The product requires that an actor should only be able to perform an action once, or to have only one unique action, but the product does not enforce or improperly enforces this restriction.
Volume of CVEs assigned to CWE-837 and their average CVSS base score over time.
Top CVEs that have been assigned this CWE. A single CVE can have multiple CWE assignments, though many have just one.
16 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-42609HIGH Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a business logic vulnerability in the Grav Admin Panel allows a low-privileged user (with only user creation permissions) | May 11, 2026 | 8.1 | 32 | NO | NO |
CVE-2026-44601HIGH Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TROVE-2026-009. | May 7, 2026 | 7.5 | 28 | NO | NO |
CVE-2025-54315HIGH The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness. | Oct 2, 2025 | 7.1 | 24 | NO | NO |
CVE-2025-58135MEDIUM Improper action enforcement in certain Zoom Workplace Clients for Windows may allow an unauthenticated user to conduct a disclosure of information via network access. | Sep 9, 2025 | 6.5 | 23 | NO | NO |
CVE-2024-11716MEDIUM While assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in logic implementation allows an authenticated user to reset it's | Jan 2, 2025 | 5.3 | 21 | NO | NO |
CVE-2025-62784MEDIUM InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions before 1.6.5 contain a vulnerability where any plugin using a GUI with the GuiStorageElement a | Oct 27, 2025 | 5.3 | 20 | NO | NO |
CVE-2025-62782MEDIUM InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions 1.6.3-SNAPSHOT and earlier contain a vulnerability where GUIs using GuiStorageElement can allo | Oct 27, 2025 | 5.3 | 20 | NO | NO |
CVE-2024-11717MEDIUM Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sent to the server as a GET parameter and th | Jan 2, 2025 | 6.3 | 19 | NO | NO |
CVE-2024-4629MEDIUM A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests | Sep 3, 2024 | 6.5 | 19 | NO | NO |
CVE-2023-6759HIGH A vulnerability classified as problematic has been found in Thecosy IceCMS 2.0.1. This affects an unknown part of the file /WebResource/resource of the component Love Handler. The | Dec 13, 2023 | 7.5 | 19 | NO | NO |
Exploit activity across CVEs assigned to this CWE, including CVEs that carry other CWE assignments.
Social posts that mention CVE IDs assigned to this CWE. This is assigned-CVE activity, not mentions of the CWE label itself.
Media articles that mention CVE IDs assigned to this CWE. This is assigned-CVE coverage, not mentions of the CWE label itself.