Weakness (CWE)
CWE-691: Insufficient Control Flow Management
The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.
Source: MITRE CWE-691
42 results · Feed
-
Critical 9.9CVE-2026-115893 Public exploit
Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. …
-
Low 3.7
Vyper 0.1.0b10 before 0.2.3 Invalid Jump Destination via Return in Nested Loops
Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal function called two or more internal calls deep, producing an invalid jump destination (stack underflow). Affected contracts revert such calls un…
-
High 7.4
Cisco Meraki Security Hardening Release: October 2026 Insufficient Control Flow Management Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internal…
-
High 8.6
Cisco IOS XR Software Security Hardening Release: September 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple int…
-
High 7.5
An issue was discovered in openRISC OR1200 commit 83ac6b. An inaccurate update of program counter (PC) values when SPR …
-
High 8.8
Insufficient control flow management in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leve…
-
High 8.6
Cisco IOS XE Software Security Hardening Release
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple inter…
-
High 8.8CVE-2026-43503 Public exploit
net: skbuff: propagate shared-frag marker through frag-transfer helpers
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail to propagate the SKBFL_SHARED_FRAG bit in skb_shi…
-
Medium 5.5
Foxit PDF Editor/Reader Infinite Loop Denial-of-Service Vulnerability
Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI freeze and denial of service.
-
High 7.4
Insufficient control flow management for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.160 …
-
High 7.8
Insufficient control flow management in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before versi…
-
High 7.2
Insufficient control flow management in the Alias Checking Trusted Module (ACTM) firmware for some Intel(R) Xeon(R) pro…
-
High 7.8
Insufficient control flow management in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before versi…
-
Medium 6.5
Zoom Clients for iOS - Insufficient Control Flow Management
Insufficient control flow management in certain Zoom Clients for iOS before version 6.4.5 may allow an unauthenticated user to conduct a disclosure of information via network access.
-
Low 2.9
Vyper's `slice()` may elide side-effects when output length is 0
Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, the `slice()` builtin can elide side effects when the output length is 0, and the source bytestring is a builtin (`msg.data` or `<address>.c…
-
Low 2.9
Vyper's `concat()` builtin may elide side-effects for zero-length arguments
Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, `concat()` may skip evaluation of side effects when the length of an argument is zero. This is due to a fastpath in the implementation which…
-
Medium 5.7
Insufficient control flow management for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow a …
-
High 7.2
Insufficient control flow management in the Alias Checking Trusted Module for some Intel(R) Xeon(R) 6 processor E-Cores…
-
Medium 6.5
An issue was discovered in Open5GS v2.7.2. When a UE switches between two gNBs and sends a handover request at a specif…
-
Medium 5.9
Insufficient control flow management in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow i…
-
Medium 6.8
Insufficient control flow management in some Intel(R) VROC software before version 8.6.0.3001 may allow an authenticate…
-
Low 3.8
Insufficient control flow management in UEFI firmware for some Intel(R) Xeon(R) Processors may allow an authenticated u…
-
High 7.1
Insufficient control flow management in some Intel(R) TDX module software before version 1.5.05.46.698 may allow a priv…
-
Medium 6.5
Insufficient control flow management for some Intel(R) Xeon Processors may allow an authenticated user to potentially e…
-
Low 3.5
Evmos is missing precompile checks
Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. Preliminary checks on actions computed by the clawback vesting accounts are performed in the ante handler. Evmos core, implements two different ante handlers: one for Cosmos transactions a…
-
High 7.2
Insufficient control flow management in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageabi…
-
Critical 9.8
Insufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass co…
-
Medium 6.9
Insufficient control flow management in firmware for some Intel(R) Optane(TM) SSD products may allow a privileged user …
-
Low 3.3
Insufficient control flow management for some Intel Unison software may allow an authenticated user to potentially enab…
-
Medium 5.3
Insufficient Control Flow Management in RDT400 in SICK APU allows an unprivileged remote attacker to potentially enable…
-
Medium 4.1
Discourse-Jira could make SSRF attack by setting Jira URL to an arbitrary location
Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically. An administrator user can make an SSRF attack by setting the Jira URL to an arbitrary location and enabling the `discourse_jira_verb…
-
Medium 5.5
Insufficient control flow management in the Hyperscan Library maintained by Intel(R) before version 5.4.1 may allow an …
-
Medium 4.1
Insufficient control flow management in the BIOS firmware for some Intel(R) Processors may allow a privileged user to p…
-
Medium 4.7
Insufficient control flow management in the Intel(R) IPP Cryptography software before version 2021.6 may allow an unaut…
-
Medium 4.7
Insufficient control flow management for the Intel(R) IPP Cryptography software before version 2021.6 may allow an auth…
-
Medium 5.2
In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible
-
High 8.8
Insufficient control flow management in AmdCpmGpioInitSmm may allow a privileged attacker to tamper with the SMM handle…
-
Medium 5.2
In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible.
-
High 8.6
Cisco IOS and IOS XE Software Web Services Denial of Service Vulnerability
A vulnerability in the web services interface of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to improper resource management in the HTTP ser…
-
High 7.8
Vulnerability in Snow Inventory Java Scanner
A vulnerability in Snow Inventory Java Scanner allows an attacker to run malicious code at a higher level of privileges. This issue affects: SNOW Snow Inventory Java Scanner 1.0