# CWE-840. Every Advisory and CVE whose sources give the weakness CWE-840, newest first. ## Records, newest first - [Omega Solution Restro POS sale-invoice logic error](https://agentprime.io/advisories/CVE-2026-116461.md) `CVE-2026-116461` · CVE record: Omega Solution Restro POS · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-840 - [node: A flaw in the Node.js \`zlib.ZipFile\` API can cause it to return bytes that do not belong…](https://agentprime.io/advisories/CVE-2026-106070.md) `CVE-2026-106070` · CVE record: nodejs node · CVSS 3.7 Low · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-840 - [subhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflow](https://agentprime.io/advisories/CVE-2026-115248.md) `CVE-2026-115248` · CVE record: subhajitkhan online-clinic-management-system · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-840, CWE-841 - [light0011 cms Vote VoteController.class.php logic error](https://agentprime.io/advisories/CVE-2026-112028.md) `CVE-2026-112028` · CVE record: light0011 cms · CVSS 6.9 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: CWE-840 - [macrozheng mall mall-portal generateOrder OmsPortalOrderServiceImpl logic error](https://agentprime.io/advisories/CVE-2026-109406.md) `CVE-2026-109406` · CVE record: macrozheng mall · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-840 - [deepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflow](https://agentprime.io/advisories/CVE-2026-108789.md) `CVE-2026-108789` · CVE record: deepseek-ai deepseek-harness · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-840, CWE-841 - [macrozheng mall Payment Endpoint AlipayServiceImpl.java AlipayServiceImpl.pay logic error](https://agentprime.io/advisories/CVE-2026-108784.md) `CVE-2026-108784` · CVE record: macrozheng mall · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-840 - [newbee-ltd newbee-mall Shopping Cart Quantity updateAccountHeadAndDetail logic error](https://agentprime.io/advisories/CVE-2026-105573.md) `CVE-2026-105573` · CVE record: newbee-ltd newbee-mall · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-840 - [The emoji field in the page emoji update endpoint does not properly validate user input.](https://agentprime.io/advisories/CVE-2026-77166.md) `CVE-2026-77166` · CVE record: Nextcloud Collectives · CVSS 2.4 Low · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-840 - [Nextcloud Approval: The Approval app's approve/reject endpoint is meant to require the file's current etag as…](https://agentprime.io/advisories/CVE-2026-82982.md) `CVE-2026-82982` · CVE record: Nextcloud Approval · CVSS 4.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-840 - [HKUDS AI-Trader selfRegister API Endpoint routes_agent.py logic error](https://agentprime.io/advisories/CVE-2026-85030.md) `CVE-2026-85030` · CVE record: HKUDS AI-Trader · CVSS 6.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-840 - [macrozheng mall Payment Status Endpoint paySuccess behavioral workflow](https://agentprime.io/advisories/CVE-2026-82423.md) `CVE-2026-82423` · CVE record: macrozheng mall · CVSS 5.3 Medium · Not analysed yet · Published 29 Aug 2026 · Tags: CWE-840, CWE-841 - [macrozheng mall quantity OmsCartItemServiceImpl.updateQuantity logic error](https://agentprime.io/advisories/CVE-2026-79406.md) `CVE-2026-79406` · CVE record: macrozheng mall · CVSS 5.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-840 - [Webkul Bagisto store behavioral workflow](https://agentprime.io/advisories/CVE-2026-75081.md) `CVE-2026-75081` · CVE record: Webkul Bagisto · CVSS 5.3 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-840, CWE-841 - [Webkul Bagisto RMA State Validation update-status behavioral workflow](https://agentprime.io/advisories/CVE-2026-19993.md) `CVE-2026-19993` · CVE record: Webkul Bagisto · CVSS 5.3 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-840, CWE-841 - [WonderTrader Pending Order TraderAdapter.h \_undone_qty behavioral workflow](https://agentprime.io/advisories/CVE-2026-19213.md) `CVE-2026-19213` · CVE record: WonderTrader · CVSS 5.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: CWE-840, CWE-841 - [WonderTrader TraderDD.cpp queryTrades behavioral workflow](https://agentprime.io/advisories/CVE-2026-19208.md) `CVE-2026-19208` · CVE record: WonderTrader · CVSS 6.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: CWE-840, CWE-841 - [WonderTrader Internal Limit Order Book Cache MatchEngine.cpp update_lob behavioral workflow](https://agentprime.io/advisories/CVE-2026-19037.md) `CVE-2026-19037` · CVE record: WonderTrader · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-840, CWE-841 - [Permission control vulnerability in the file system.](https://agentprime.io/advisories/CVE-2026-58558.md) `CVE-2026-58558` · CVE record: Huawei Harmony OS and 1 more · CVSS 7.8 High · Not analysed yet · Published 15 Jul 2026 · Tags: CWE-840 - [SourceCodester Simple Food Ordering System cart.php logic error](https://agentprime.io/advisories/CVE-2026-13571.md) `CVE-2026-13571` · CVE record: SourceCodester Simple Food Ordering System · CVSS 6.9 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-840 - [Permission control vulnerability in calls.](https://agentprime.io/advisories/CVE-2026-41973.md) `CVE-2026-41973` · CVE record: Huawei HarmonyOS and 1 more · CVSS 5.9 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-840 - [songquanpeng one-api has an issue that results in business logic errors](https://agentprime.io/advisories/GHSA-7v3v-cp44-vc8m.md) `GHSA-7v3v-cp44-vc8m`, `CVE-2026-11465`, `GO-2026-6126` · Go `github.com/songquanpeng/one-api`: affected `>=0.1.6-alpha, <=0.6.11-preview.7`, no fixed version yet · CVSS 2.3 Low · Not analysed yet · Published 8 Jun 2026 · Tags: CWE-20, CWE-840 - [Sanluan PublicCMS Trade Payment Flow TradeOrderController.java AccountGatewayComponent.pay logic error](https://agentprime.io/advisories/CVE-2026-8738.md) `CVE-2026-8738` · CVE record: Sanluan PublicCMS · CVSS 6.9 Medium · Not analysed yet · Published 17 May 2026 · Tags: CWE-840 - [Permission control vulnerability in the manufacturability design module.](https://agentprime.io/advisories/CVE-2026-41968.md) `CVE-2026-41968` · CVE record: Huawei HarmonyOS · CVSS 5.9 Medium · Not analysed yet · Published 15 May 2026 · Tags: CWE-840 - [Permission control vulnerability in the manufacturability design module.](https://agentprime.io/advisories/CVE-2026-41967.md) `CVE-2026-41967` · CVE record: Huawei HarmonyOS · CVSS 5.9 Medium · Not analysed yet · Published 15 May 2026 · Tags: CWE-840 - [Permission control vulnerability in the smart sensing service.](https://agentprime.io/advisories/CVE-2026-41966.md) `CVE-2026-41966` · CVE record: Huawei HarmonyOS · CVSS 5.6 Medium · Not analysed yet · Published 15 May 2026 · Tags: CWE-840 - [Permission control vulnerability in contacts.](https://agentprime.io/advisories/CVE-2026-41961.md) `CVE-2026-41961` · CVE record: Huawei HarmonyOS · CVSS 5.9 Medium · Not analysed yet · Published 15 May 2026 · Tags: CWE-840 - [Permission control vulnerability in the security control module.](https://agentprime.io/advisories/CVE-2026-41971.md) `CVE-2026-41971` · CVE record: Huawei HarmonyOS · CVSS 5.5 Medium · Not analysed yet · Published 15 May 2026 · Tags: CWE-840 - [Use-After-Free (UAF) vulnerability in the web.](https://agentprime.io/advisories/CVE-2026-41965.md) `CVE-2026-41965` · CVE record: Huawei HarmonyOS · CVSS 5.6 Medium · Not analysed yet · Published 15 May 2026 · Tags: CWE-840 - [Business Logic Errors in GitLab](https://agentprime.io/advisories/CVE-2026-1322.md) `CVE-2026-1322` · CVE record: GitLab GitLab · CVSS 6.8 Medium · Not analysed yet · Published 14 May 2026 · Tags: CWE-840 - [IBM Guardium Data Protection is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-1274.md) `CVE-2026-1274` · CVE record: IBM Guardium Data Protection · CVSS 4.9 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-840 - [SourceCodester Pharmacy Product Management System POST Parameter add-sales.php logic error](https://agentprime.io/advisories/CVE-2026-5812.md) `CVE-2026-5812` · CVE record: SourceCodester Pharmacy Product Management System · CVSS 5.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-840 - [SourceCodester Online Food Ordering System POST Parameter Actions.php save_product logic error](https://agentprime.io/advisories/CVE-2026-5811.md) `CVE-2026-5811` · CVE record: SourceCodester Online Food Ordering System · CVSS 5.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-840 - [mickasmt next-saas-stripe-starter Checkout generate-user-stripe.ts generateUserStripe logic error](https://agentprime.io/advisories/CVE-2026-4547.md) `CVE-2026-4547` · CVE record: mickasmt next-saas-stripe-starter · CVSS 5.3 Medium · Not analysed yet · Published 22 Mar 2026 · Tags: CWE-840 - [Race condition vulnerability in the security control module.](https://agentprime.io/advisories/CVE-2026-28550.md) `CVE-2026-28550` · CVE record: Huawei HarmonyOS · CVSS 4.0 Medium · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-840 - [Bdtask Bhojon All-In-One Restaurant Management System Add-to-Cart Submission Endpoint addtocart logic error](https://agentprime.io/advisories/CVE-2026-1600.md) `CVE-2026-1600` · CVE record: Bdtask Bhojon All-In-One Restaurant Management System · CVSS 5.3 Medium · Not analysed yet · Published 29 Jan 2026 · Tags: CWE-840 - [Bdtask Bhojon All-In-One Restaurant Management System Checkout placeorder logic error](https://agentprime.io/advisories/CVE-2026-1599.md) `CVE-2026-1599` · CVE record: Bdtask Bhojon All-In-One Restaurant Management System · CVSS 5.3 Medium · Not analysed yet · Published 29 Jan 2026 · Tags: CWE-840 - [Keycloak services allows the issuance of access and refresh tokens for disabled users](https://agentprime.io/advisories/GHSA-wv3h-x6c4-r867.md) `GHSA-wv3h-x6c4-r867`, `CVE-2025-14559` · Maven `org.keycloak:keycloak-services`: affected `>=26.5.0, <26.5.2 || <26.4.9`, fixed in `26.5.2`, `26.4.9` · CVSS 6.5 Medium · Not analysed yet · Published 21 Jan 2026 · Tags: Broken access control, CWE-840 - [Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution submit_checkout behavioral workflow](https://agentprime.io/advisories/CVE-2025-13239.md) `CVE-2025-13239` · CVE record: Bdtask Isshue Multi Store eCommerce Shopping Cart Solution and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 16 Nov 2025 · Tags: CWE-840, CWE-841 - [Business Logic Errors in GitLab](https://agentprime.io/advisories/CVE-2025-6601.md) `CVE-2025-6601` · CVE record: GitLab GitLab · CVSS 2.7 Low · Not analysed yet · Published 27 Oct 2025 · Tags: CWE-840 - [Vulnerability of improper exception handling in the print module.](https://agentprime.io/advisories/CVE-2025-58289.md) `CVE-2025-58289` · CVE record: Huawei HarmonyOS · CVSS 5.9 Medium · Not analysed yet · Published 11 Oct 2025 · Tags: CWE-840 - [Business Logic Errors in GitLab](https://agentprime.io/advisories/CVE-2025-10868.md) `CVE-2025-10868` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 26 Sept 2025 · Tags: CWE-840 - [linlinjava litemall Business Logic express logic error](https://agentprime.io/advisories/CVE-2025-8991.md) `CVE-2025-8991` · CVE record: linlinjava litemall · CVSS 5.3 Medium · Not analysed yet · Published 15 Aug 2025 · Tags: CWE-840 - [EXTRA_REFERRER resource read vulnerability in the Gallery module.](https://agentprime.io/advisories/CVE-2025-54611.md) `CVE-2025-54611` · CVE record: Huawei HarmonyOS and 1 more · CVSS 7.3 High · Not analysed yet · Published 6 Aug 2025 · Tags: CWE-840 - [Status verification vulnerability in the lock screen module.](https://agentprime.io/advisories/CVE-2025-54606.md) `CVE-2025-54606` · CVE record: Huawei HarmonyOS · CVSS 7.3 High · Not analysed yet · Published 6 Aug 2025 · Tags: CWE-840 - [Business Logic Errors in GitLab](https://agentprime.io/advisories/CVE-2025-2938.md) `CVE-2025-2938` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 26 Jun 2025 · Tags: CWE-840 - [code-projects ATM Banking moneyWithdraw logic error](https://agentprime.io/advisories/CVE-2025-4037.md) `CVE-2025-4037` · CVE record: code-projects ATM Banking · CVSS 4.8 Medium · Not analysed yet · Published 28 Apr 2025 · Tags: CWE-840 - [Business Logic Errors in GitLab](https://agentprime.io/advisories/CVE-2025-1908.md) `CVE-2025-1908` · CVE record: GitLab GitLab · CVSS 7.7 High · Not analysed yet · Published 24 Apr 2025 · Tags: CWE-840 - [TorchServe script references S3 bucket without ensuring ownership or confirming accessibility](https://agentprime.io/advisories/GHSA-xx7c-j7h3-vjcq.md) `GHSA-xx7c-j7h3-vjcq`, `CVE-2024-6577`, `PYSEC-2026-1973` · PyPI `torchserve`: affected `<=0.11.0`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: CWE-840 - [274056675 springboot-openai-chatgpt Number of Question questionCou updateQuestionCou behavioral workflow](https://agentprime.io/advisories/CVE-2025-2323.md) `CVE-2025-2323` · CVE record: 274056675 springboot-openai-chatgpt · CVSS 5.3 Medium · Not analysed yet · Published 15 Mar 2025 · Tags: CWE-840, CWE-841 - [274056675 springboot-openai-chatgpt addData logic error](https://agentprime.io/advisories/CVE-2025-2321.md) `CVE-2025-2321` · CVE record: 274056675 springboot-openai-chatgpt · CVSS 5.3 Medium · Not analysed yet · Published 15 Mar 2025 · Tags: CWE-840 - [Permission management vulnerability in the lock screen module Impact: Successful exploitation of this vulnerability may affect service confidentiality.](https://agentprime.io/advisories/CVE-2024-58046.md) `CVE-2024-58046` · CVE record: Huawei HarmonyOS · CVSS 6.2 Medium · Not analysed yet · Published 4 Mar 2025 · Tags: CWE-840 - [Permission bypass vulnerability in the window module Impact: Successful exploitation of this vulnerability may affect service confidentiality.](https://agentprime.io/advisories/CVE-2024-58043.md) `CVE-2024-58043` · CVE record: Huawei HarmonyOS and 1 more · CVSS 7.3 High · Not analysed yet · Published 4 Mar 2025 · Tags: CWE-840 - [Zoom Workplace Apps - Business Logic Error](https://agentprime.io/advisories/CVE-2024-45424.md) `CVE-2024-45424` · CVE record: Zoom Communications, Inc Zoom Workplace Apps · CVSS 5.3 Medium · Not analysed yet · Published 25 Feb 2025 · Tags: CWE-840 - [Magento Business Logic Error vulnerability](https://agentprime.io/advisories/GHSA-6ff8-jrfg-43hh.md) `GHSA-6ff8-jrfg-43hh`, `CVE-2025-24425`, `PKSA-7r2g-km67-fzjj`, `PKSA-tvs5-ndw3-3gtb` · Packagist `magento/community-edition` and 1 more: affected `<2.4.4-p12 || >=2.4.5-p1, <2.4.5-p11 || >=2.4.6-p1, <2.4.6-p9 || >=2.4.7-beta1, <2.4.7-p4`, fixed in `2.4.4-p12`, `2.4.5-p11`, `2.4.6-p9`, `2.4.7-p4` · CVSS 5.3 Medium · Not analysed yet · Published 11 Feb 2025 · Tags: CWE-840 - [Privilege escalation vulnerability in the Account module Impact: Successful exploitation of this vulnerability may affect service confidentiality.](https://agentprime.io/advisories/CVE-2024-56449.md) `CVE-2024-56449` · CVE record: Huawei HarmonyOS and 1 more · CVSS 6.6 Medium · Not analysed yet · Published 8 Jan 2025 · Tags: CWE-840 - [Service logic error vulnerability in the system service module Impact: Successful exploitation of this vulnerability may affect service integrity.](https://agentprime.io/advisories/CVE-2024-54098.md) `CVE-2024-54098` · CVE record: Huawei HarmonyOS and 1 more · CVSS 8.5 High · Not analysed yet · Published 12 Dec 2024 · Tags: CWE-840 - [Unclaimed S3 Bucket Reference in psf/requests Documentation](https://agentprime.io/advisories/CVE-2024-1682.md) `CVE-2024-1682` · CVE record: psf psf/requests · CVSS 4.3 Medium · Not analysed yet · Published 14 Nov 2024 · Tags: CWE-840 - [Information management vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service confidentiality.](https://agentprime.io/advisories/CVE-2024-51523.md) `CVE-2024-51523` · CVE record: Huawei HarmonyOS · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2024 · Tags: CWE-840 - [CoinGate Plugin Payment callback.php postProcess logic error](https://agentprime.io/advisories/CVE-2018-25104.md) `CVE-2018-25104` · CVE record: CoinGate Plugin · CVSS 5.3 Medium · Not analysed yet · Published 17 Oct 2024 · Tags: CWE-840 Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .