# CWE-1284.

Every Advisory and CVE whose sources give the weakness CWE-1284, newest first.

## Records, newest first

- [Stack-based buffer overflow in SafeNet Authentication Client SIS token engine](https://agentprime.io/advisories/CVE-2026-94395.md)
  `CVE-2026-94395` · CVE record: Thalesgroup Safenet Authentication Client SIS token engine · CVSS 7.0 High · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption, CWE-1284
- [stable-diffusion.cpp: Heap out-of-bounds write in the imatrix loader (\`load_imatrix\`) via a duplicate tensor name](https://agentprime.io/advisories/CVE-2026-70659.md)
  `CVE-2026-70659` · CVE record: leejet stable-diffusion.cpp · CVSS 7.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption, CWE-1284
- [STMicroelectronics st-mems-android-linux-sensors-hal: STMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check…](https://agentprime.io/advisories/CVE-2026-123011.md)
  `CVE-2026-123011` · CVE record: STMicroelectronics st-mems-android-linux-sensors-hal · CVSS 4.2 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-1284
- [In the Exynos modem's IMS stack, Out of Bound access occurs due to improper validation.](https://agentprime.io/advisories/CVE-2026-33972.md)
  `CVE-2026-33972` · CVE record: Samsung Semiconductor Exynos 1080 and 4 more · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-1284
- [A memory corruption vulnerability caused by improper validation of messages](https://agentprime.io/advisories/CVE-2026-48176.md)
  `CVE-2026-48176` · CVE record: Samsung Semiconductor Exynos 1080 and 4 more · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-1284
- [GetPaid WordPress Plugin < 2.8.63 Negative Quantity Payment Bypass](https://agentprime.io/advisories/CVE-2026-119749.md)
  `CVE-2026-119749` · CVE record: AyeCode Ltd Payment forms, Buy now buttons, and Invoicing System | GetPaid · CVSS 8.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-1284
- [In Modem, there is a possible out of bounds write due to a missing bounds check.](https://agentprime.io/advisories/CVE-2026-20562.md)
  `CVE-2026-20562` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 5.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-1284
- [Forge: AES-GCM authentication bypass via unvalidated tagLength option](https://agentprime.io/advisories/GHSA-5cwg-6vw7-rj6p.md)
  `GHSA-5cwg-6vw7-rj6p`, `CVE-2026-119186` · npm `node-forge`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 5.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-354, CWE-1284
- [Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count](https://agentprime.io/advisories/GHSA-jc66-7q78-782g.md)
  `GHSA-jc66-7q78-782g`, `CVE-2026-118782` · npm `node-forge`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-354, CWE-1284
- [Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir](https://agentprime.io/advisories/CVE-2026-115274.md)
  `CVE-2026-115274` · CVE record: elixir-lang elixir · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-1284
- [Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir](https://agentprime.io/advisories/CVE-2026-109821.md)
  `CVE-2026-109821` · CVE record: elixir-lang elixir · CVSS 6.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service, CWE-1284
- [zip: AES Entry HMAC Authentication Bypass on Premature EOF](https://agentprime.io/advisories/GHSA-8hxf-qr8p-62x4.md)
  `GHSA-8hxf-qr8p-62x4`, `CVE-2026-115906` · crates.io `zip`: affected `>=0.6.0, <9.0.0`, fixed in `9.0.0` · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-354, CWE-1284
- [Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)](https://agentprime.io/advisories/GHSA-97r2-qh9m-474h.md)
  `GHSA-97r2-qh9m-474h`, `CVE-2026-116581` · npm `seroval`: affected `<1.6.8`, fixed in `1.6.8` · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service, CWE-1284
- [Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches](https://agentprime.io/advisories/CVE-2026-114349.md)
  `CVE-2026-114349` · CVE record: Apache Software Foundation Apache Kafka · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service, CWE-1284
- [Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code Execution](https://agentprime.io/advisories/CVE-2026-103594.md)
  `CVE-2026-103594` · CVE record: WatchGuard Fireware OS · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption, CWE-1284
- [dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS](https://agentprime.io/advisories/GHSA-px68-xx5g-48q5.md)
  `GHSA-px68-xx5g-48q5`, `CVE-2026-46350` · npm `dcmjs`: affected `<0.52.0`, fixed in `0.52.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-20, CWE-1284
- [An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL parameter in the qrcode_auth.html component](https://agentprime.io/advisories/CVE-2026-107079.md)
  `CVE-2026-107079` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-1284
- [server-set cookie aborts cookie jar load](https://agentprime.io/advisories/CVE-2026-92386.md)
  `CVE-2026-92386` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-1284
- [Module Manager object lookup validates one byte of a module's search name](https://agentprime.io/advisories/CVE-2026-94024.md)
  `CVE-2026-94024` · CVE record: Eclipse Foundation Eclipse ThreadX · CVSS 6.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption, CWE-1284
- [Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509](https://agentprime.io/advisories/CVE-2026-93475.md)
  `CVE-2026-93475` · CVE record: Eclipse Foundation Eclipse ThreadX - NetX Duo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption, CWE-1284
- [FileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT image](https://agentprime.io/advisories/CVE-2026-91041.md)
  `CVE-2026-91041` · CVE record: Eclipse Foundation Eclipse ThreadX - FileX · CVSS 7.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption, CWE-1284
- [WordPress Classified Listing plugin <= 6.1.5 - Direct static code injection vulnerability](https://agentprime.io/advisories/CVE-2026-111828.md)
  `CVE-2026-111828` · CVE record: Mamunur Rashid Classified Listing · CVSS 4.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-1284
- [nic BIRD: An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an…](https://agentprime.io/advisories/CVE-2026-112112.md)
  `CVE-2026-112112` · CVE record: nic BIRD · CVSS 2.3 Low · Not analysed yet · Published 18 Oct 2026 · Tags: CWE-1284
- [swoosh has email-derived URL path injection in Microsoft Graph endpoint](https://agentprime.io/advisories/GHSA-754j-98wh-57rf.md)
  `GHSA-754j-98wh-57rf`, `CVE-2026-54893`, `EEF-CVE-2026-54893` · Hex `swoosh`: affected `>=1.12.0, <1.26.3`, fixed in `1.26.3` · CVSS 2.1 Low · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service, CWE-116, CWE-1284
- [WordPress Booking and Rental Manager plugin <= 2.8.0 - Other vulnerability Type vulnerability](https://agentprime.io/advisories/CVE-2026-103350.md)
  `CVE-2026-103350` · CVE record: Magepeople inc. Booking and Rental Manager · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-1284
- [Junos OS and Junos OS Evolved: A specific BGP ISO-VPN update causes an rpd crash when BMP or NSR is enabled](https://agentprime.io/advisories/CVE-2026-101952.md)
  `CVE-2026-101952` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1284
- [Junos OS and Junos OS Evolved: A malformed EVPN SRv6 route causes an rpd crash](https://agentprime.io/advisories/CVE-2026-102184.md)
  `CVE-2026-102184` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1284
- [Junos OS and Junos OS Evolved: If in a BGP EVPN scenario a malformed NLRI is received rpd crashes](https://agentprime.io/advisories/CVE-2026-102183.md)
  `CVE-2026-102183` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1284
- [Junos OS and Junos OS Evolved: An attacker causes denial of service when MC-LAG MAC synchronization is enabled](https://agentprime.io/advisories/CVE-2026-102033.md)
  `CVE-2026-102033` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1284
- [Junos OS and Junos OS Evolved: Malformed RIPv2 messages cause routing service disruption when RIP is enabled](https://agentprime.io/advisories/CVE-2026-102019.md)
  `CVE-2026-102019` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1284
- [Junos OS and Junos OS Evolved: An attacker causes a routing outage when BGP MVPN signaling is enabled](https://agentprime.io/advisories/CVE-2026-102016.md)
  `CVE-2026-102016` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1284
- [Junos OS and Junos OS Evolved: A specific IS-IS SRv6 packet causes an rpd crash when flexible algorithm is used](https://agentprime.io/advisories/CVE-2026-101987.md)
  `CVE-2026-101987` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1284
- [Junos OS and Junos OS Evolved: Malformed RSVP packet causes a rpd crash when RSVP is enabled](https://agentprime.io/advisories/CVE-2026-102066.md)
  `CVE-2026-102066` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1284
- [Junos OS and Junos OS Evolved: A malformed SRv6 service route causes an rpd crash when dynamic tunnels are enabled](https://agentprime.io/advisories/CVE-2026-102065.md)
  `CVE-2026-102065` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1284
- [Junos OS and Junos OS Evolved: Malformed OSPF packets cause rpd memory disclosure or service disruption when link-local TE processing is used](https://agentprime.io/advisories/CVE-2026-101974.md)
  `CVE-2026-101974` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1284
- [Junos OS and Junos OS Evolved: A specific RSVP packet causes an rpd crash when L2 LSP support is used](https://agentprime.io/advisories/CVE-2026-102067.md)
  `CVE-2026-102067` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1284
- [Junos OS and Junos OS Evolved: Malformed ICCP packets cause l2ald memory disclosure and disruption](https://agentprime.io/advisories/CVE-2026-101995.md)
  `CVE-2026-101995` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1284
- [Junos OS Evolved: PTX Series: An IS-IS peer causes an rpd crash when BIER over IS-IS is enabled](https://agentprime.io/advisories/CVE-2026-101985.md)
  `CVE-2026-101985` · CVE record: Juniper Networks Junos OS Evolved · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1284
- [modern-tar 0.3.5 through 0.8.5 Memory Exhaustion via Malformed Octal Size Field](https://agentprime.io/advisories/CVE-2026-109380.md)
  `CVE-2026-109380` · CVE record: ayuhito modern-tar · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-1284
- [WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Other vulnerability Type vulnerability](https://agentprime.io/advisories/CVE-2026-107429.md)
  `CVE-2026-107429` · CVE record: VideoWhisper.com Paid Videochat Turnkey Site · CVSS 4.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-1284
- [WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.22 - Other vulnerability Type vulnerability](https://agentprime.io/advisories/CVE-2026-106605.md)
  `CVE-2026-106605` · CVE record: WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-1284
- [WordPress MicroPayments plugin <= 3.2.9 - Bypass Vulnerability vulnerability](https://agentprime.io/advisories/CVE-2026-107434.md)
  `CVE-2026-107434` · CVE record: videowhisper MicroPayments · CVSS 5.4 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: CWE-1284
- [Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch](https://agentprime.io/advisories/CVE-2026-103501.md)
  `CVE-2026-103501` · CVE record: Apache Software Foundation Apache DataSketches · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Memory corruption, CWE-1284
- [Luksmeta: incomplete gap-boundary and overlap checks in luks1 metadata allocator allow data corruption](https://agentprime.io/advisories/CVE-2026-107565.md)
  `CVE-2026-107565` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.1 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-1284
- [vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features](https://agentprime.io/advisories/GHSA-ph72-cqr5-qpp7.md)
  `GHSA-ph72-cqr5-qpp7`, `CVE-2026-105754`, `PYSEC-2026-4309` · PyPI `vllm`: affected `<0.30.0`, fixed in `0.30.0` · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Denial of service, Broken access control, Information disclosure, CWE-20
- [WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability vulnerability](https://agentprime.io/advisories/CVE-2026-97275.md)
  `CVE-2026-97275` · CVE record: VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-1284
- [WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.1 - Other vulnerability Type vulnerability](https://agentprime.io/advisories/CVE-2026-103351.md)
  `CVE-2026-103351` · CVE record: Magepeople inc. Taxi Booking Manager for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-1284
- [WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability](https://agentprime.io/advisories/CVE-2026-103065.md)
  `CVE-2026-103065` · CVE record: Themeum Kirki · CVSS 8.2 High · Not analysed yet · Published 3 Oct 2026 · Tags: CWE-1284
- [Wasmtime wasi:http implementation panics with a zero timeout supplied](https://agentprime.io/advisories/GHSA-w4qr-p94g-mjhv.md)
  `GHSA-w4qr-p94g-mjhv`, `CVE-2026-115382`, `RUSTSEC-2026-0320` · crates.io `wasmtime-wasi-http`: affected `>=46.0.0, <48.0.4 || >=49.0.0, <49.0.2`, fixed in `48.0.4`, `49.0.2` · CVSS 5.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-1284
- [Apache Thrift: Node.js \`server.js\` ends the process on any per-connection error (+ two triggers)](https://agentprime.io/advisories/CVE-2026-94646.md)
  `CVE-2026-94646` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Prototype pollution, CWE-248, CWE-1284
- [Apache Thrift: Python \`TZlibTransport\` stops enforcing its decompressed-size limit once the limit is exactly used up](https://agentprime.io/advisories/CVE-2026-94636.md)
  `CVE-2026-94636` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-409, CWE-628, CWE-1284
- [Apache Thrift: Node.js \`TJSONProtocol\` uses a peer-declared container size as an unbounded loop bound](https://agentprime.io/advisories/CVE-2026-94645.md)
  `CVE-2026-94645` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service, CWE-1284
- [Apache Thrift: PHP \`thrift_protocol\` accelerator: zero-byte container elements](https://agentprime.io/advisories/CVE-2026-91137.md)
  `CVE-2026-91137` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service, CWE-1284
- [Out-of-bounds write in PeaZip PEA extractor allows code execution via a crafted .pea archive](https://agentprime.io/advisories/CVE-2026-102514.md)
  `CVE-2026-102514` · CVE record: PeaZip PeaZip · CVSS 8.4 High · Not analysed yet · Published 1 Oct 2026 · Tags: Memory corruption, CWE-1284
- [pgvector buffer overflow in IVFFlat index build](https://agentprime.io/advisories/CVE-2026-103484.md)
  `CVE-2026-103484` · CVE record: pgvector · CVSS 8.8 High · Not analysed yet · Published 1 Oct 2026 · Tags: Memory corruption, CWE-1284
- [Kiteworks Core Improper Validation of Specified Quantity in Input](https://agentprime.io/advisories/CVE-2026-102111.md)
  `CVE-2026-102111` · CVE record: Kiteworks Core · CVSS 4.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-1284
- [WordPress Creator LMS plugin <= 1.2.19 - Other vulnerability Type vulnerability](https://agentprime.io/advisories/CVE-2026-62083.md)
  `CVE-2026-62083` · CVE record: WPFunnels Creator LMS · CVSS 5.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-1284
- [Fireware OS Pre-Authentication Integer Underflow in iked Allows Remote Denial of Service](https://agentprime.io/advisories/CVE-2026-86133.md)
  `CVE-2026-86133` · CVE record: WatchGuard Fireware OS · CVSS 8.2 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption, CWE-1284
- [Out-of-bounds Write via NAND Metadata Parsing at Mount in LevelX](https://agentprime.io/advisories/CVE-2026-102730.md)
  `CVE-2026-102730` · CVE record: Eclipse Foundation Eclipse ThreadX NetX Duo · CVSS 8.6 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption, CWE-1284
- [Out-of-bounds Read and Unverified Entry Pointers in the ThreadX Module Loader](https://agentprime.io/advisories/CVE-2026-102711.md)
  `CVE-2026-102711` · CVE record: Eclipse Foundation Eclipse ThreadX · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption, CWE-345, CWE-1284

Older: <https://agentprime.io/advisories/tag/cwe-1284.md?cursor=WyIyMDI2LTA5LTI5VDE3OjM4OjIyLjE3MTAwMFoiLCJDVkUtMjAyNi0xMDI3MTEiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1284>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1284/>. Everything for agents: <https://agentprime.io/llms.txt>.