CVE Database and Vulnerability Search

Browse vendorsBrowse ecosystems

Search CVE and GHSA vulnerability records by identifier, title, vendor, product, package, or CWE. Filter by severity, CISA KEV, ransomware association, linked artifacts, and Nuclei templates; sort by publication date, CVSS, or EPSS.

Vulnerabilities
381,276
with PoCs
37,250
CISA KEV
1,665
Ransomware
606
with Nuclei
4,342
Advanced

Showing 25 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

WonderTrader Pending Order TraderAdapter.h _undone_qty behavioral workflow

A vulnerability was identified in WonderTrader up to 0.9.9. Affected is the function _undone_qty in the library src/WtCore/TraderAdapter.h of the component Pending Order Handler. The manipulation of the argument getUndoneQty leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE-840CWE-841Aug 7, 2026
CVSS5.3v4.0EPSS0.216%PoCs0SignalsSTIX

WonderTrader TraderDD.cpp queryTrades behavioral workflow

A vulnerability was detected in WonderTrader up to 0.9.9. Impacted is the function TraderDD::queryTrades of the file src/TraderDD/TraderDD.cpp. The manipulation of the argument FID_JYLB results in enforcement of behavioral workflow. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE-840CWE-841Aug 7, 2026
CVSS6.3v4.0EPSS0.273%PoCs0SignalsSTIX

WonderTrader Internal Limit Order Book Cache MatchEngine.cpp update_lob behavioral workflow

A weakness has been identified in WonderTrader up to 0.9.9. This vulnerability affects the function MatchEngine::update_lob of the file src/WtBtCore/MatchEngine.cpp of the component Internal Limit Order Book Cache Handler. This manipulation causes enforcement of behavioral workflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CWE-840CWE-841Aug 6, 2026
CVSS5.3v4.0EPSS0.352%PoCs0SignalsSTIX

Huawei EMUI and Harmony OS File System Permission Control Vulnerability

Permission control vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CWE-840Jul 15, 2026
CVSS7.8v3.1EPSS0.084%PoCs0SignalsSTIX

SourceCodester Simple Food Ordering System cart.php logic error

A flaw has been found in SourceCodester Simple Food Ordering System 1.0. The affected element is an unknown function of the file /cart.php. Executing a manipulation of the argument item_price can lead to business logic errors. The attack may be performed from remote. The exploit has been published and may be used.

CWE-840Jun 29, 2026
CVSS6.9v4.0EPSS0.383%PoCs0SignalsSTIX

Huawei EMUI and HarmonyOS Permission Control Vulnerability in Calls

Permission control vulnerability in calls. Impact: Successful exploitation of this vulnerability may affect availability.

CWE-840Jun 9, 2026
CVSS5.9v3.1EPSS0.078%PoCs0SignalsSTIX

songquanpeng one-api Redemption Code Top-Up Endpoint redemption.go Redeem logic error

A security flaw has been discovered in songquanpeng one-api up to 0.6.11-preview.7. Affected by this issue is the function Redeem of the file model/redemption.go of the component Redemption Code Top-Up Endpoint. The manipulation results in business logic errors. The attack may be launched remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue a…

CWE-20CWE-840Jun 7, 2026
CVSS2.3v4.0EPSS0.22%PoCs0SignalsSTIX

Sanluan PublicCMS Trade Payment Flow TradeOrderController.java AccountGatewayComponent.pay logic error

A security vulnerability has been detected in Sanluan PublicCMS 5.202506.d. Impacted is the function TradeOrderController.pay/TradePaymentController.pay/AccountGatewayComponent.pay of the file publiccms-trade/src/main/java/com/publiccms/controller/web/trade/TradeOrderController.java of the component Trade Payment Flow. The manipulation leads to business logic errors. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted e…

CWE-840May 17, 2026
CVSS6.9v4.0EPSS0.331%PoCs0SignalsSTIX

Huawei HarmonyOS Manufacturability Design Module Permission Control Vulnerability

Permission control vulnerability in the manufacturability design module. Impact: Successful exploitation of this vulnerability may affect availability.

CWE-840May 15, 2026
CVSS5.9v3.1EPSS0.08%PoCs0SignalsSTIX

Huawei HarmonyOS Permission Control Vulnerability in Manufacturability Design Module

Permission control vulnerability in the manufacturability design module. Impact: Successful exploitation of this vulnerability may affect availability.

CWE-840May 15, 2026
CVSS5.9v3.1EPSS0.078%PoCs0SignalsSTIX

HarmonyOS Smart Sensing Service Permission Control Vulnerability

Permission control vulnerability in the smart sensing service. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CWE-840May 15, 2026
CVSS5.6v3.1EPSS0.114%PoCs0SignalsSTIX

HarmonyOS Contacts Permission Control Vulnerability

Permission control vulnerability in contacts. Impact: Successful exploitation of this vulnerability may affect availability.

CWE-840May 15, 2026
CVSS5.9v3.1EPSS0.078%PoCs0SignalsSTIX

Huawei HarmonyOS Security Control Module Permission Control Vulnerability

Permission control vulnerability in the security control module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CWE-840May 15, 2026
CVSS5.5v3.1EPSS0.082%PoCs0SignalsSTIX

Huawei HarmonyOS Web Use-After-Free Vulnerability

Use-After-Free (UAF) vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability.

CWE-840May 15, 2026
CVSS5.6v3.1EPSS0.126%PoCs0SignalsSTIX

Business Logic Errors in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with a read_api scoped OAuth application to create issues and add comments to issues in private projects due to improper authorization.

CWE-840May 14, 2026
CVSS6.8v3.1EPSS0.311%PoCs0SignalsSTIX

IBM Guardium Data Protection is affected by multiple vulnerabilities

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a Bypass Business Logic vulnerability in the access management control panel.

CWE-840Apr 22, 2026
CVSS4.9v3.1EPSS0.3%PoCs0SignalsSTIX

SourceCodester Pharmacy Product Management System POST Parameter add-sales.php logic error

A security flaw has been discovered in SourceCodester Pharmacy Product Management System 1.0. This affects an unknown part of the file add-sales.php of the component POST Parameter Handler. Performing a manipulation of the argument txtqty results in business logic errors. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.

CWE-840Apr 8, 2026
CVSS5.3v4.0EPSS0.241%PoCs0SignalsSTIX

SourceCodester Online Food Ordering System POST Parameter Actions.php save_product logic error

A vulnerability was identified in SourceCodester Online Food Ordering System 1.0. Affected by this issue is the function save_product of the file /Actions.php of the component POST Parameter Handler. Such manipulation of the argument price leads to business logic errors. The attack may be performed from remote. The exploit is publicly available and might be used.

CWE-840Apr 8, 2026
CVSS5.3v4.0EPSS0.246%PoCs0SignalsSTIX

mickasmt next-saas-stripe-starter Checkout generate-user-stripe.ts generateUserStripe logic error

A security vulnerability has been detected in mickasmt next-saas-stripe-starter 1.0.0. Affected is the function generateUserStripe of the file actions/generate-user-stripe.ts of the component Checkout Handler. The manipulation of the argument priceId leads to business logic errors. The attack may be initiated remotely.

CWE-840Mar 22, 2026
CVSS5.3v4.0EPSS0.209%PoCs0SignalsSTIX

HarmonyOS Security Control Module Race Condition Vulnerability

Race condition vulnerability in the security control module. Impact: Successful exploitation of this vulnerability may affect availability.

CWE-362CWE-840Mar 5, 2026
CVSS4.0v3.1EPSS0.079%PoCs0SignalsSTIX

Bdtask Bhojon All-In-One Restaurant Management System Add-to-Cart Submission Endpoint addtocart logic error

A vulnerability was identified in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. The impacted element is an unknown function of the file /hungry/addtocart of the component Add-to-Cart Submission Endpoint. The manipulation of the argument price/allprice leads to business logic errors. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE-840Jan 29, 2026
CVSS5.3v4.0EPSS0.25%PoCs0SignalsSTIX

Bdtask Bhojon All-In-One Restaurant Management System Checkout placeorder logic error

A vulnerability was determined in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. The affected element is an unknown function of the file /hungry/placeorder of the component Checkout. Executing a manipulation of the argument orggrandTotal/vat/service_charge/grandtotal can lead to business logic errors. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not re…

CWE-840Jan 29, 2026
CVSS5.3v4.0EPSS0.295%PoCs0SignalsSTIX

Org.keycloak/keycloak-services: keycloak keycloak-services: business logic flaw allows unauthorized token issuance for disabled users

A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh tokens for disabled users, leading to unauthorized use of previously revoked privileges, via a business logic vulnerability in the Token Exchange implementation when a privileged client invokes the token exchange flow.

CWE-840CWE-863Jan 21, 2026
CVSS6.5v3.1EPSS0.443%PoCs0SignalsSTIX

Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution submit_checkout behavioral workflow

A security vulnerability has been detected in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution 5. Affected by this issue is some unknown functionality of the file /submit_checkout. Such manipulation of the argument order_total_amount/cart_total_amount leads to enforcement of behavioral workflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE-840CWE-841Nov 16, 2025
CVSS5.3v4.0EPSS0.309%PoCs0SignalsSTIX

Business Logic Errors in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.3, and 18.5 before 18.5.1 that under certain conditions could have allowed authenticated users to gain unauthorized project access by exploiting the access request approval workflow.

CWE-840Oct 27, 2025
CVSS2.7v3.1EPSS0.298%PoCs0SignalsSTIX