The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.
Volume of CVEs assigned to CWE-841 and their average CVSS base score over time.
Top CVEs that have been assigned this CWE. A single CVE can have multiple CWE assignments, though many have just one.
55 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-42246HIGH Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-middle attacker can cau | May 9, 2026 | 7.4 | 33 | NO | NO |
CVE-2026-48505HIGH Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, a flaw in the handling of recovery codes for app-based mul | Jun 22, 2026 | 7.4 | 32 | NO | NO |
CVE-2026-43937HIGH YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5, Any admin OnPost… handler executes its side effects before the ResultFilterAttribute rewrites the response to a | May 12, 2026 | 8.8 | 31 | NO | NO |
CVE-2026-34582CRITICAL Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished message being receive | Apr 7, 2026 | 9.1 | 31 | NO | NO |
CVE-2026-3130CRITICAL Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is | Mar 3, 2026 | 9.8 | 31 | NO | NO |
CVE-2026-43974HIGH Unexpected Status Code or Return Value vulnerability in ninenines gun (gun_http module) allows a malicious HTTP server to force the client into raw protocol mode via an unsolicited | Jun 8, 2026 | 8.7 | 30 | NO | NO |
CVE-2026-30783CRITICAL A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Client signaling, API sync loop, config management modules) al | Mar 5, 2026 | 9.8 | 30 | NO | NO |
CVE-2023-4181CRITICAL A vulnerability, which was classified as critical, has been found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected by this issue is some unknown | Aug 6, 2023 | 9.8 | 28 | NO | NO |
CVE-2026-57536MEDIUM Our payment integration with Mollie did not properly validate payment
status responses. An attacker could use a successful payment status
response from one payment and supply it | Jun 25, 2026 | 6.3 | 27 | NO | NO |
CVE-2026-13223MEDIUM Our payment integration with Computop-based payment methods did not
properly validate payment status responses. An attacker could use a
successful payment status response from on | Jun 25, 2026 | 6.3 | 27 | NO | NO |
Exploit activity across CVEs assigned to this CWE, including CVEs that carry other CWE assignments.
Social posts that mention CVE IDs assigned to this CWE. This is assigned-CVE activity, not mentions of the CWE label itself.
Media articles that mention CVE IDs assigned to this CWE. This is assigned-CVE coverage, not mentions of the CWE label itself.