CWE-837
20 published CVEs are weaknesses of this kind, as the records or NVD name it.
- 20Published CVEs20 of them scored
- 6Last 12 monthspublished in the last year
- 0Critical3 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-112285
Thelia before 3.1.5 and 3.2.4 Coupon Usage Limit Bypass via Pay-Later Orders
Thelia · Thelia
Medium5.3 - CVE-2026-105850
Payload: Order confirmation validation issue in Payload Ecommerce
payloadcms · payload
High8.8 - CVE-2026-86198
PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket
pmmp · PocketMine-MP
Low2.3 - CVE-2026-45734
MyBB: Default CAPTCHA missing invalidation
mybb · mybb
Medium5.3 - CVE-2026-42609
Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic
getgrav · grav
High8.1 - CVE-2026-44601
Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TROVE-2026-009.
torproject · Tor
Low3.7 - CVE-2025-62784
InventoryGui allows item duplication in GUIs which use GuiStorageElement
Phoenix616 · InventoryGui
Medium5.3 - CVE-2025-62783
InventoryGui affected by item duplication in GUIs which use GuiStorageElement
Phoenix616 · InventoryGui
Medium5.0 - CVE-2025-62782
InventoryGUI vulnerable to item duplication via Bundle items when using GuiStorageElement
Phoenix616 · InventoryGui
Medium5.9 - CVE-2025-54315
The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness.
Matrix · Matrix specification
High7.1