Skip to content
Noroxi

CWE-670 · 146 records

Always-Incorrect Control Flow Implementation

CVEs in this class

146 records

  • CVE-2024-32896
    62This week

    there is a possible way to bypass due to a logic error in the code.

    HighCVSS 7.8KEVWeaponizedEPSS 2%

    google · androidJun 13, 2024

  • CVE-2019-17192
    40Plan

    The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a

    CriticalCVSS 9.8No exploitEPSS 2%

    signal · private messengerOct 4, 2019

  • CVE-2020-1914
    40Plan

    A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7f

    CriticalCVSS 9.8No exploitEPSS 2%

    facebook · hermesOct 8, 2020

  • CVE-2020-17466
    39Monitor

    Turcom TRCwifiZone through 2020-08-10 allows authentication bypass by visiting manage/control.php and ignoring 302 Redirect responses.

    CriticalCVSS 9.8No exploitEPSS 1%

    turcom · trcwifizoneAug 11, 2020

  • CVE-2022-21679
    39Monitor

    Authorization Policy bypass in Istio

    CriticalCVSS 9.8No exploitEPSS 1%

    istio · istioJan 19, 2022

  • CVE-2021-41153
    39Monitor

    Specification non-compliance in JUMPI

    CriticalCVSS 9.8No exploitEPSS 1%

    evm project · evmOct 18, 2021

  • CVE-2025-43359
    39Monitor

    A logic issue was addressed with improved state management.

    CriticalCVSS 9.8No exploitEPSS 0%

    apple · ipadosSep 15, 2025

  • CVE-2023-23623
    39Monitor

    Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron

    CriticalCVSS 9.8No exploitEPSS 0%

    electronjs · electronSep 6, 2023

  • CVE-2022-2993
    39Monitor

    bt: host: Wrong key validation check

    CriticalCVSS 9.8No exploitEPSS 0%

    zephyrproject · zephyrDec 9, 2022

  • CVE-2022-25745
    39Monitor

    Always Incorrect Control Flow Implementation in MODEM

    CriticalCVSS 9.8No exploitEPSS 0%

    qualcomm · mdm9205 firmwareApr 13, 2023

  • GHSA-54gx-3cgr-7mfm
    38Monitor

    Cosmos EVM: incorrect state handling during nested EVM execution paths

    CriticalCVSS 9.5No exploit

    Go · github.com/cosmos/evmMar 11, 2026

  • CVE-2020-9425
    36Monitor

    An issue was discovered in includes/head.inc.php in rConfig before 3.9.4.

    HighCVSS 7.5Proof of conceptEPSS 19%

    rconfig · rconfigMar 20, 2020

  • CVE-2026-55276
    36Monitor

    Apache Tomcat: Logged effective web.xml is incomplete

    CriticalCVSS 9.1No exploitEPSS 0%

    apache · tomcatJun 29, 2026

  • CVE-2025-29312
    36Monitor

    An issue in onos v2.7.0 allows attackers to trigger unexpected behavior within a device connected to a legacy switch via changing the link t

    CriticalCVSS 9.1No exploitEPSS 0%

    opennetworking · onosMar 24, 2025

  • CVE-2026-16392
    36Monitor

    JIT miscompilation in the JavaScript Engine: JIT component

    CriticalCVSS 9.1No exploitEPSS 0%

    mozilla · firefoxJul 21, 2026

  • CVE-2018-16766
    35Monitor

    In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or poss

    HighCVSS 8.8No exploitEPSS 1%

    webassembly virtual machine project · webassembly virtual machineSep 10, 2018

  • CVE-2023-20558
    35Monitor

    Insufficient control flow management in AmdCpmOemSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to

    HighCVSS 8.8No exploitEPSS 0%

    amd · ryzen 7 5700g firmwareApr 2, 2023

  • CVE-2026-33011
    34Monitor

    Nest Fastify HEAD Request Middleware Bypass

    HighCVSS 8.7No exploitEPSS 0%

    nestjs · nestMar 20, 2026

  • CVE-2026-1874
    34Monitor

    Denial-of-Service (DoS) vulnerability in Ethernet function of MELSEC iQ-F Series EtherNet/IP module and Ethernet module

    HighCVSS 8.7No exploitEPSS 0%

    mitsubishielectric · melsec iq-f fx5-eip firmwareMar 3, 2026

  • CVE-2024-5659
    33Monitor

    Rockwell Automation Multicast Request Causes major nonrecoverable fault on Select Controllers

    HighCVSS 8.3No exploitEPSS 0%

    rockwellautomation · controllogix 5580 firmwareJun 14, 2024

  • CVE-2023-1668
    32Monitor

    A flaw was found in openvswitch (OVS).

    HighCVSS 8.2No exploitEPSS 1%

    cloudbase · open vswitchApr 10, 2023

  • CVE-2024-38365
    32Monitor

    btcd did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality

    HighCVSS 8.1No exploitEPSS 1%

    btcd project · btcdOct 11, 2024

  • CVE-2024-52811
    32Monitor

    Acks not validated before logged to qlog leads to buffer overflow in ngtcp2

    HighCVSS 8.2No exploitEPSS 0%

    ngtcp2 · ngtcp2Nov 25, 2024

  • CVE-2025-49091
    32Monitor

    KDE Konsole before 25.04.2 allows remote code execution in a certain scenario.

    HighCVSS 8.2Proof of conceptEPSS 0%

    kde · konsoleJun 10, 2025

  • CVE-2023-0400
    32Monitor

    The protection bypass vulnerability in DLP for Windows 11.9.x is addressed in version 11.10.0.

    HighCVSS 8.2Proof of conceptEPSS 0%

    trellix · data loss preventionFeb 2, 2023

All vulnerability classes