CWE-670

163 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 1 of them as exploited in the wild.

Critical 12High 69Medium 66Low 16Not scored 0

CVEs per yearBy the year they were published

CVE-2024-32896
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges…
Google · Android
ExploitedHigh8.1

CVE-2026-117859
Keycloak-services: keycloak-services: par single-use bypass via flow restart
Red Hat · Red Hat Build of Keycloak
Medium5.4
CVE-2020-37288
Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops
vyperlang · vyper
Medium6.3
CVE-2026-79608
x86/AMD: ineffectual Zenbleed workaround
Xen · Xen
Critical9.8
CVE-2026-109722
JIT miscompilation in the JavaScript Engine: JIT component
Mozilla · Firefox
High8.1
CVE-2026-107284
AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check
AsyncHttpClient · async-http-client
Low3.7
CVE-2026-106586
In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a different…
OpenBSD · OpenSSH
Low2.5
CVE-2026-102110
Missing authentication on a Kiteworks appliance setup function
Kiteworks · Core
Medium5.9
CVE-2026-102124
Kiteworks Core Missing Authentication for Critical Function
Kiteworks · Core
Medium6.5
CVE-2026-98164
KVM: x86/mmu: Check write tracking in all address spaces
Linux · Linux
High7.1
CVE-2026-96760
Authlib library contains a signature‑verification bypass vulnerability
Authlib · Authlib
Critical9.8