tec industrial it dvg-irf1401, dvg-irf1421, dvg-irf3401 +3 more +5 more ads-tec Industrial IT: Account lockout via non-atomic user creation 8.1 High
- gnu savane GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization. 3.7 Low
- indian motorcycle scout bobber + tech Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot 1.0 Low
- indian motorcycle scout bobber + tech Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot 1.0 Low
- openstack ironic OpenStack Ironic: Pre-Validation Checksum Calculation allows Denial of Service (DoS) via Infinite Block Devices 4.3 Medium
- github copilot-cli GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor 8.5 High
- torproject tor Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of... 3.7 Low
-
kanidmd_libcrates.io kanidmd_lib: Image upload validators run before authorization; PNG validator panics on malformed input 6.9 Medium - openstack horizon OpenStack Horizon has Incorrect Behavior Order 5.3 Medium
- ultradag, opnsense core +1 more UltraDAG: SmartOp Vote Path Triggers Fatal Supply Invariant Halt 8.8 High
- littlecms little cms, little cms color engine +1 more Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the... 4.0 Medium
- systemd In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes... 4.7 Medium
- openbsd openssh In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within... 3.6 Low
- openclaw OpenClaw < 2026.3.25 - Denial of Service via Unauthenticated Webhook Request Parsing 6.9 Medium
- openclaw OpenClaw 2026.3.11 < 2026.3.25 - Session Isolation Bypass via sessionId Resolution 7.1 High
- openclaw OpenClaw < 2026.3.22 - Premature Cite Expansion Before Authorization in Channel and DM 6.9 Medium
- openclaw OpenClaw < 2026.3.22 - Unauthorized Action Execution via Callback Dispatch 6.9 Medium
- openclaw OpenClaw < 2026.3.22 - Unauthenticated Cryptographic Work in Nostr Inbound DM Handling 6.9 Medium
- open-emr openemr OpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructor 5.4 Medium
- canon inc. carps2 printer driver, generic fax driver, generic plus lips4 printer driver +10 more +12 more Unallocated memory access vulnerability in print processing of Generic Plus PCL6 Printer Driver /... 6.9 Medium
- bmc control-m/agent BMC Control-M/Agent improper IP address filtering order 6.9 Medium
- arm mbed tls, mbed mbedtls +1 more Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can... 4.0 Medium
- whitebeam In WhiteBeam 0.2.0 through 0.2.1 before 0.2.2, a user with local access to a server can bypass... 5.7 Medium
-
intel-microcodeDebian,intel-ucodeAlpaquita,microcodeMageia +3 more +5 more Incorrect behavior order for some Intel(R) Core™ Ultra Processors may allow an unauthenticated... 4.1 Medium - api-platform core GraphQL grant on a property might be cached with different objects 7.5 High
- zoom workplace, zoom communications, inc workplace apps for ios, zoom meeting software development kit +2 more Zoom Workplace Apps for iOS - Incorrect Behavior Order 7.1 High
- mariadb MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11... 4.9 Medium
- trustedfirmware mbed tls An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user... 5.1 Medium
- intel processor Incorrect behavior order in transition between executive monitor and SMI transfer monitor (STM)... 7.3 High
- Show olderLoading…