CWE-841.

Germanized for WooCommerce <= 4.1.4 - Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Change

• vendidero Germanized for WooCommerce
• CWE-841

OpenCart through 4.1.0.4 Payment Bypass via Free Checkout Reward Points

• OpenCart
• CWE-841

subhajitkhan online-clinic-management-system Booking patappointtime.php behavioral workflow

• subhajitkhan online-clinic-management-system
• CWE-840
• CWE-841

Google Chrome: Inappropriate implementation in Core in Google Chrome on on Mac prior to 156.0.8078.47…

• Google Chrome
• CWE-841

Google Chrome: Inappropriate implementation in Core in Google Chrome prior to 156.0.8078.47 allowed a…

• Google Chrome
• CWE-841

Google Chrome: Inappropriate implementation in API in Google Chrome prior to 156.0.8078.47 allowed a…

• Google Chrome
• CWE-841

FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts

• error311 FileRise
• Authentication bypass
• CWE-841

Windows DNS Denial of Service Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• CWE-841

deepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflow

• deepseek-ai deepseek-harness
• CWE-840
• CWE-841

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

• IBM Security Verify Access
• IBM Verify Identity Access
• CWE-841

Gitea fork workflow job revival through later approval

• Gitea
• CWE-841

vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)

• Denial of service
• CWE-841

<3.11.7 · fixed in 3.11.7

Google Chrome: Inappropriate implementation in PlatformIntegration in Google Chrome on on Windows prior…

• Google Chrome
• CWE-841

Google Chrome: Inappropriate implementation in NFC in Google Chrome prior to 154.0.8037.57 allowed a…

• Google Chrome
• CWE-841

Google Chrome: Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a…

• Google Chrome
• CWE-841

Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace

• CWE-841

<1.7.20 · fixed in 1.7.20

NVIDIA Infrastructure Controller: NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker…

• NVIDIA Infrastructure Controller
• CWE-841

HomeBox: Forced Group Membership Without Consent in Homebox AddMember Handler

• sysadminsmedia homebox
• Broken access control
• CWE-841

strongSwan: libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2…

• strongSwan
• CWE-841

Google Chrome: Inappropriate implementation in Downloads in Google Chrome on on Android prior to…

• Google Chrome
• CWE-841

SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS

• Mikrotik RouterOS
• CWE-841

macrozheng mall Payment Status Endpoint paySuccess behavioral workflow

• macrozheng mall
• CWE-840
• CWE-841

klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits

• CWE-841

<1.7.19-rc4 · fixed in 1.7.19-rc4

Dimension Log Server Configuration Lock Bypass Vulnerability

• WatchGuard Dimension
• CWE-841

Dimension Business Logic Flaw Allows Chained Backend Object Operations

• WatchGuard Dimension
• Broken access control
• CWE-841

Weblate: Unverified REST API email changes

• weblate
• CWE-302
• CWE-841

vivo Kids Mode: A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password…

• vivo Kids Mode
• CWE-841

Kimai before 2.63.0 Team Membership Removal via API

• kimai
• CWE-841

Google Chrome: Improper enforcement of behavioral workflow in Media in Google Chrome prior to…

• Google Chrome
• CWE-841

Webkul Bagisto store behavioral workflow

• Webkul Bagisto
• CWE-840
• CWE-841

Webkul Bagisto RMA State Validation update-status behavioral workflow

• Webkul Bagisto
• CWE-840
• CWE-841

WonderTrader Pending Order TraderAdapter.h _undone_qty behavioral workflow

• WonderTrader
• CWE-840
• CWE-841

WonderTrader TraderDD.cpp queryTrades behavioral workflow

• WonderTrader
• CWE-840
• CWE-841

WonderTrader Internal Limit Order Book Cache MatchEngine.cpp update_lob behavioral workflow

• WonderTrader
• CWE-840
• CWE-841

Insufficient validation of payment status in pretix-girosolution

• pretix GmbH pretix-girosolution
• CWE-841

Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption

• Red Hat Build of Keycloak
• Red Hat Data Grid 8
• CWE-305
• CWE-841

Sylius: Cart FormComponent allows modification or deletion of an already-completed order

• CWE-672
• CWE-841

>=2.0.0, <2.0.18 || >=2.1.0, <2.1.15 || >=2.2.0, <2.2.6 · fixed in 2.0.18, 2.1.15, 2.2.6

Vulnerabilities found in Watson Data Intelligence

• IBM watsonx.data intelligence
• CWE-841

Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission

• Race condition
• CWE-841

>=4.0.0, <4.11.5 || >=5.0.0, <5.6.5 · fixed in 4.11.5, 5.6.5

Insufficient validation of payment status in pretix-mollie

• pretix-mollie
• CWE-841

Insufficient validation of payment status in pretix-oppwa

• pretix-oppwa
• CWE-841

Insufficient validation of payment status in pretix-computop

• pretix-computop
• CWE-841

Nimiq light-blockchain: Light blockchain rebranch issue

• nimiq core-rs-albatross
• CWE-841

gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM

• CWE-841

>=2.0.0, <2.4.0 · fixed in 2.4.0

AutoGPT: Credit system bypassed via direct block execution in POST /api/blocks/{block_id}/execute

• Significant-Gravitas AutoGPT
• Denial of service
• CWE-841

Devolutions Server: Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval…

• Devolutions Server
• CWE-841

Ethyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection

• Authentication bypass
• CWE-841

>=2.75.0, <2.83.2 · fixed in 2.83.2

YAFNET: Pre-Handler Authorization Bypass on Admin Pages Enables Blind SQL Execution via `/Admin/RunSql`

• SQL injection
• CWE-841

<4.0.5 · fixed in 4.0.5

net-imap vulnerable to STARTTLS stripping via invalid response timing

• CWE-325
• CWE-392

<0.3.10 || >=0.4.0, <0.4.24 || >=0.5.0, <0.5.14 || >=0.6.0, <0.6.4 · fixed in 0.3.10, 0.4.24, 0.5.14, 0.6.4

Mastodon: Insufficient verification of email addresses

• mastodon
• CWE-841

Botan has a TLS 1.3 certificate authentication bypass

• randombit botan
• CWE-166
• CWE-841

A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-sales.php file.

• CWE-841

IBM Aspera Console Denial of Service

• IBM Aspera Console
• CWE-841

RustDesk Client Can Orphan API Channel to Ignore All Admin Commands and ACL Policies

• rustdesk-client RustDesk Client
• CWE-602
• CWE-841

Devolutions Server: Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier…

• Devolutions Server
• CWE-841

Chamilo: Friend Request Workflow Bypass - Unauthorized Friend Addition and ID Validation Bypass

• chamilo-lms
• CWE-841

Open eClass Business Logic Flaw Allows Students to Mark Attendance in Expired Activities

• gunet openeclass
• CWE-841

Resource allocation without limits in OpenVPN

• OpenVPN
• Denial of service
• CWE-775

Business Logic Error in Seneka Software's Onaylarım

• Seneka Software Hardware Information Technology Trade Contracting and Industry Ltd. Co. Onaylarım
• CWE-841

Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution submit_checkout behavioral workflow

• Bdtask Isshue Multi Store eCommerce Shopping Cart Solution
• CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution
• CWE-840
• CWE-841