# CWE-1023.

Every Advisory and CVE whose sources give the weakness CWE-1023, newest first.

## Records, newest first

- [Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass](https://agentprime.io/advisories/CVE-2026-121949.md)
  `CVE-2026-121949` · CVE record: sensiolabs symfony · CVSS 2.3 Low · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-184, CWE-1023
- [Silent loss of messages when merging overlapping chat exports in whatstk](https://agentprime.io/advisories/CVE-2026-121564.md)
  `CVE-2026-121564` · CVE record: lucasrodes whatstk · CVSS 1.8 Low · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-1023
- [IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)](https://agentprime.io/advisories/CVE-2026-91768.md)
  `CVE-2026-91768` · CVE record: PHP Group PHP · CVSS 6.5 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-1023
- [Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone](https://agentprime.io/advisories/CVE-2026-85491.md)
  `CVE-2026-85491` · CVE record · CVSS 8.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-706, CWE-1023
- [Incorrect authorization in Eclipse Foundation Eclipse Ankaios](https://agentprime.io/advisories/CVE-2026-92611.md)
  `CVE-2026-92611` · CVE record: Eclipse Foundation Eclipse Ankaios · CVSS 4.8 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Broken access control, CWE-1023
- [OpenClaw ClawScan Static Scanner static_scanner.go incomplete comparison with missing factors](https://agentprime.io/advisories/CVE-2026-91836.md)
  `CVE-2026-91836` · CVE record: OpenClaw ClawScan · CVSS 2.4 Low · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-1023
- [Visual Studio Code Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-81376.md)
  `CVE-2026-81376` · CVE record: Microsoft Visual Studio Code · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-693, CWE-1023
- [Session takeover via Auth Proxy cache key collision](https://agentprime.io/advisories/CVE-2026-14199.md)
  `CVE-2026-14199` · CVE record: Grafana Grafana Enterprise and 1 more · CVSS 7.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass, Broken access control, CWE-1023
- [cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions](https://agentprime.io/advisories/GHSA-r5pm-vrc5-3m73.md)
  `GHSA-r5pm-vrc5-3m73`, `CVE-2026-54713`, `PKSA-tgsp-smx2-wtkc` · Packagist `cakephp/queue`: affected `>=0.1.10, <2.3.1`, fixed in `2.3.1` · CVSS 3.7 Low · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-1023
- [Laravel Backpack CRUD: Stored XSS in the color column — the \`@if($column\['escaped'\])\` branches are inverted](https://agentprime.io/advisories/GHSA-mmg4-322v-6jvc.md)
  `GHSA-mmg4-322v-6jvc`, `CVE-2026-54181`, `PKSA-5phc-pmxf-y81y` · Packagist `backpack/crud`: affected `>=6.0.0, <6.8.14 || >=7.0.0, <7.0.38`, fixed in `6.8.14`, `7.0.38` · CVSS 5.4 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Cross-site scripting (XSS), CWE-1023
- [NVIDIA Dynamo: NVIDIA Dynamo for Linux contains a vulnerability in the multimodal embedding cache…](https://agentprime.io/advisories/CVE-2026-24255.md)
  `CVE-2026-24255` · CVE record: NVIDIA Dynamo · CVSS 7.5 High · Not analysed yet · Published 4 Aug 2026 · Tags: CWE-1023
- [OpenClaw: Trusted retry endpoint checks could match hostname prefixes](https://agentprime.io/advisories/GHSA-77q5-rr5v-x43q.md)
  `GHSA-77q5-rr5v-x43q`, `CVE-2026-53839` · npm `openclaw`: affected `<2026.5.7`, fixed in `2026.5.7` · CVSS 6.0 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: CWE-20, CWE-345, CWE-1023
- [OpenClaw: Hostname checks could treat trailing-dot hosts inconsistently](https://agentprime.io/advisories/GHSA-gxg4-2rrr-jhc7.md)
  `GHSA-gxg4-2rrr-jhc7`, `CVE-2026-53859` · npm `openclaw`: affected `<2026.5.26`, fixed in `2026.5.26` · CVSS 6.0 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: Server-side request forgery (SSRF), CWE-20, CWE-1023
- [Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes](https://agentprime.io/advisories/GHSA-x5qj-865h-mgvm.md)
  `GHSA-x5qj-865h-mgvm`, `CVE-2026-48761`, `PKSA-3d8r-4bff-vcj1`, `PKSA-qpkt-z1gq-qf6m` · Packagist `symfony/html-sanitizer` and 1 more: affected `>=6.1.0, <6.4.41 || >=7.0.0, <7.4.13 || >=8.0.0, <8.0.13`, fixed in `6.4.41`, `7.4.13`, `8.0.13` · CVSS 5.3 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: Cross-site scripting (XSS), CWE-1023
- [Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass](https://agentprime.io/advisories/CVE-2026-7473.md)
  `CVE-2026-7473` · CVE record: Arista Networks EOS · CVSS 6.9 Medium · Critical (KEV) · In CISA KEV · Not analysed yet · Published 5 Jun 2026 · Tags: CWE-1023
- [Django: has_vary_header may expose cached responses when Vary values contain whitespace](https://agentprime.io/advisories/GHSA-923m-gv2p-w5qp.md)
  `GHSA-923m-gv2p-w5qp`, `BIT-django-2026-48587`, `CVE-2026-48587`, `PYSEC-2026-198` · PyPI `django`: affected `<5.2.15 || >=6.0.0, <6.0.6`, fixed in `5.2.15`, `6.0.6` · CVSS 2.3 Low · Not analysed yet · Published 3 Jun 2026 · Tags: CWE-1023
- [pf silently ignores certain rules](https://agentprime.io/advisories/CVE-2026-4748.md)
  `CVE-2026-4748` · CVE record: FreeBSD FreeBSD · CVSS 7.5 High · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-480, CWE-754, CWE-1023
- [jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation](https://agentprime.io/advisories/GHSA-5jx8-q4cp-rhh6.md)
  `GHSA-5jx8-q4cp-rhh6`, `CVE-2026-4599` · npm `jsrsasign`: affected `>=7.0.0, <11.1.1`, fixed in `11.1.1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Mar 2026 · Tags: Weak cryptography or TLS, CWE-1023
- [BullWall Ransomware Containment incomplete file inspection](https://agentprime.io/advisories/CVE-2025-62000.md)
  `CVE-2025-62000` · CVE record: BullWall Ransomware Containment · CVSS 6.9 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: CWE-1023
- [Windows BitLocker Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-55333.md)
  `CVE-2025-55333` · CVE record: Microsoft Windows 10 Version 1507 and 4 more · CVSS 6.1 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: CWE-1023
- [vLLM has a Weakness in MultiModalHasher Image Hashing Implementation](https://agentprime.io/advisories/GHSA-c65p-x677-fgj6.md)
  `GHSA-c65p-x677-fgj6`, `CVE-2025-46722`, `PYSEC-2025-43` · PyPI `vllm`: affected `>=0.7.0, <0.9.0`, fixed in `0.9.0` · CVSS 4.2 Medium · Not analysed yet · Published 28 May 2025 · Tags: CWE-1023, CWE-1288
- [Incomplete Comparison with Missing Factors in GitLab](https://agentprime.io/advisories/CVE-2024-5528.md)
  `CVE-2024-5528` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 5 Feb 2025 · Tags: CWE-1023
- [An Incomplete Comparison with Missing Factors vulnerability in the Gallagher Controller allows an attacker to bypass PIV verification.](https://agentprime.io/advisories/CVE-2021-23146.md)
  `CVE-2021-23146` · CVE record: Gallagher Command Center · CVSS 7.1 High · Not analysed yet · Published 18 Nov 2021 · Tags: CWE-1023

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1023>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1023/>. Everything for agents: <https://agentprime.io/llms.txt>.