# CWE-115.

Every Advisory and CVE whose sources give the weakness CWE-115, newest first.

## Records, newest first

- [Dulwich before 1.2.20 Commit Parser Tree Header Misinterpretation](https://agentprime.io/advisories/CVE-2026-122299.md)
  `CVE-2026-122299` · CVE record: jelmer dulwich · CVSS 8.6 High · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-115, CWE-1250
- [DoS vulnerability in the file parsing module.](https://agentprime.io/advisories/CVE-2026-101170.md)
  `CVE-2026-101170` · CVE record: Huawei HarmonyOS · CVSS 4.0 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-115
- [pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier](https://agentprime.io/advisories/CVE-2026-116241.md)
  `CVE-2026-116241` · CVE record: pgadmin.org pgAdmin 4 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection, CWE-115
- [HPE NonStop DNS 9.2.3 Non Secure Version](https://agentprime.io/advisories/CVE-2026-73798.md)
  `CVE-2026-73798` · CVE record: Hewlett Packard Enterprise HPE NonStop DNS 9.2.3 Non Secure Version · CVSS 8.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-115
- [Improper certificate validation in OpenVPN](https://agentprime.io/advisories/CVE-2026-63650.md)
  `CVE-2026-63650` · CVE record: OpenVPN OpenVPN · CVSS 2.0 Low · Not analysed yet · Published 14 Aug 2026 · Tags: Weak cryptography or TLS, CWE-115
- [pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)](https://agentprime.io/advisories/CVE-2026-17566.md)
  `CVE-2026-17566` · CVE record: pgadmin.org pgAdmin 4 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Jul 2026 · Tags: Command injection, CWE-115
- [pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)](https://agentprime.io/advisories/CVE-2026-17351.md)
  `CVE-2026-17351` · CVE record: pgadmin.org pgAdmin 4 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Jul 2026 · Tags: SQL injection, CWE-115
- [EDNS options smuggling](https://agentprime.io/advisories/CVE-2026-42004.md)
  `CVE-2026-42004` · CVE record: PowerDNS DNSdist · CVSS 3.7 Low · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-115
- [Duplicate Advisory: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations](https://agentprime.io/advisories/GHSA-x8xr-mj9x-6h7w.md)
  `GHSA-x8xr-mj9x-6h7w` · PyPI `vllm`: affected `>=0.11.0, <=0.23.0`, no fixed version yet · CVSS 4.8 Medium · Withdrawn · Not analysed yet · Published 17 Jun 2026 · Tags: CWE-115
- [vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations](https://agentprime.io/advisories/GHSA-8jr5-v98p-w75m.md)
  `GHSA-8jr5-v98p-w75m`, `CVE-2026-12491`, `PYSEC-2026-3406` · PyPI `vllm`: affected `>=0.11.0, <0.24.0`, fixed in `0.24.0` · CVSS 4.8 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: CWE-115, CWE-436
- [ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay](https://agentprime.io/advisories/GHSA-6gvq-jcmp-8959.md)
  `GHSA-6gvq-jcmp-8959`, `CVE-2025-68113`, `GO-2025-4239`, `PKSA-5rb8-j658-qvzz`, `PYSEC-2026-1115` · Go `github.com/altcha-org/altcha-lib-go` and 6 more: affected `<1.0.0`, fixed in `1.0.0` · CVSS 6.5 Medium · Not analysed yet · Published 16 Dec 2025 · Tags: Weak cryptography or TLS, CWE-115
- [Astro allows unauthorized third-party images in \_image endpoint](https://agentprime.io/advisories/GHSA-xf8x-j4p2-f749.md)
  `GHSA-xf8x-j4p2-f749`, `CVE-2025-55303` · npm `astro` and 1 more: affected `<4.16.19 || >=5.0.0-alpha.0, <5.13.2`, fixed in `4.16.19`, `5.13.2` · CVSS 6.9 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Cross-site scripting (XSS), CWE-115
- [GitProxy Backfile Parsing Exploit](https://agentprime.io/advisories/GHSA-xxmh-rf63-qwjv.md)
  `GHSA-xxmh-rf63-qwjv`, `CVE-2025-54584` · npm `@finos/git-proxy`: affected `<1.19.2`, fixed in `1.19.2` · CVSS 7.0 High · Not analysed yet · Published 30 Jul 2025 · Tags: CWE-115
- [Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability](https://agentprime.io/advisories/CVE-2025-5826.md)
  `CVE-2025-5826` · CVE record: Autel Autel MaxiCharger AC Wallbox Commercial · CVSS 6.3 Medium · Not analysed yet · Published 25 Jun 2025 · Tags: CWE-115
- [WOLFBOX Level 2 EV Charger MCU Command Parsing Misinterpretation of Input Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-5747.md)
  `CVE-2025-5747` · CVE record: WOLFBOX Level 2 EV Charger · CVSS 8.0 High · Not analysed yet · Published 6 Jun 2025 · Tags: CWE-115
- [Libsoup: denial of service on libsoup through http/2 server](https://agentprime.io/advisories/CVE-2025-32908.md)
  `CVE-2025-32908` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.5 High · Not analysed yet · Published 14 Apr 2025 · Tags: CWE-115
- [LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality](https://agentprime.io/advisories/GHSA-w6hh-w36c-vxmw.md)
  `GHSA-w6hh-w36c-vxmw`, `CVE-2024-9900`, `GO-2025-3542` · Go `github.com/mudler/LocalAI`: affected `<2.22.0`, fixed in `2.22.0` · CVSS 5.4 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: Cross-site scripting (XSS), CWE-115
- [Unhandled Exception Leading to Server Crash in danny-avila/librechat](https://agentprime.io/advisories/CVE-2024-11169.md)
  `CVE-2024-11169` · CVE record: danny-avila danny-avila/librechat · CVSS 7.5 High · Not analysed yet · Published 20 Mar 2025 · Tags: CWE-115
- [HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net](https://agentprime.io/advisories/GHSA-qxp5-gwg8-xv66.md)
  `GHSA-qxp5-gwg8-xv66`, `CVE-2025-22870`, `GO-2025-3503` · Go `golang.org/x/net`: affected `<0.36.0`, fixed in `0.36.0` · CVSS 4.4 Medium · Not analysed yet · Published 12 Mar 2025 · Tags: CWE-20, CWE-115
- [Apache Kvrocks: Cross-Protocol Scripting Vulnerability](https://agentprime.io/advisories/CVE-2025-25069.md)
  `CVE-2025-25069` · CVE record: Apache Software Foundation Apache Kvrocks · CVSS 6.5 Medium · Not analysed yet · Published 7 Feb 2025 · Tags: CWE-115
- [A firmware bug which may lead to misinterpretation of data in the AMC2-4WCF and AMC2-2WCF allowing an adversary to grant access to the last authorized user.](https://agentprime.io/advisories/CVE-2023-32228.md)
  `CVE-2023-32228` · CVE record: Bosch AMS and 1 more · CVSS 4.6 Medium · Not analysed yet · Published 11 Apr 2024 · Tags: CWE-115
- [A potential Misinterpretation of Input vulnerability has been identified in SMAX, AMX, and HCMX products.](https://agentprime.io/advisories/CVE-2023-32260.md)
  `CVE-2023-32260` · CVE record: OpenText™ Service Management Automation X (SMAX) and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 19 Mar 2024 · Tags: CWE-115
- [Misinterpretation of Input in thorsten/phpmyfaq](https://agentprime.io/advisories/GHSA-f9c6-4j9h-6c5r.md)
  `GHSA-f9c6-4j9h-6c5r`, `CVE-2023-0880`, `PKSA-gpfr-w2p1-4v7c` · Packagist `thorsten/phpmyfaq`: affected `<3.1.11`, fixed in `3.1.11` · CVSS 8.3 High · Not analysed yet · Published 17 Feb 2023 · Tags: CWE-115
- [Cisco IOS XE Software IPv6 VPN over MPLS Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2022-20915.md)
  `CVE-2022-20915` · CVE record: Cisco Cisco IOS XE Software · CVSS 7.4 High · Not analysed yet · Published 10 Oct 2022 · Tags: CWE-115
- [parse-url parses http URLs incorrectly, making it vulnerable to host name spoofing](https://agentprime.io/advisories/GHSA-pqw5-jmp5-px4v.md)
  `GHSA-pqw5-jmp5-px4v`, `CVE-2022-3224` · npm `parse-url`: affected `<8.1.0`, fixed in `8.1.0` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2022 · Tags: CWE-115
- [URL Confusion When Scheme Not Supplied in medialize/uri.js](https://agentprime.io/advisories/GHSA-g694-m8vq-gv9h.md)
  `GHSA-g694-m8vq-gv9h`, `CVE-2022-1233` · npm `urijs`: affected `<1.19.11`, fixed in `1.19.11` · CVSS 6.5 Medium · Not analysed yet · Published 5 Apr 2022 · Tags: Open redirect, CWE-115
- [Authentication Bypass in github.com/russellhaering/gosaml2](https://agentprime.io/advisories/GHSA-xhqq-x44f-9fgg.md)
  `GHSA-xhqq-x44f-9fgg`, `BIT-golang-2020-29509`, `CVE-2020-29509`, `GO-2021-0060` · Go `github.com/russellhaering/gosaml2`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Feb 2022 · Tags: CWE-115
- [/etc/pki/tls and /etc/ssl/certs include distrusted certificates in make-ca](https://agentprime.io/advisories/CVE-2022-21672.md)
  `CVE-2022-21672` · CVE record: lfs-book make-ca · CVSS 6.5 Medium · Not analysed yet · Published 10 Jan 2022 · Tags: CWE-115
- [Cisco NX-OS Software VXLAN OAM (NGOAM) Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2021-1587.md)
  `CVE-2021-1587` · CVE record: Cisco Cisco NX-OS Software · CVSS 8.6 High · Not analysed yet · Published 25 Aug 2021 · Tags: CWE-115
- [XML Processing error in github.com/crewjam/saml](https://agentprime.io/advisories/GHSA-4hq8-gmxx-h6w9.md)
  `GHSA-4hq8-gmxx-h6w9`, `BIT-grafana-2020-27846`, `CVE-2020-27846`, `GO-2021-0058` · Go `github.com/crewjam/saml`: affected `<0.4.3`, fixed in `0.4.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jun 2021 · Tags: Authentication bypass, CWE-115
- [REXML round-trip instability](https://agentprime.io/advisories/GHSA-8cr8-4vfw-mr7h.md)
  `GHSA-8cr8-4vfw-mr7h`, `BIT-ruby-2021-28965`, `BIT-ruby-min-2021-28965`, `CVE-2021-28965` · RubyGems `rexml`: affected `<3.2.5`, fixed in `3.2.5` · CVSS 7.5 High · Not analysed yet · Published 30 Apr 2021 · Tags: XML external entities (XXE), CWE-115
- [Misinterpretation of malicious XML input](https://agentprime.io/advisories/GHSA-h6q6-9hqw-rwfv.md)
  `GHSA-h6q6-9hqw-rwfv`, `CVE-2021-21366` · npm `xmldom`: affected `<0.5.0`, fixed in `0.5.0` · CVSS 4.3 Medium · Not analysed yet · Published 12 Mar 2021 · Tags: CWE-115, CWE-436
- [NFX250, NFX350, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series: Certain genuine traffic received by the Junos OS device will be discarded instead of forwarded.](https://agentprime.io/advisories/CVE-2021-0207.md)
  `CVE-2021-0207` · CVE record: Juniper Networks Junos OS · CVSS 7.5 High · Not analysed yet · Published 15 Jan 2021 · Tags: CWE-115, CWE-436
- [Go: The encoding/xml package in Go (all versions) does not correctly preserve the semantics…](https://agentprime.io/advisories/CVE-2020-29511.md)
  `CVE-2020-29511` · CVE record: Golang Go · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Dec 2020 · Tags: CWE-115
- [Go: The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the…](https://agentprime.io/advisories/CVE-2020-29510.md)
  `CVE-2020-29510` · CVE record: Golang Go · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Dec 2020 · Tags: CWE-115
- [Node.js: Node.js: All versions prior to Node.js 6.15.0, 8.14.0…](https://agentprime.io/advisories/CVE-2018-12123.md)
  `CVE-2018-12123` · CVE record: The Node.js Project Node.js · No CVSS score · Not analysed yet · Published 28 Nov 2018 · Tags: CWE-115
- [Node.js: Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If…](https://agentprime.io/advisories/CVE-2018-12116.md)
  `CVE-2018-12116` · CVE record: The Node.js Project Node.js · No CVSS score · Not analysed yet · Published 28 Nov 2018 · Tags: CWE-115
- [Node.js: The HTTP parser in all current versions of Node.js ignores spaces in the \`Content-Length\`…](https://agentprime.io/advisories/CVE-2018-7159.md)
  `CVE-2018-7159` · CVE record: The Node.js Project Node.js · No CVSS score · Not analysed yet · Published 17 May 2018 · Tags: CWE-115

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-115>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-115/>. Everything for agents: <https://agentprime.io/llms.txt>.