CWE-696.

Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed after the user signs in

• Apache Software Foundation Apache Wicket
• CWE-696

Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability

• SMCI MBD-X12SPI
• CWE-696

GitPython validates a submodule's ".git" path only after cloning into it (RCE)

• CWE-696

<3.2.1 · fixed in 3.2.1

Gitea second-factor bypass through OpenID identity linking

• Gitea
• Authentication bypass
• CWE-696

Nix: Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation…

• Nix
• CWE-696

TYPO3-CORE-SA-2026-024: Security Misconfiguration in Form Framework

• Information disclosure
• CWE-696

>=14.0.0, <14.3.9 · fixed in 14.3.9

Docling imports plugin entry points before the allow_external_plugins check

• CWE-696
• CWE-829

>=2.27.0, <2.131.0 · fixed in 2.131.0

External Secrets Operator: label enforcement bypass in webhook generator enables secret exfiltration

• CWE-696

>=0.10.0, <1.3.2 · fixed in 1.3.2

WordPress FluentForm plugin <= 6.2.14 - Broken Access Control vulnerability

• WP ManageNinja LLC FluentForm
• CWE-696

Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when…

• @anthropic-ai/claude-code
• CWE-696

adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content

• CWE-436
• CWE-696

<0.6.1 · fixed in 0.6.1

Devolutions Server: Improper rule enforcement in the PAM Active Directory provider in Devolutions Server…

• Devolutions Server
• CWE-696

(D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange

• wolfSSL
• CWE-696

Security Advisory 0160

• Arista Networks EOS
• CWE-696

Partition interceptor may be improperly added while sending message

• Spring Cloud Stream
• CWE-696

Russh: Channel-scoped server callbacks can be reached without an open channel

• Broken access control
• CWE-666

<0.62.5 · fixed in 0.62.5

Firewall bypass during shutdown

• Phoenix Contact CHARX SEC-3150
• Phoenix Contact CHARX SEC-3100
• CWE-696

cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation

• DaveGamble cJSON
• CWE-696

Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode

• Apache Software Foundation Apache Traffic Server
• CWE-696

ads-tec Industrial IT: Account lockout via non-atomic user creation

• ads-tec Industrial IT DVG-IRF1401
• ads-tec Industrial IT DVG-IRF1421
• CWE-696

GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.

• GNU Savane
• CWE-696

Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot

• Indian Motorcycle Scout Bobber + Tech
• CWE-636
• CWE-696

Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot

• Indian Motorcycle Scout Bobber + Tech
• CWE-636
• CWE-696

OpenStack Ironic: Pre-Validation Checksum Calculation allows Denial of Service (DoS) via Infinite Block Devices

• CWE-696

<=36.0.0 · no fixed version yet

GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor

• CWE-696

<1.0.43 · fixed in 1.0.43

Tor: Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the…

• Tor
• CWE-696

kanidmd_lib: Image upload validators run before authorization; PNG validator panics on malformed input

• Memory corruption
• CWE-20

<1.9.3 · fixed in 1.9.3

OpenStack Horizon has Incorrect Behavior Order

• CWE-696

>=25.6, <25.7.3 · fixed in 25.7.3

UltraDAG: SmartOp Vote Path Triggers Fatal Supply Invariant Halt

• UltraDAGcom core
• CWE-460
• CWE-696

Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.

• littlecms little cms color engine
• CWE-696

systemd: In systemd 258 before 260, a local unprivileged user can trigger an assert when a…

• systemd
• CWE-696

Duplicate Advisory: OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete

• CWE-696

<2026.3.22 · fixed in 2026.3.22

Duplicate Advisory: OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation

• CWE-696

<2026.3.28 · fixed in 2026.3.28

Duplicate Advisory: OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement

• CWE-696

<2026.3.22 · fixed in 2026.3.22

OpenBSD OpenSSH: In OpenSSH before 10.3, command execution can occur via shell metacharacters in a…

• OpenBSD OpenSSH
• CWE-696

OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation

• Denial of service
• CWE-696

<2026.3.28 · fixed in 2026.3.28

OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibility

• Broken access control
• CWE-696

>=2026.3.11, <2026.3.28 · fixed in 2026.3.28

OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete

• Broken access control
• CWE-696

<2026.3.22 · fixed in 2026.3.22

OpenClaw: Mattermost callback dispatch allowed non-allowlisted sender actions

• Broken access control
• CWE-696

<2026.3.22 · fixed in 2026.3.22

OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement

• Broken access control
• CWE-696

<2026.3.22 · fixed in 2026.3.22

OpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructor

• openemr
• Broken access control
• CWE-696

Canon Inc. Generic Plus PCL6 Printer Driver: Unallocated memory access vulnerability in print processing of Generic Plus PCL6 Printer…

• Canon Inc. Generic Plus PCL6 Printer Driver
• Canon Inc. Generic Plus UFR II Printer Driver
• CWE-696

BMC Control-M/Agent improper IP address filtering order

• BMC Control-M/Agent
• CWE-696

mbedtls: Mbed TLS before 3.6.4 has a NULL pointer dereference because…

• mbedtls
• CWE-696

WhiteBeam: In WhiteBeam 0.2.0 through 0.2.1 before 0.2.2…

• WhiteBeam
• CWE-696

Intel(R) Core™ Ultra Processors: Incorrect behavior order for some Intel(R) Core™ Ultra Processors may allow an…

• Intel(R) Core™ Ultra Processors
• CWE-696

GraphQL grant on a property might be cached with different objects

• CWE-696

<3.4.17 || >=4.0.0-alpha.1, <4.0.22 || >=4.1.0-alpha.1, <4.1.5 · fixed in 3.4.17, 4.0.22, 4.1.5

Zoom Workplace Apps for iOS - Incorrect Behavior Order

• Zoom Communications, Inc Zoom Workplace Apps for iOS
• CWE-696

MariaDB: MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17…

• MariaDB
• CWE-696

An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used.

• CWE-696

Intel(R) Processor: Incorrect behavior order in transition between executive monitor and SMI transfer monitor…

• Intel(R) Processor
• CWE-696

ZKsync Era evaluation order of Yul function arguments

• matter-labs era-compiler-solidity
• CWE-696

Junos OS: EX4300 Series: Firewall filter not blocking egress traffic

• Juniper Networks Junos OS
• CWE-696

Junos OS: EX4300 Series: Loopback filter not blocking traffic despite having discard term.

• Juniper Networks Junos
• CWE-696

Potential DoS via the Tudoor mechanism in eventlet and dnspython

• CWE-292
• CWE-696

<2.6.1 · fixed in 2.6.1

Gallagher Command Centre Server: Incorrect behavior order in the Command Centre Server could allow privileged users to…

• Gallagher Command Centre Server
• CWE-696

Authorization bypass in Quarkus

• Broken access control
• CWE-551

>=2.14.0, <3.5.3 || <2.13.9.Final · fixed in 3.5.3, 2.13.9.Final

Incorrect request error handling triggers server crash in Vapor

• vapor
• Denial of service
• CWE-231

SolarWinds Platform Incorrect Behavior Order Vulnerability

• SolarWinds Platform
• CWE-696

skylot jadx affected by Incorrect Behavior Order in vulnerable dependency

• CWE-696

<1.4.3 · fixed in 1.4.3