Advisories · Weakness
CWE-837.
Every Advisory and CVE whose sources give the weakness CWE-837, newest first.
- CVSS 2.3 Low
PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets
- CWE-837
<5.44.2 · fixed in 5.44.2
GHSA-pg53-p7qp-65cv · CVE-2026-86198 - CVSS 5.3 Medium
Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders
- Thelia
- CWE-837
- CVSS 8.8 High
Payload Ecommerce has an order confirmation validation issue
- CWE-837
<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34 · fixed in 3.90.0, 4.0.0-canary.34
GHSA-8r29-2mp2-pmrw · CVE-2026-105850 - CVSS 5.3 Medium
MyBB: Default CAPTCHA missing invalidation
- mybb
- CWE-837
- CVSS 3.7 Low
Tor: Tor before 0.4.9.7, when circuit queue memory pressure exists…
- Tor
- CWE-837
- CVSS 8.1 High
Grav Vulnerable to Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic
- Privilege escalation
- Broken access control
<2.0.0-beta.2 · fixed in 2.0.0-beta.2
GHSA-rr73-568v-28f8 · CVE-2026-42609 - CVSS 5.3 Medium
InventoryGui allows item duplication in GUIs which use GuiStorageElement
- CWE-837
<1.6.5 · fixed in 1.6.5
GHSA-7whh-79j3-7c55 · CVE-2025-62784 - CVSS 5.9 Medium
InventoryGui allows item duplication with experimental "Bundle" item in GUIs which use GuiStorageElement
- CWE-837
<1.6.4-SNAPSHOT · fixed in 1.6.4-SNAPSHOT
GHSA-rgvh-4m82-fvjq · CVE-2025-62782 - CVSS 5.0 Medium
InventoryGui affected by item duplication in GUIs which use GuiStorageElement
- CWE-754
- CWE-837
<1.6.2-SNAPSHOT · fixed in 1.6.2-SNAPSHOT
GHSA-598q-jw82-5w66 · CVE-2025-62783 - CVSS 7.1 High
Matrix specification: The Matrix specification before 1.16 (i.e…
- Matrix specification
- CWE-837
- CVSS 5.3 Medium
Zoom Workplace Clients for Windows - Improper Action Enforcement
- Zoom Communications, Inc Zoom Workplace Clients for Windows
- CWE-837
- CVSS 6.5 Medium
Improper Enforcement of Unique Constraint in lunary-ai/lunary
- lunary-ai/lunary
- CWE-837
- CVSS 6.3 Medium
Weak credentials in CTFd
- CTFd
- Hard-coded credentials
- CWE-837
- CVSS 5.3 Medium
CTFd: While assignment of a user to a team (bracket) in CTFd should be possible only once…
- CTFd
- CWE-837
- CVSS 5.3 Medium
Unauthorized Modification of Ticket Requester
- Issuetrak
- CWE-472
- CWE-837
- CVSS 6.5 Medium
Keycloak Services has a potential bypass of brute force protection
- Authentication bypass
- CWE-837
<22.0.12 || >=23.0.0, <24.0.7 || >=25.0.0, <25.0.4 · fixed in 22.0.12, 24.0.7, 25.0.4
GHSA-gc7q-jgjv-vjr2 · CVE-2024-4629 - CVSS 6.5 Medium
Duplicate Advisory: Keycloak has a brute force login protection bypass
- CWE-837
<24.0.4 · fixed in 24.0.4
GHSA-8wm9-24qg-m5qj - CVSS 5.3 Medium
Thecosy IceCMS Love resource improper enforcement of a single, unique action
- Thecosy IceCMS
- CWE-837
- CVSS 3.1 Low
Thecosy IceCMS Comment Like improper enforcement of a single, unique action
- Thecosy IceCMS
- CWE-837
- CVSS 4.3 Medium
Thecosy IceCMS Like improper enforcement of a single, unique action
- Thecosy IceCMS
- CWE-837
- CVSS 5.3 Medium
phpkobo Ajax Poll Script ajax-poll.php improper enforcement of a single, unique action
- phpkobo Ajax Poll Script
- CWE-837