CWE-696 Incorrect Behavior Order
classThe product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (70)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-45033US | high7.8 | Exploit | ||
GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulnerability has been identified in GitHub Copilot CLI where a m… | ||||
| CVE-2026-35652US | critical9.1OT elevated | — | ||
OpenClaw before 2026.3.22 contains an authorization bypass vulnerability in interactive callback dispatch that allows non-allowlisted senders to execute action handlers. Attackers… | ||||
| CVE-2023-6394US | critical9.1OT elevated | — | ||
A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the reque… | ||||
| CVE-2026-40583US | high8.2 | — | ||
UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, and balance pre… | ||||
| CVE-2026-35627US | high8.2OT elevated | — | ||
OpenClaw before 2026.3.22 performs cryptographic and dispatch operations on inbound Nostr direct messages before enforcing sender and pairing policy validation. Attackers can trigg… | ||||
| CVE-2021-22569US | medium5.5 | Exploit | ||
An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that would be processed out of order. A small malicious payload can o… | ||||
| CVE-2026-35386US | high8.1 | — | ||
In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This requires a scenario where the username on the command line is… | ||||
| CVE-2026-105745US | high7.8 | — | ||
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories i… | ||||
| CVE-2026-41254US | high7.5 | — | ||
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication. | ||||
| CVE-2026-35640US | high7.5 | — | ||
OpenClaw before 2026.3.25 parses JSON request bodies before validating webhook signatures, allowing unauthenticated attackers to force resource-intensive parsing operations. Remote… | ||||
| CVE-2025-48965US | high7.5 | — | ||
Mbed TLS before 3.6.4 has a NULL pointer dereference because mbedtls_asn1_store_named_data can trigger conflicting data with val.p of NULL but val.len greater than zero. | ||||
| CVE-2023-33224US | high7.2 | — | ||
The SolarWinds Platform was susceptible to the Incorrect Behavior Order Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execu… | ||||
| CVE-2024-24699US | medium6.5 | — | ||
Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access.
| ||||
| CVE-2026-44919US | medium6.5 | — | ||
In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL. | ||||
| CVE-2025-0150US | medium6.5 | — | ||
Incorrect behavior order in some Zoom Workplace Apps for iOS before version 6.3.0 may allow an authenticated user to conduct a denial of service via network access. | ||||
| CVE-2026-114104US | medium5.9 | — | ||
adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP archives with duplicate entry names… | ||||
| CVE-2021-29446US | medium5.9 | — | ||
jose-node-cjs-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS38… | ||||
| CVE-2021-29445US | medium5.9 | — | ||
jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS38… | ||||
| CVE-2021-29443US | medium5.9 | — | ||
jose is an npm library providing a number of cryptographic operations. In vulnerable versions AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption w… | ||||
| CVE-2026-40223US | medium5.5 | — | ||
In systemd 258 before 260, a local unprivileged user can trigger an assert when a Delegate=yes and User=<unset> unit exists and is running. | ||||
04
attack patterns (1)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan