# CWE-1284. Every Advisory and CVE whose sources give the weakness CWE-1284, newest first. ## Records, newest first (an older page) - [Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_CHECK_TA_COMPAT to cause incorrect shared memory mapping, potentially resulting…](https://agentprime.io/advisories/CVE-2025-66660.md) `CVE-2025-66660` · CVE record: AMD AMD Radeon™ RX 6000 Series Graphics Products and 4 more · CVSS 1.8 Low · Not analysed yet · Published 15 May 2026 · Tags: CWE-1284 - [Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_COPY_VF_CHIPLET_REGS to write invalid data to a remote Die, potentially resulti…](https://agentprime.io/advisories/CVE-2026-0428.md) `CVE-2026-0428` · CVE record: AMD AMD Instinct™ MI300A and 3 more · CVSS 1.8 Low · Not analysed yet · Published 15 May 2026 · Tags: CWE-1284 - [Improper Validation of Specified Quantity in Input in GitLab](https://agentprime.io/advisories/CVE-2025-14869.md) `CVE-2025-14869` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 14 May 2026 · Tags: CWE-1284 - [Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in \`JSONPathBuilder.key()\` / \`.at()\`](https://agentprime.io/advisories/GHSA-pv5w-4p9q-p3v2.md) `GHSA-pv5w-4p9q-p3v2`, `CVE-2026-44635` · npm `kysely`: affected `>=0.26.0, <0.28.17`, fixed in `0.28.17` · CVSS 7.5 High · Not analysed yet · Published 11 May 2026 · Tags: Path traversal, SQL injection, Broken access control, CWE-1284 - [oxidize-pdf: NaN/inf bypass in colour content-stream emission causes PDF rejection (DoS)](https://agentprime.io/advisories/GHSA-88q9-cmp2-c2vq.md) `GHSA-88q9-cmp2-c2vq` · crates.io `oxidize-pdf` and 2 more: affected `<2.6.0`, fixed in `2.6.0` · CVSS 4.3 Medium · Not analysed yet · Published 11 May 2026 · Tags: CWE-20, CWE-1284 - [Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()](https://agentprime.io/advisories/GHSA-hm8q-7f3q-5f36.md) `GHSA-hm8q-7f3q-5f36`, `CVE-2026-44459` · npm `hono`: affected `<4.12.18`, fixed in `4.12.18` · CVSS 3.8 Low · Not analysed yet · Published 9 May 2026 · Tags: CWE-1284 - [Conditional Fields for Contact Form 7 < 2.7.3 DoS via Uncontrolled Resource Consumption](https://agentprime.io/advisories/CVE-2026-25863.md) `CVE-2026-25863` · CVE record: Jules Colle Conditional Fields for Contact Form 7 · CVSS 8.7 High · Not analysed yet · Published 4 May 2026 · Tags: CWE-1284 - [An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXParser.cpp, ParseVectorDataArray()](https://agentprime.io/advisories/CVE-2025-70071.md) `CVE-2025-70071` · CVE record · CVSS 5.9 Medium · Not analysed yet · Published 4 May 2026 · Tags: Denial of service, CWE-1284 - [An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial() method](https://agentprime.io/advisories/CVE-2025-70069.md) `CVE-2025-70069` · CVE record · CVSS 7.5 High · Not analysed yet · Published 4 May 2026 · Tags: Denial of service, CWE-1284 - [IBM® Db2® is vulnerable to a denial of service when fetching from certain tables under specific configurations](https://agentprime.io/advisories/CVE-2025-14688.md) `CVE-2025-14688` · CVE record: IBM Db2 · CVSS 5.3 Medium · Not analysed yet · Published 30 Apr 2026 · Tags: CWE-1284 - [Flaw in the updateUser Command May Allow Unauthorized Configuration Change](https://agentprime.io/advisories/CVE-2026-6915.md) `CVE-2026-6915` · CVE record: MongoDB MongoDB Server · CVSS 5.3 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: CWE-1284 - [IBM® Db2® is vulnerable to a trap or return SQLCODE -901 when compiling a specially crafted query with a defined index](https://agentprime.io/advisories/CVE-2026-1352.md) `CVE-2026-1352` · CVE record: IBM Db2 · CVSS 6.5 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-1284 - [rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length](https://agentprime.io/advisories/GHSA-xmgf-hq76-4vx2.md) `GHSA-xmgf-hq76-4vx2`, `CVE-2026-41677` · crates.io `openssl`: affected `>=0.9.0, <0.10.78`, fixed in `0.10.78` · CVSS 1.7 Low · Not analysed yet · Published 22 Apr 2026 · Tags: Memory corruption, CWE-1284 - [nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation](https://agentprime.io/advisories/GHSA-6973-8887-87ff.md) `GHSA-6973-8887-87ff`, `CVE-2026-33471` · crates.io `nimiq-block`: affected `<1.7.2`, fixed in `1.7.2` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Apr 2026 · Tags: Memory corruption, CWE-20, CWE-345, CWE-1284 - [Samsung Open Source ONE: Improper validation of STRING tensor offsets could allows malformed string metadata to…](https://agentprime.io/advisories/CVE-2026-6839.md) `CVE-2026-6839` · CVE record: Samsung Open Source ONE · CVSS 6.6 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-1284 - [OpenBSD: In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they…](https://agentprime.io/advisories/CVE-2026-41285.md) `CVE-2026-41285` · CVE record: OpenBSD OpenBSD · CVSS 4.3 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: CWE-1284 - [CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation impacting log integrity when a Web Admin user alters the POST /logsetti…](https://agentprime.io/advisories/CVE-2026-2403.md) `CVE-2026-2403` · CVE record: Schneider Electric PowerChute™ Serial Shutdown · CVSS 5.3 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-1284 - [Denial of Service Vulnerabilities in System 800xA, Symphony® Plus IEC 61850](https://agentprime.io/advisories/CVE-2025-3756.md) `CVE-2025-3756` · CVE record: ABB AC800M (System 800xA) and 3 more · CVSS 7.1 High · Not analysed yet · Published 13 Apr 2026 · Tags: CWE-1284 - [nimiq-blockchain is missing a wall-clock upper bound on block timestamps](https://agentprime.io/advisories/GHSA-49xc-52mp-cc9j.md) `GHSA-49xc-52mp-cc9j`, `CVE-2026-40093` · crates.io `nimiq-blockchain`: affected `<=1.3.0`, no fixed version yet · CVSS 8.1 High · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-20, CWE-1284 - [Improper Validation of Specified Quantity in Input in GitLab](https://agentprime.io/advisories/CVE-2025-12664.md) `CVE-2025-12664` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-1284 - [Improper Validation of Specified Quantity in Input in GitLab](https://agentprime.io/advisories/CVE-2026-1092.md) `CVE-2026-1092` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-1284 - [Improper Validation of Specified Quantity in Input in GitLab](https://agentprime.io/advisories/CVE-2026-1101.md) `CVE-2026-1101` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-1284 - [Tandoor Recipes — \`amount\`/\`unit\` bypass serializer in \`food/{id}/shopping/\`](https://agentprime.io/advisories/CVE-2026-35489.md) `CVE-2026-35489` · CVE record: TandoorRecipes recipes · CVSS 7.3 High · Not analysed yet · Published 7 Apr 2026 · Tags: Broken access control, CWE-1284 - [vLLM: Unauthenticated OOM Denial of Service via Unbounded \`n\` Parameter in OpenAI API Server](https://agentprime.io/advisories/GHSA-3mwp-wvh9-7528.md) `GHSA-3mwp-wvh9-7528`, `CVE-2026-34756`, `PYSEC-2026-2298` · PyPI `vllm`: affected `>=0.1.0, <0.19.0`, fixed in `0.19.0` · CVSS 6.5 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Denial of service, CWE-1284 - [OpenEXR: integer overflow lead to OOB in HTJ2K decoder](https://agentprime.io/advisories/CVE-2026-34545.md) `CVE-2026-34545` · CVE record: AcademySoftwareFoundation openexr · CVSS 8.4 High · Not analysed yet · Published 1 Apr 2026 · Tags: Memory corruption, CWE-1284 - [A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0.](https://agentprime.io/advisories/CVE-2026-30573.md) `CVE-2026-30573` · CVE record · CVSS 7.5 High · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-1284 - [A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-stock.php file.](https://agentprime.io/advisories/CVE-2026-30575.md) `CVE-2026-30575` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Mar 2026 · Tags: CWE-20, CWE-1284 - [Improper Validation of Specified Quantity in Input in GitLab](https://agentprime.io/advisories/CVE-2025-13078.md) `CVE-2025-13078` · CVE record: GitLab GitLab · CVSS 6.5 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-1284 - [WordPress SimpLy Gallery plugin <= 3.3.2 - Arbitrary Code Execution vulnerability](https://agentprime.io/advisories/CVE-2026-25345.md) `CVE-2026-25345` · CVE record: GalleryCreator SimpLy Gallery · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-1284 - [Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser](https://agentprime.io/advisories/GHSA-jp2q-39xq-3w4g.md) `GHSA-jp2q-39xq-3w4g`, `CVE-2026-33349` · npm `fast-xml-parser`: affected `>=4.0.0-beta.3, <4.5.5 || >=5.0.0, <5.5.7`, fixed in `4.5.5`, `5.5.7` · CVSS 5.9 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: CWE-1284 - [Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-26940.md) `CVE-2026-26940` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: CWE-1284 - [HTSlib CRAM decoder vulnerable to buffer overflow](https://agentprime.io/advisories/CVE-2026-31971.md) `CVE-2026-31971` · CVE record: samtools htslib · CVSS 7.1 High · Not analysed yet · Published 18 Mar 2026 · Tags: Memory corruption, CWE-1284 - [HTSlib BGZF index file reader has a heap buffer overflow](https://agentprime.io/advisories/CVE-2026-31970.md) `CVE-2026-31970` · CVE record: samtools htslib · CVSS 7.1 High · Not analysed yet · Published 18 Mar 2026 · Tags: Memory corruption, CWE-1284 - [Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation](https://agentprime.io/advisories/GHSA-v9p9-hfj2-hcw8.md) `GHSA-v9p9-hfj2-hcw8`, `CVE-2026-2229` · npm `undici`: affected `<6.24.0 || >=7.0.0, <7.24.0`, fixed in `6.24.0`, `7.24.0` · CVSS 7.5 High · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-248, CWE-1284 - [GStreamer rtpqdm2depay Heap-based Buffer Overflow Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-3085.md) `CVE-2026-3085` · CVE record: GStreamer GStreamer · CVSS 8.8 High · Not analysed yet · Published 13 Mar 2026 · Tags: Memory corruption, CWE-1284 - [Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client](https://agentprime.io/advisories/GHSA-f269-vfmq-vjvj.md) `GHSA-f269-vfmq-vjvj`, `CVE-2026-1528` · npm `undici`: affected `>=6.0.0, <6.24.0 || >=7.0.0, <7.24.0`, fixed in `6.24.0`, `7.24.0` · CVSS 7.5 High · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-248, CWE-1284 - [Improper Validation of Specified Quantity in Input in GitLab](https://agentprime.io/advisories/CVE-2025-14513.md) `CVE-2025-14513` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-1284 - [WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability](https://agentprime.io/advisories/CVE-2026-27384.md) `CVE-2026-27384` · CVE record: BoldGrid W3 Total Cache · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-1284 - [jackson-core has Nesting Depth Constraint Bypass in \`UTF8DataInputJsonParser\` potentially allowing Resource Exhaustion](https://agentprime.io/advisories/GHSA-6v53-7c9g-w56r.md) `GHSA-6v53-7c9g-w56r`, `CVE-2026-29062` · Maven `tools.jackson.core:jackson-core`: affected `>=3.0.0, <3.1.0`, fixed in `3.1.0` · CVSS 8.7 High · Not analysed yet · Published 4 Mar 2026 · Tags: Denial of service, CWE-1284 - [Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_bytes()](https://agentprime.io/advisories/CVE-2026-2597.md) `CVE-2026-2597` · CVE record: LEONT Crypt::SysRandom::XS · CVSS 7.5 High · Not analysed yet · Published 26 Feb 2026 · Tags: Memory corruption, CWE-1284 - [Improper Validation of Specified Quantity in Input in Kibana Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-26934.md) `CVE-2026-26934` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 26 Feb 2026 · Tags: CWE-1284 - [Improper Validation of Specified Quantity in Input in GitLab](https://agentprime.io/advisories/CVE-2025-14511.md) `CVE-2025-14511` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 25 Feb 2026 · Tags: CWE-1284 - [zlib: zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64…](https://agentprime.io/advisories/CVE-2026-27171.md) `CVE-2026-27171` · CVE record: zlib zlib · CVSS 2.9 Low · Not analysed yet · Published 18 Feb 2026 · Tags: CWE-1284 - [IBM Db2 Denial of Service](https://agentprime.io/advisories/CVE-2025-13867.md) `CVE-2025-13867` · CVE record: IBM Db2 for Linux, UNIX and Windows · CVSS 6.5 Medium · Not analysed yet · Published 17 Feb 2026 · Tags: CWE-1284 - [IBM Db2 Denial of Service](https://agentprime.io/advisories/CVE-2025-14689.md) `CVE-2025-14689` · CVE record: IBM Db2 for Linux, UNIX and Windows · CVSS 6.5 Medium · Not analysed yet · Published 17 Feb 2026 · Tags: CWE-1284 - [Crypt::URandom versions from 0.41 before 0.55 for Perl is vulnerable to a heap buffer overflow in the XS function crypt_urandom_getrandom()](https://agentprime.io/advisories/CVE-2026-2474.md) `CVE-2026-2474` · CVE record: DDICK Crypt::URandom · CVSS 7.5 High · Not analysed yet · Published 16 Feb 2026 · Tags: Memory corruption, CWE-1284 - [Improper bound check within AMD CPU microcode can allow a malicious guest to write to host memory, potentially resulting in loss of integrity.](https://agentprime.io/advisories/CVE-2025-52534.md) `CVE-2025-52534` · CVE record: AMD AMD EPYC™ 9005 Series Processors · CVSS 5.3 Medium · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-1284 - [Improper input validation in IOMMU could allow a malicious hypervisor to reconfigure IOMMU registers resulting in loss of guest data integrity.](https://agentprime.io/advisories/CVE-2024-21953.md) `CVE-2024-21953` · CVE record: AMD AMD EPYC™ 9004 Series Processors and 2 more · CVSS 5.9 Medium · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-1284 - [Information Disclosure, Information Tampering, and Denial of Service (DoS) Vulnerability in Mitsubishi Electric proprietary protocol communication and SLMP communication for FA products](https://agentprime.io/advisories/CVE-2025-15080.md) `CVE-2025-15080` · CVE record: Mitsubishi Electric Corporation MELSEC iQ-R Series R08PCPU and 3 more · CVSS 8.8 High · Not analysed yet · Published 5 Feb 2026 · Tags: CWE-1284 - [Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for January 2026.](https://agentprime.io/advisories/CVE-2025-36094.md) `CVE-2025-36094` · CVE record: IBM Cloud Pak for Business Automation · CVSS 5.4 Medium · Not analysed yet · Published 3 Feb 2026 · Tags: CWE-1284 - [IBM Db2 Denial of Service](https://agentprime.io/advisories/CVE-2025-36009.md) `CVE-2025-36009` · CVE record: IBM Db2 for Linux, UNIX and Windows · CVSS 6.5 Medium · Not analysed yet · Published 30 Jan 2026 · Tags: CWE-1284 - [IBM Db2 Denial of Service](https://agentprime.io/advisories/CVE-2025-36407.md) `CVE-2025-36407` · CVE record: IBM Db2 for Linux, UNIX and Windows · CVSS 6.5 Medium · Not analysed yet · Published 30 Jan 2026 · Tags: CWE-1284 - [IBM Db2 Denial of Service](https://agentprime.io/advisories/CVE-2025-36423.md) `CVE-2025-36423` · CVE record: IBM Db2 for Linux, UNIX and Windows · CVSS 6.5 Medium · Not analysed yet · Published 30 Jan 2026 · Tags: CWE-1284 - [IBM Db2 Denial of Service](https://agentprime.io/advisories/CVE-2025-36424.md) `CVE-2025-36424` · CVE record: IBM Db2 for Linux, UNIX and Windows · CVSS 6.5 Medium · Not analysed yet · Published 30 Jan 2026 · Tags: CWE-1284 - [IBM Db2 Denial of Service](https://agentprime.io/advisories/CVE-2025-36427.md) `CVE-2025-36427` · CVE record: IBM Db2 for Linux, UNIX and Windows · CVSS 6.5 Medium · Not analysed yet · Published 30 Jan 2026 · Tags: CWE-1284 - [IBM Db2 Denial of Service](https://agentprime.io/advisories/CVE-2025-36428.md) `CVE-2025-36428` · CVE record: IBM Db2 for Linux, UNIX and Windows · CVSS 5.3 Medium · Not analysed yet · Published 30 Jan 2026 · Tags: CWE-1284 - [React Server Components have multiple Denial of Service Vulnerabilities](https://agentprime.io/advisories/GHSA-83fc-fqcc-2hmg.md) `GHSA-83fc-fqcc-2hmg`, `CVE-2026-23864` · npm `react-server-dom-parcel` and 2 more: affected `>=19.0.0, <19.0.4 || >=19.1.0-canary-7130d0c6-20241212, <19.1.5 || >=19.2.0-canary-63779030-20250328, <19.2.4`, fixed in `19.0.4`, `19.1.5`, `19.2.4` · CVSS 7.5 High · Not analysed yet · Published 29 Jan 2026 · Tags: Denial of service, Insecure deserialization, CWE-1284 - [Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components](https://agentprime.io/advisories/GHSA-h25m-26qc-wcjf.md) `GHSA-h25m-26qc-wcjf`, `CVE-2026-23864` · npm `next`: affected `>=13.0.0, <15.0.8 || >=15.1.1-canary.0, <15.1.12 || >=15.2.0-canary.0, <15.2.9 || >=15.3.0-canary.0, <15.3.9 || >=15.4.0-canary.0, <15.4.11 || >=15.5.1-canary.0, <15.5.10 || >=15.6.0-canary.0, <15.6.0-canary.61 || >=16.0.0-beta.0, <16.0.11 || >=16.1.0-canary.0, <16.1.5`, fixed in `15.0.8`, `15.1.12`, `15.2.9`, `15.3.9`, `15.4.11`, `15.5.10`, `15.6.0-canary.61`, `16.0.11`, `16.1.5` · CVSS 7.5 High · Not analysed yet · Published 28 Jan 2026 · Tags: Denial of service, Insecure deserialization, CWE-1284 - [Tanium addressed an improper input validation vulnerability in Discover.](https://agentprime.io/advisories/CVE-2026-0925.md) `CVE-2026-0925` · CVE record: Tanium Discover · CVSS 2.7 Low · Not analysed yet · Published 26 Jan 2026 · Tags: CWE-1284 - [Rockwell Automation CompactLogix® 5370 Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2025-11743.md) `CVE-2025-11743` · CVE record: Rockwell Automation CompactLogix® 5370 · CVSS 7.1 High · Not analysed yet · Published 20 Jan 2026 · Tags: CWE-1284 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .