# CWE-1288.

Every Advisory and CVE whose sources give the weakness CWE-1288, newest first.

## Records, newest first

- [JwtVerifierImpl.Verify does not enforce the JWS \`crit\` header (RFC 7515 §4.1.11)](https://agentprime.io/advisories/CVE-2026-89317.md)
  `CVE-2026-89317` · CVE record: Eclipse Foundation Eclipse KeyPont - GOSE · CVSS 6.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS, CWE-20, CWE-1288
- [TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl](https://agentprime.io/advisories/CVE-2026-94200.md)
  `CVE-2026-94200` · CVE record: Erlang OTP · CVSS 8.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1288
- [Junos OS and Junos OS Evolved: An attacker causes l2cpd denial of service when MVRP is used](https://agentprime.io/advisories/CVE-2026-102047.md)
  `CVE-2026-102047` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1288
- [Junos OS and Junos OS Evolved: A BGP peer causes an rpd crash if a malformed MCAST-TREE NLRI is received and readvertised](https://agentprime.io/advisories/CVE-2026-101951.md)
  `CVE-2026-101951` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1288
- [\`@bsv/wallet-toolbox\` / \`-client\` / \`-mobile\` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction](https://agentprime.io/advisories/GHSA-36f9-7rg5-cpf8.md)
  `GHSA-36f9-7rg5-cpf8`, `CVE-2026-56744` · npm `@bsv/wallet-toolbox` and 2 more: affected `>=1.1.47, <2.4.0`, fixed in `2.4.0` · CVSS 8.7 High · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-1288
- [Windows TCP/IP Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-69793.md)
  `CVE-2026-69793` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.5 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-1288
- [OOBR in rpcap client in libpcap before 1.10.7](https://agentprime.io/advisories/CVE-2026-18238.md)
  `CVE-2026-18238` · CVE record: The Tcpdump Group libpcap · CVSS 5.0 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: CWE-126, CWE-1288
- [OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite](https://agentprime.io/advisories/CVE-2026-18794.md)
  `CVE-2026-18794` · CVE record: CalcProgrammer1 OpenRGB · CVSS 8.8 High · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-1288
- [CVAT: Denial of service with regards to automatic annotation](https://agentprime.io/advisories/CVE-2026-73219.md)
  `CVE-2026-73219` · CVE record: cvat-ai cvat · CVSS 5.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-1288
- [Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check](https://agentprime.io/advisories/CVE-2026-18209.md)
  `CVE-2026-18209` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 3.4 Low · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-1288
- [Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change](https://agentprime.io/advisories/CVE-2026-15943.md)
  `CVE-2026-15943` · CVE record: Red Hat Red Hat build of Keycloak 26.6.8 and 3 more · CVSS 5.5 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-1288
- [Windows Secure Kernel Mode Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-42982.md)
  `CVE-2026-42982` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-1288
- [Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo email](https://agentprime.io/advisories/CVE-2026-14781.md)
  `CVE-2026-14781` · CVE record: Red Hat Red Hat Build of Keycloak and 3 more · CVSS 4.8 Medium · Not analysed yet · Published 5 Jul 2026 · Tags: CWE-1288
- [RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()](https://agentprime.io/advisories/CVE-2026-46117.md)
  `CVE-2026-46117` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 28 May 2026 · Tags: CWE-20, CWE-1288
- [Keycloak Services has Improper Validation of Consistency within Input](https://agentprime.io/advisories/GHSA-wcvj-vpvw-9rr5.md)
  `GHSA-wcvj-vpvw-9rr5`, `CVE-2026-9689` · Maven `org.keycloak:keycloak-services`: affected `>=26.5.0, <=26.6.4 || <=26.4.7`, no fixed version yet · CVSS 4.2 Medium · Not analysed yet · Published 27 May 2026 · Tags: CWE-1288
- [smb: client: validate the whole DACL before rewriting it in cifsacl](https://agentprime.io/advisories/CVE-2026-31709.md)
  `CVE-2026-31709` · CVE record: Linux Linux · CVSS 8.8 High · Not analysed yet · Published 1 May 2026 · Tags: Memory corruption, CWE-1288
- [OpenStack Keystone has an Incorrect Authorization Issue](https://agentprime.io/advisories/GHSA-hhq2-3832-xxcv.md)
  `GHSA-hhq2-3832-xxcv`, `CVE-2026-43001`, `PYSEC-2026-602` · PyPI `keystone`: affected `>=13.0.0, <=29.0.1`, no fixed version yet · CVSS 7.9 High · Not analysed yet · Published 1 May 2026 · Tags: Broken access control, CWE-1288
- [drm/amd/display: Do not skip unrelated mode changes in DSC validation](https://agentprime.io/advisories/CVE-2026-31488.md)
  `CVE-2026-31488` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 22 Apr 2026 · Tags: Memory corruption, CWE-1288
- [crypto: algif_aead - Revert to operating out-of-place](https://agentprime.io/advisories/CVE-2026-31431.md)
  `CVE-2026-31431` · CVE record: Linux Linux · CVSS 7.8 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.98 · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-669, CWE-1288
- [Innomic VibroLine Configurator and avibia Configurator allow unintended device reset via USB](https://agentprime.io/advisories/CVE-2022-50976.md)
  `CVE-2022-50976` · CVE record: Innomic VibroLine Configurator 5.0 and 2 more · CVSS 7.7 High · Not analysed yet · Published 2 Feb 2026 · Tags: CWE-1288
- [Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables](https://agentprime.io/advisories/GHSA-fg8x-q69g-4qp3.md)
  `GHSA-fg8x-q69g-4qp3`, `CVE-2025-10929`, `DRUPAL-CONTRIB-2025-111`, `PKSA-zp2q-9sfp-d51m` · Packagist `drupal/reverse_proxy_header`: affected `<1.1.2`, fixed in `1.1.2` · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: CWE-1288
- [Improper validation of payload elements](https://agentprime.io/advisories/CVE-2025-9999.md)
  `CVE-2025-9999` · CVE record: arcinfo PcVue · CVSS 7.6 High · Not analysed yet · Published 5 Sept 2025 · Tags: CWE-940, CWE-1288
- [vLLM has a Weakness in MultiModalHasher Image Hashing Implementation](https://agentprime.io/advisories/GHSA-c65p-x677-fgj6.md)
  `GHSA-c65p-x677-fgj6`, `CVE-2025-46722`, `PYSEC-2025-43` · PyPI `vllm`: affected `>=0.7.0, <0.9.0`, fixed in `0.9.0` · CVSS 4.2 Medium · Not analysed yet · Published 28 May 2025 · Tags: CWE-1023, CWE-1288
- [Improper Validation of Consistency within Input in GitLab](https://agentprime.io/advisories/CVE-2024-12093.md)
  `CVE-2024-12093` · CVE record: GitLab GitLab · CVSS 6.8 Medium · Not analysed yet · Published 22 May 2025 · Tags: CWE-1288
- [tough root metadata version is not checked for sequential versioning](https://agentprime.io/advisories/GHSA-5vmp-m5v2-hx47.md)
  `GHSA-5vmp-m5v2-hx47`, `CVE-2025-2885` · crates.io `tough`: affected `<0.20.0`, fixed in `0.20.0` · CVSS 5.7 Medium · Not analysed yet · Published 28 Mar 2025 · Tags: CWE-1288
- [MongoDB Server secondaries may crash due to forced index constraints](https://agentprime.io/advisories/CVE-2024-8305.md)
  `CVE-2024-8305` · CVE record: MongoDB Inc MongoDB Server · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2024 · Tags: CWE-1288
- [Junos OS and Junos OS Evolved: With BGP traceoptions enabled, receipt of specifically malformed BGP update causes RPD crash](https://agentprime.io/advisories/CVE-2024-39515.md)
  `CVE-2024-39515` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 8.7 High · Not analysed yet · Published 9 Oct 2024 · Tags: CWE-1288
- [389-ds-base: malformed userpassword hash may cause denial of service](https://agentprime.io/advisories/CVE-2024-5953.md)
  `CVE-2024-5953` · CVE record: Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8 and 4 more · CVSS 5.7 Medium · Not analysed yet · Published 18 Jun 2024 · Tags: CWE-1288
- [An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330.](https://agentprime.io/advisories/CVE-2024-27371.md)
  `CVE-2024-27371` · CVE record · CVSS 6.7 Medium · Not analysed yet · Published 5 Jun 2024 · Tags: CWE-1288
- [An issue was discovered in Samsung Mobile Processor Exynos 980, Exynos 850, Exynos 1280, Exynos 1380, and Exynos 1330.](https://agentprime.io/advisories/CVE-2024-27375.md)
  `CVE-2024-27375` · CVE record · CVSS 6.7 Medium · Not analysed yet · Published 5 Jun 2024 · Tags: CWE-1288
- [JetBrains TeamCity: In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files…](https://agentprime.io/advisories/CVE-2024-31140.md)
  `CVE-2024-31140` · CVE record: JetBrains TeamCity · CVSS 4.1 Medium · Not analysed yet · Published 28 Mar 2024 · Tags: CWE-1288
- [In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter](https://agentprime.io/advisories/CVE-2024-31136.md)
  `CVE-2024-31136` · CVE record: JetBrains TeamCity · CVSS 7.4 High · Not analysed yet · Published 28 Mar 2024 · Tags: CWE-1288
- [A command injection vulnerability exists in local RACADM.](https://agentprime.io/advisories/CVE-2024-25951.md)
  `CVE-2024-25951` · CVE record: Dell Integrated Dell Remote Access Controller 8 · CVSS 8.0 High · Not analysed yet · Published 9 Mar 2024 · Tags: CWE-1288
- [Candid infinite decoding loop through specially crafted payload](https://agentprime.io/advisories/GHSA-7787-p7x6-fq3j.md)
  `GHSA-7787-p7x6-fq3j`, `CVE-2023-6245`, `RUSTSEC-2023-0073` · crates.io `candid`: affected `>=0.9.0, <0.9.10`, fixed in `0.9.10` · CVSS 7.5 High · Not analysed yet · Published 8 Dec 2023 · Tags: Denial of service, CWE-20, CWE-168, CWE-1288
- [Vulnerability in Networking Stack Impacts QNX Software Development Platform (SDP)](https://agentprime.io/advisories/CVE-2023-32701.md)
  `CVE-2023-32701` · CVE record: BlackBerry QNX Software Development Platform (SDP) · CVSS 7.1 High · Not analysed yet · Published 14 Nov 2023 · Tags: CWE-1288
- [WAGO: DoS in multiple products in multiple versions using Codesys](https://agentprime.io/advisories/CVE-2023-1620.md)
  `CVE-2023-1620` · CVE record: Wago 750-8202/xxx-xxx and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 26 Jun 2023 · Tags: CWE-1288
- [WAGO: DoS in multiple versions of multiple products](https://agentprime.io/advisories/CVE-2023-1619.md)
  `CVE-2023-1619` · CVE record: Wago 750-8202/xxx-xxx and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 26 Jun 2023 · Tags: CWE-1288
- [xmldom allows multiple root nodes in a DOM](https://agentprime.io/advisories/GHSA-crh6-fp67-6883.md)
  `GHSA-crh6-fp67-6883`, `CVE-2022-39353` · npm `xmldom` and 1 more: affected `<=0.6.0`, no fixed version yet · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2022 · Tags: CWE-20, CWE-1288
- [Invalid RPKI data could disable Route Origin Validation on RTR clients.](https://agentprime.io/advisories/CVE-2021-41531.md)
  `CVE-2021-41531` · CVE record: NLnet Labs Routinator · No CVSS score · Not analysed yet · Published 21 Sept 2021 · Tags: CWE-1288

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1288>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1288/>. Everything for agents: <https://agentprime.io/llms.txt>.