# CWE-841. Every Advisory and CVE whose sources give the weakness CWE-841, newest first. ## Records, newest first - [chenyme grok2api STT Billing voice_ws_handler.go behavioral workflow](https://agentprime.io/advisories/CVE-2026-123788.md) `CVE-2026-123788` · CVE record: chenyme grok2api · CVSS 5.3 Medium · Not analysed yet · Published 6 Nov 2026 · Tags: CWE-840, CWE-841 - [Germanized for WooCommerce <= 4.1.4 - Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Change](https://agentprime.io/advisories/CVE-2026-109231.md) `CVE-2026-109231` · CVE record: vendidero Germanized for WooCommerce · CVSS 4.3 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: CWE-841 - [OpenCart through 4.1.0.4 Payment Bypass via Free Checkout Reward Points](https://agentprime.io/advisories/CVE-2026-119558.md) `CVE-2026-119558` · CVE record: OpenCart OpenCart · CVSS 2.3 Low · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-841 - [subhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflow](https://agentprime.io/advisories/CVE-2026-115248.md) `CVE-2026-115248` · CVE record: subhajitkhan online-clinic-management-system · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-840, CWE-841 - [Google Chrome: Inappropriate implementation in Core in Google Chrome on on Mac prior to 156.0.8078.47…](https://agentprime.io/advisories/CVE-2026-113165.md) `CVE-2026-113165` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-841 - [Google Chrome: Inappropriate implementation in Core in Google Chrome prior to 156.0.8078.47 allowed a…](https://agentprime.io/advisories/CVE-2026-113308.md) `CVE-2026-113308` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-841 - [Google Chrome: Inappropriate implementation in API in Google Chrome prior to 156.0.8078.47 allowed a…](https://agentprime.io/advisories/CVE-2026-113094.md) `CVE-2026-113094` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-841 - [FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts](https://agentprime.io/advisories/CVE-2026-103977.md) `CVE-2026-103977` · CVE record: error311 FileRise · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass, CWE-841 - [Windows DNS Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-70079.md) `CVE-2026-70079` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-841 - [deepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflow](https://agentprime.io/advisories/CVE-2026-108789.md) `CVE-2026-108789` · CVE record: deepseek-ai deepseek-harness · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-840, CWE-841 - [Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-19878.md) `CVE-2026-19878` · CVE record: IBM Security Verify Access and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-841 - [Gitea fork workflow job revival through later approval](https://agentprime.io/advisories/CVE-2026-104626.md) `CVE-2026-104626` · CVE record: Gitea Gitea · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-841 - [vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)](https://agentprime.io/advisories/GHSA-r4fx-v8hh-22mv.md) `GHSA-r4fx-v8hh-22mv`, `CVE-2026-92942` · npm `vm2`: affected `<3.11.7`, fixed in `3.11.7` · CVSS 8.7 High · Not analysed yet · Published 5 Oct 2026 · Tags: Denial of service, CWE-841 - [Google Chrome: Inappropriate implementation in PlatformIntegration in Google Chrome on on Windows prior…](https://agentprime.io/advisories/CVE-2026-95385.md) `CVE-2026-95385` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-841 - [Google Chrome: Inappropriate implementation in NFC in Google Chrome prior to 154.0.8037.57 allowed a…](https://agentprime.io/advisories/CVE-2026-95370.md) `CVE-2026-95370` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-841 - [Google Chrome: Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a…](https://agentprime.io/advisories/CVE-2026-95369.md) `CVE-2026-95369` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-841 - [Klever-Go: Zombie-order theft: \`Buy\` missing \`IsClaimed\` guard in native marketplace](https://agentprime.io/advisories/GHSA-26r5-4mm2-px5c.md) `GHSA-26r5-4mm2-px5c`, `CVE-2026-82406`, `GO-2026-6584` · Go `github.com/klever-io/klever-go`: affected `<1.7.20`, fixed in `1.7.20` · CVSS 7.1 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-841 - [NVIDIA Infrastructure Controller: NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker…](https://agentprime.io/advisories/CVE-2026-65126.md) `CVE-2026-65126` · CVE record: NVIDIA Infrastructure Controller · CVSS 5.0 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-841 - [HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler](https://agentprime.io/advisories/CVE-2026-48974.md) `CVE-2026-48974` · CVE record: sysadminsmedia homebox · CVSS 5.4 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control, CWE-841 - [strongSwan: libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2…](https://agentprime.io/advisories/CVE-2026-78135.md) `CVE-2026-78135` · CVE record: strongSwan strongSwan · CVSS 5.6 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-841 - [Google Chrome: Inappropriate implementation in Downloads in Google Chrome on on Android prior to…](https://agentprime.io/advisories/CVE-2026-87503.md) `CVE-2026-87503` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-841 - [SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS](https://agentprime.io/advisories/CVE-2026-67279.md) `CVE-2026-67279` · CVE record: Mikrotik RouterOS · CVSS 6.9 Medium · Critical (KEV) · In CISA KEV · Not analysed yet · Published 5 Sept 2026 · Tags: CWE-841 - [macrozheng mall Payment Status Endpoint paySuccess behavioral workflow](https://agentprime.io/advisories/CVE-2026-82423.md) `CVE-2026-82423` · CVE record: macrozheng mall · CVSS 5.3 Medium · Not analysed yet · Published 29 Aug 2026 · Tags: CWE-840, CWE-841 - [klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits](https://agentprime.io/advisories/GHSA-v358-wf77-39xv.md) `GHSA-v358-wf77-39xv`, `CVE-2026-55763`, `GO-2026-6323` · Go `github.com/klever-io/klever-go`: affected `<1.7.19-rc4`, fixed in `1.7.19-rc4` · CVSS 8.7 High · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-841 - [Dimension Log Server Configuration Lock Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-78103.md) `CVE-2026-78103` · CVE record: WatchGuard Dimension · CVSS 5.1 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-841 - [Dimension Business Logic Flaw Allows Chained Backend Object Operations](https://agentprime.io/advisories/CVE-2026-78618.md) `CVE-2026-78618` · CVE record: WatchGuard Dimension · CVSS 6.9 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Broken access control, CWE-841 - [Weblate: Unverified REST API email changes](https://agentprime.io/advisories/CVE-2026-77508.md) `CVE-2026-77508` · CVE record: WeblateOrg weblate · CVSS 3.5 Low · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-302, CWE-841 - [vivo Kids Mode: A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password…](https://agentprime.io/advisories/CVE-2026-15365.md) `CVE-2026-15365` · CVE record: vivo Kids Mode · CVSS 2.4 Low · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-841 - [Kimai before 2.63.0 Team Membership Removal via API](https://agentprime.io/advisories/CVE-2026-80195.md) `CVE-2026-80195` · CVE record: kimai kimai · CVSS 8.7 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-841 - [Google Chrome: Improper enforcement of behavioral workflow in Media in Google Chrome prior to…](https://agentprime.io/advisories/CVE-2026-79083.md) `CVE-2026-79083` · CVE record: Google Chrome · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-841 - [Webkul Bagisto store behavioral workflow](https://agentprime.io/advisories/CVE-2026-75081.md) `CVE-2026-75081` · CVE record: Webkul Bagisto · CVSS 5.3 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-840, CWE-841 - [Webkul Bagisto RMA State Validation update-status behavioral workflow](https://agentprime.io/advisories/CVE-2026-19993.md) `CVE-2026-19993` · CVE record: Webkul Bagisto · CVSS 5.3 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-840, CWE-841 - [WonderTrader Pending Order TraderAdapter.h \_undone_qty behavioral workflow](https://agentprime.io/advisories/CVE-2026-19213.md) `CVE-2026-19213` · CVE record: WonderTrader · CVSS 5.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: CWE-840, CWE-841 - [WonderTrader TraderDD.cpp queryTrades behavioral workflow](https://agentprime.io/advisories/CVE-2026-19208.md) `CVE-2026-19208` · CVE record: WonderTrader · CVSS 6.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: CWE-840, CWE-841 - [WonderTrader Internal Limit Order Book Cache MatchEngine.cpp update_lob behavioral workflow](https://agentprime.io/advisories/CVE-2026-19037.md) `CVE-2026-19037` · CVE record: WonderTrader · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-840, CWE-841 - [Insufficient validation of payment status in pretix-girosolution](https://agentprime.io/advisories/CVE-2026-18029.md) `CVE-2026-18029` · CVE record: pretix GmbH pretix-girosolution · CVSS 6.3 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: CWE-841 - [Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption](https://agentprime.io/advisories/CVE-2026-16103.md) `CVE-2026-16103` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-305, CWE-841 - [Sylius: Cart FormComponent allows modification or deletion of an already-completed order](https://agentprime.io/advisories/GHSA-5597-7rmh-97q5.md) `GHSA-5597-7rmh-97q5`, `CVE-2026-53637`, `PKSA-kjm4-5dkr-g6q7` · Packagist `sylius/sylius`: affected `>=2.0.0, <2.0.18 || >=2.1.0, <2.1.15 || >=2.2.0, <2.2.6`, fixed in `2.0.18`, `2.1.15`, `2.2.6` · CVSS 6.5 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: CWE-672, CWE-841 - [Vulnerabilities found in Watson Data Intelligence](https://agentprime.io/advisories/CVE-2025-36333.md) `CVE-2025-36333` · CVE record: IBM watsonx.data intelligence · CVSS 4.3 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-841 - [Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission](https://agentprime.io/advisories/GHSA-mc5j-f6wx-h9qh.md) `GHSA-mc5j-f6wx-h9qh`, `CVE-2026-48505`, `PKSA-nsry-m1tp-jzr9` · Packagist `filament/filament`: affected `>=4.0.0, <4.11.5 || >=5.0.0, <5.6.5`, fixed in `4.11.5`, `5.6.5` · CVSS 7.4 High · Not analysed yet · Published 25 Jun 2026 · Tags: Race condition, CWE-841 - [Insufficient validation of payment status in pretix-mollie](https://agentprime.io/advisories/CVE-2026-57536.md) `CVE-2026-57536` · CVE record: pretix pretix-mollie · CVSS 6.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-841 - [Insufficient validation of payment status in pretix-oppwa](https://agentprime.io/advisories/CVE-2026-13222.md) `CVE-2026-13222` · CVE record: pretix pretix-oppwa · CVSS 6.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-841 - [Insufficient validation of payment status in pretix-computop](https://agentprime.io/advisories/CVE-2026-13223.md) `CVE-2026-13223` · CVE record: pretix pretix-computop · CVSS 6.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-841 - [Nimiq light-blockchain: Light blockchain rebranch issue](https://agentprime.io/advisories/CVE-2026-46540.md) `CVE-2026-46540` · CVE record: nimiq core-rs-albatross · CVSS 6.5 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-841 - [gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM](https://agentprime.io/advisories/GHSA-2j82-37xg-f9wp.md) `GHSA-2j82-37xg-f9wp`, `CVE-2026-43974`, `EEF-CVE-2026-43974` · Hex `gun`: affected `>=2.0.0, <2.4.0`, fixed in `2.4.0` · CVSS 8.7 High · Not analysed yet · Published 8 Jun 2026 · Tags: CWE-841 - [AutoGPT: Credit system bypassed via direct block execution in POST /api/blocks/{block_id}/execute](https://agentprime.io/advisories/CVE-2026-45023.md) `CVE-2026-45023` · CVE record: Significant-Gravitas AutoGPT · CVSS 5.4 Medium · Not analysed yet · Published 28 May 2026 · Tags: Denial of service, CWE-841 - [Devolutions Server: Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval…](https://agentprime.io/advisories/CVE-2026-8477.md) `CVE-2026-8477` · CVE record: Devolutions Server · CVSS 2.7 Low · Not analysed yet · Published 22 May 2026 · Tags: CWE-841 - [Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection](https://agentprime.io/advisories/GHSA-qx5f-ghc2-7g5c.md) `GHSA-qx5f-ghc2-7g5c`, `CVE-2026-42303`, `PYSEC-2026-2471` · PyPI `ethyca-fides`: affected `>=2.75.0, <2.83.2`, fixed in `2.83.2` · CVSS 6.1 Medium · Not analysed yet · Published 5 May 2026 · Tags: Authentication bypass, CWE-841 - [YAFNET: Pre-Handler Authorization Bypass on Admin Pages Enables Blind SQL Execution via \`/Admin/RunSql\`](https://agentprime.io/advisories/GHSA-xhw7-j96h-c3g5.md) `GHSA-xhw7-j96h-c3g5`, `CVE-2026-43937` · NuGet `YAFNET.Core`: affected `<4.0.5`, fixed in `4.0.5` · CVSS 8.8 High · Not analysed yet · Published 5 May 2026 · Tags: SQL injection, CWE-841 - [net-imap vulnerable to STARTTLS stripping via invalid response timing](https://agentprime.io/advisories/GHSA-vcgp-9326-pqcp.md) `GHSA-vcgp-9326-pqcp`, `CVE-2026-42246` · RubyGems `net-imap`: affected `<0.3.10 || >=0.4.0, <0.4.24 || >=0.5.0, <0.5.14 || >=0.6.0, <0.6.4`, fixed in `0.3.10`, `0.4.24`, `0.5.14`, `0.6.4` · CVSS 7.6 High · Not analysed yet · Published 4 May 2026 · Tags: CWE-325, CWE-392, CWE-393, CWE-636 - [Mastodon: Insufficient verification of email addresses](https://agentprime.io/advisories/CVE-2026-41259.md) `CVE-2026-41259` · CVE record: mastodon mastodon · CVSS 8.2 High · Not analysed yet · Published 23 Apr 2026 · Tags: CWE-841 - [Botan has a TLS 1.3 certificate authentication bypass](https://agentprime.io/advisories/CVE-2026-34582.md) `CVE-2026-34582` · CVE record: randombit botan · CVSS 8.7 High · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-166, CWE-841 - [A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-sales.php file.](https://agentprime.io/advisories/CVE-2026-30574.md) `CVE-2026-30574` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Mar 2026 · Tags: CWE-841 - [IBM Aspera Console Denial of Service](https://agentprime.io/advisories/CVE-2025-13459.md) `CVE-2025-13459` · CVE record: IBM Aspera Console · CVSS 2.7 Low · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-841 - [RustDesk Client Can Orphan API Channel to Ignore All Admin Commands and ACL Policies](https://agentprime.io/advisories/CVE-2026-30783.md) `CVE-2026-30783` · CVE record: rustdesk-client RustDesk Client · CVSS 4.8 Medium · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-602, CWE-841 - [Devolutions Server: Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier…](https://agentprime.io/advisories/CVE-2026-3130.md) `CVE-2026-3130` · CVE record: Devolutions Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-841 - [Chamilo: Friend Request Workflow Bypass - Unauthorized Friend Addition and ID Validation Bypass](https://agentprime.io/advisories/CVE-2025-52469.md) `CVE-2025-52469` · CVE record: chamilo chamilo-lms · CVSS 7.1 High · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-841 - [Open eClass Business Logic Flaw Allows Students to Mark Attendance in Expired Activities](https://agentprime.io/advisories/CVE-2026-24774.md) `CVE-2026-24774` · CVE record: gunet openeclass · CVSS 4.3 Medium · Not analysed yet · Published 3 Feb 2026 · Tags: CWE-841 - [Resource allocation without limits in OpenVPN](https://agentprime.io/advisories/CVE-2025-13751.md) `CVE-2025-13751` · CVE record: OpenVPN OpenVPN · CVSS 1.3 Low · Not analysed yet · Published 3 Dec 2025 · Tags: Denial of service, CWE-775, CWE-841 - [Business Logic Error in Seneka Software's Onaylarım](https://agentprime.io/advisories/CVE-2025-13129.md) `CVE-2025-13129` · CVE record: Seneka Software Hardware Information Technology Trade Contracting and Industry Ltd. Co. Onaylarım · CVSS 4.3 Medium · Not analysed yet · Published 1 Dec 2025 · Tags: CWE-841 Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .