# CWE-1395.

Every Advisory and CVE whose sources give the weakness CWE-1395, newest first.

## Records, newest first (an older page)

- [Auth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK](https://agentprime.io/advisories/GHSA-f3r2-88mq-9v4g.md)
  `GHSA-f3r2-88mq-9v4g`, `PKSA-3pss-my3n-f2df` · Packagist `auth0/symfony`: affected `>=5.0.0, <5.6.0`, fixed in `5.6.0` · CVSS 6.8 Medium · Not analysed yet · Published 17 Dec 2025 · Tags: Broken access control, CWE-345, CWE-1395
- [Auth0 Laravel SDK has Improper Audience Validation via Auth0-PHP SDK dependency](https://agentprime.io/advisories/GHSA-7hh9-gp72-wh7h.md)
  `GHSA-7hh9-gp72-wh7h`, `PKSA-y6vp-t32r-dgs1` · Packagist `auth0/login`: affected `>=7.0.0, <7.20.0`, fixed in `7.20.0` · CVSS 6.8 Medium · Not analysed yet · Published 17 Dec 2025 · Tags: Broken access control, CWE-1395
- [Micro820®, Micro850®, Micro870® – Specialized Fuzzing Vulnerabilities](https://agentprime.io/advisories/CVE-2025-13823.md)
  `CVE-2025-13823` · CVE record: Rockwell Automation Micro820®, Micro850®, Micro870® · CVSS 7.1 High · Not analysed yet · Published 15 Dec 2025 · Tags: CWE-1395
- [Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up](https://agentprime.io/advisories/GHSA-5j59-xgg2-r9c4.md)
  `GHSA-5j59-xgg2-r9c4` · npm `next`: affected `>=13.3.1-canary.0, <14.2.35 || >=15.0.6, <15.0.7 || >=15.1.10, <15.1.11 || >=15.2.7, <15.2.8 || >=15.3.7, <15.3.8 || >=15.4.9, <15.4.10 || >=15.5.8, <15.5.9 || >=15.6.0-canary.59, <15.6.0-canary.60 || >=16.0.9, <16.0.10 || >=16.1.0-canary.17, <16.1.0-canary.19`, fixed in `14.2.35`, `15.0.7`, `15.1.11`, `15.2.8`, `15.3.8`, `15.4.10`, `15.5.9`, `15.6.0-canary.60`, `16.0.10`, `16.1.0-canary.19` · CVSS 7.5 High · Not analysed yet · Published 12 Dec 2025 · Tags: Denial of service, Insecure deserialization, CWE-1395
- [Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components](https://agentprime.io/advisories/GHSA-c6m7-q6pr-c64r.md)
  `GHSA-c6m7-q6pr-c64r` · npm `@vitejs/plugin-rsc`: affected `<0.5.7`, fixed in `0.5.7` · CVSS 5.3 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: Information disclosure, Insecure deserialization, CWE-1395
- [Vite Plugin React has a Denial of Service Vulnerability in React Server Components](https://agentprime.io/advisories/GHSA-cpqf-f22c-r95x.md)
  `GHSA-cpqf-f22c-r95x` · npm `@vitejs/plugin-rsc`: affected `<0.5.7`, fixed in `0.5.7` · CVSS 7.5 High · Not analysed yet · Published 12 Dec 2025 · Tags: Denial of service, Insecure deserialization, CWE-1395
- [Next Server Actions Source Code Exposure](https://agentprime.io/advisories/GHSA-w37m-7fhw-fmv9.md)
  `GHSA-w37m-7fhw-fmv9` · npm `next`: affected `>=15.0.0-canary.0, <15.0.6 || >=15.1.1-canary.0, <15.1.10 || >=15.2.0-canary.0, <15.2.7 || >=15.3.0-canary.0, <15.3.7 || >=15.4.0-canary.0, <15.4.9 || >=15.5.1-canary.0, <15.5.8 || >=15.6.0-canary.0, <15.6.0-canary.59 || >=16.0.0-beta.0, <16.0.9 || >=16.1.0-canary.0, <16.1.0-canary.17`, fixed in `15.0.6`, `15.1.10`, `15.2.7`, `15.3.7`, `15.4.9`, `15.5.8`, `15.6.0-canary.59`, `16.0.9`, `16.1.0-canary.17` · CVSS 5.3 Medium · Not analysed yet · Published 11 Dec 2025 · Tags: Information disclosure, Insecure deserialization, CWE-1395
- [Next Vulnerable to Denial of Service with Server Components](https://agentprime.io/advisories/GHSA-mwv6-3258-q52c.md)
  `GHSA-mwv6-3258-q52c` · npm `next`: affected `>=13.3.0, <14.2.34 || >=15.0.0-canary.0, <15.0.6 || >=15.1.1-canary.0, <15.1.10 || >=15.2.0-canary.0, <15.2.7 || >=15.3.0-canary.0, <15.3.7 || >=15.4.0-canary.0, <15.4.9 || >=15.5.1-canary.0, <15.5.8 || >=15.6.0-canary.0, <15.6.0-canary.59 || >=16.0.0-beta.0, <16.0.9 || >=16.1.0-canary.0, <16.1.0-canary.17`, fixed in `14.2.34`, `15.0.6`, `15.1.10`, `15.2.7`, `15.3.7`, `15.4.9`, `15.5.8`, `15.6.0-canary.59`, `16.0.9`, `16.1.0-canary.17` · CVSS 7.5 High · Not analysed yet · Published 11 Dec 2025 · Tags: Denial of service, Insecure deserialization, CWE-1395
- [OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs](https://agentprime.io/advisories/GHSA-mjcp-gpgx-ggcg.md)
  `GHSA-mjcp-gpgx-ggcg`, `GO-2025-4224` · Go `github.com/opentofu/opentofu`: affected `<1.10.8`, fixed in `1.10.8` · CVSS 5.9 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-296, CWE-1395
- [SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475](https://agentprime.io/advisories/GHSA-5j8p-438x-rgg5.md)
  `GHSA-5j8p-438x-rgg5`, `PKSA-67d7-mg8j-87zx` · Packagist `onelogin/php-saml`: affected `<2.21.1 || >=3.0.0, <3.8.1 || >=4.0.0, <4.3.1`, fixed in `2.21.1`, `3.8.1`, `4.3.1` · CVSS 4.0, no score published · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-1395
- [OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses](https://agentprime.io/advisories/GHSA-w2jf-268q-mrvh.md)
  `GHSA-w2jf-268q-mrvh`, `GO-2025-4101` · Go `github.com/opentofu/opentofu`: affected `<1.10.7`, fixed in `1.10.7` · CVSS 3.1 Low · Not analysed yet · Published 6 Nov 2025 · Tags: CWE-1395
- [Busybox 1.31.1 - Multiple Known Vulnerabilities](https://agentprime.io/advisories/CVE-2025-12220.md)
  `CVE-2025-12220` · CVE record: Azure Access Technology BLU-IC2 and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2025 · Tags: CWE-1395
- [Vulnerable Components in Azure Access OS](https://agentprime.io/advisories/CVE-2025-12219.md)
  `CVE-2025-12219` · CVE record: Azure Access Technology BLU-IC2 and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2025 · Tags: CWE-1395
- [Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter on .within.website when Weblate is configured with Anubis and REDIRECT_DOMAINS...](https://agentprime.io/advisories/GHSA-3xhv-r4gx-xw99.md)
  `GHSA-3xhv-r4gx-xw99`, `CVE-2025-61587`, `PYSEC-2025-269` · PyPI `weblate`: affected `<5.13.3`, fixed in `5.13.3` · CVSS 2.1 Low · Not analysed yet · Published 1 Oct 2025 · Tags: Open redirect, CWE-1395
- [Vasion Print (formerly PrinterLogic) Use of Outdated, End-Of-Life, and Vulnerable Third-Party Components](https://agentprime.io/advisories/CVE-2025-34203.md)
  `CVE-2025-34203` · CVE record: Vasion Print Virtual Appliance Host and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Sept 2025 · Tags: CWE-1395
- [PostgreSQL Upgrade from v10 to v17.4 in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier to Address Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2025-10226.md)
  `CVE-2025-10226` · CVE record: AxxonSoft AxxonOne C-Werk · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2025 · Tags: CWE-1395
- [Information Disclosure due to Outdated OpenSSL Version in SAP NetWeaver AS Java (Adobe Document Service)](https://agentprime.io/advisories/CVE-2025-42927.md)
  `CVE-2025-42927` · CVE record: SAP_SE SAP NetWeaver AS Java (Adobe Document Service) · CVSS 3.4 Low · Not analysed yet · Published 9 Sept 2025 · Tags: CWE-1395
- [mitmproxy binaries embed a vulnerable python-hyper/h2 dependency](https://agentprime.io/advisories/GHSA-63cx-g855-hvv4.md)
  `GHSA-63cx-g855-hvv4` · PyPI `mitmproxy`: affected `<12.1.2`, fixed in `12.1.2` · CVSS 4.0, no score published · Not analysed yet · Published 25 Aug 2025 · Tags: HTTP request smuggling, CWE-1395
- [Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow](https://agentprime.io/advisories/CVE-2025-40913.md)
  `CVE-2025-40913` · CVE record: ATRODO Net::Dropbear · CVSS 6.5 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: CWE-1395
- [Unauthenticated Path Traversal affecting Avid NEXIS](https://agentprime.io/advisories/CVE-2024-26293.md)
  `CVE-2024-26293` · CVE record: Avid Avid NEXIS E-series and 3 more · CVSS 8.7 High · Not analysed yet · Published 14 Jul 2025 · Tags: CWE-1395
- [Archive::Unzip::Burst from 0.01 through 0.09 for Perl contains a bundled InfoZip library that is affected by several vulnerabilities](https://agentprime.io/advisories/CVE-2022-4976.md)
  `CVE-2022-4976` · CVE record: ETJ Archive::Unzip::Burst · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jun 2025 · Tags: CWE-1395
- [CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode](https://agentprime.io/advisories/CVE-2025-40912.md)
  `CVE-2025-40912` · CVE record: MIK CryptX · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Jun 2025 · Tags: CWE-1395
- [Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow](https://agentprime.io/advisories/CVE-2025-40914.md)
  `CVE-2025-40914` · CVE record: MIK CryptX · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Jun 2025 · Tags: CWE-1395
- [laravel-auth0 SDK Deserialization of Untrusted Data vulnerability](https://agentprime.io/advisories/GHSA-c42h-56wx-h85q.md)
  `GHSA-c42h-56wx-h85q`, `PKSA-73kk-h2rk-mk8g` · Packagist `auth0/login`: affected `>=7.0.0-BETA1, <7.2.2`, fixed in `7.2.2` · CVSS 4.0, no score published · Not analysed yet · Published 6 Jun 2025 · Tags: Insecure deserialization, CWE-1395
- [multicast in source builds from vulnerable setuptools dependency](https://agentprime.io/advisories/GHSA-94v7-wxj6-r2q5.md)
  `GHSA-94v7-wxj6-r2q5` · PyPI `multicast`: affected `<2.0.9a0`, fixed in `2.0.9a0` · CVSS 4.0, no score published · Not analysed yet · Published 28 May 2025 · Tags: CWE-1395
- [BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities](https://agentprime.io/advisories/CVE-2025-40906.md)
  `CVE-2025-40906` · CVE record: MONGODB BSON::XS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 May 2025 · Tags: Memory corruption, CWE-1104, CWE-1395
- [FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library](https://agentprime.io/advisories/CVE-2025-40907.md)
  `CVE-2025-40907` · CVE record: ETHER FCGI · CVSS 5.3 Medium · Not analysed yet · Published 16 May 2025 · Tags: Memory corruption, CWE-1395
- [CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0](https://agentprime.io/advisories/GHSA-ggpf-24jw-3fcw.md)
  `GHSA-ggpf-24jw-3fcw` · PyPI `vllm`: affected `<0.8.0`, fixed in `0.8.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Apr 2025 · Tags: CWE-1395
- [Nokogiri updates packaged libxml2 to v2.13.8 to resolve CVE-2025-32414 and CVE-2025-32415](https://agentprime.io/advisories/GHSA-5w6v-399v-w3cc.md)
  `GHSA-5w6v-399v-w3cc`, `CVE-2025-71346` · RubyGems `nokogiri`: affected `<1.18.8`, fixed in `1.18.8` · No CVSS score · Not analysed yet · Published 21 Apr 2025 · Tags: CWE-1395
- [vLLM vulnerable to Denial of Service by abusing xgrammar cache](https://agentprime.io/advisories/GHSA-hf3c-wxg2-49q9.md)
  `GHSA-hf3c-wxg2-49q9` · PyPI `vllm`: affected `>=0.6.5, <0.8.4`, fixed in `0.8.4` · CVSS 6.5 Medium · Not analysed yet · Published 15 Apr 2025 · Tags: Denial of service, CWE-1395
- [RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency](https://agentprime.io/advisories/GHSA-g9pc-8g42-g6vq.md)
  `GHSA-g9pc-8g42-g6vq`, `BIT-golang-2025-22871`, `CVE-2025-22871`, `GO-2025-3563`, `PKSA-xbp4-qwr2-cbjj` · Packagist `spiral/roadrunner`: affected `<2025.1.0`, fixed in `2025.1.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Apr 2025 · Tags: HTTP request smuggling, CWE-1395
- [Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs](https://agentprime.io/advisories/GHSA-mrxw-mxhj-p664.md)
  `GHSA-mrxw-mxhj-p664`, `CVE-2025-71406` · RubyGems `nokogiri`: affected `<1.18.4`, fixed in `1.18.4` · CVSS 7.8 High · Not analysed yet · Published 14 Mar 2025 · Tags: Memory corruption, CWE-1395
- [cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002)](https://agentprime.io/advisories/GHSA-h2rp-8vpx-q9r4.md)
  `GHSA-h2rp-8vpx-q9r4`, `GO-2025-3520` · Go `github.com/cheqd/cheqd-node`: affected `<3.1.8`, fixed in `3.1.8` · No CVSS score · Not analysed yet · Published 13 Mar 2025 · Tags: CWE-1395
- [Duplicate Advisory: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171](https://agentprime.io/advisories/GHSA-5mwf-688x-mr7x.md)
  `GHSA-5mwf-688x-mr7x` · RubyGems `nokogiri`: affected `<1.18.3`, fixed in `1.18.3` · No CVSS score · Withdrawn · Not analysed yet · Published 19 Feb 2025 · Tags: CWE-1395
- [Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171](https://agentprime.io/advisories/GHSA-vvfq-8hwr-qm4m.md)
  `GHSA-vvfq-8hwr-qm4m`, `CVE-2025-71407` · RubyGems `nokogiri`: affected `<1.18.3`, fixed in `1.18.3` · No CVSS score · Not analysed yet · Published 18 Feb 2025 · Tags: Memory corruption, CWE-1395
- [Vulnerable OpenSSL included in cryptography wheels](https://agentprime.io/advisories/GHSA-79v4-65xg-pq4g.md)
  `GHSA-79v4-65xg-pq4g`, `CVE-2024-12797`, `PYSEC-2026-1284` · PyPI `cryptography`: affected `>=42.0.0, <44.0.1`, fixed in `44.0.1` · CVSS 6.3 Medium · Not analysed yet · Published 11 Feb 2025 · Tags: CWE-392, CWE-1395
- [Multiple rtmpdump vulnerabilities](https://agentprime.io/advisories/GHSA-vrpv-vw92-328g.md)
  `GHSA-vrpv-vw92-328g`, `PKSA-tznq-ytp5-qpq1` · Packagist `rudloff/rtmpdump-bin`: affected `<=2.3.1`, no fixed version yet · No CVSS score · Not analysed yet · Published 6 Feb 2025 · Tags: CWE-1395
- [Dependency on Vulnerable Third-Party Component exposes Vulnerabilities in NI Vision Software](https://agentprime.io/advisories/CVE-2024-12740.md)
  `CVE-2024-12740` · CVE record: NI Vision Development Module and 4 more · CVSS 7.0 High · Not analysed yet · Published 27 Jan 2025 · Tags: CWE-1395
- [The Umbraco Heartcore headless client library uses a vulnerable Refit dependency package](https://agentprime.io/advisories/GHSA-mgr7-5782-6jh9.md)
  `GHSA-mgr7-5782-6jh9` · NuGet `Umbraco.Headless.Client.Net`: affected `<1.5.0`, fixed in `1.5.0` · No CVSS score · Not analysed yet · Published 13 Jan 2025 · Tags: Other injection, CWE-1395
- [Cross Site Scripting (XSS) vulnerability while uploading content to a new deployment](https://agentprime.io/advisories/GHSA-64gp-r758-8pfm.md)
  `GHSA-64gp-r758-8pfm` · Maven `org.jboss.hal:hal-console`: affected `<3.7.7.Final`, fixed in `3.7.7.Final` · CVSS 4.0, no score published · Not analysed yet · Published 23 Dec 2024 · Tags: Cross-site scripting (XSS), CWE-1395
- [pyrage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution](https://agentprime.io/advisories/GHSA-47h8-jmp3-9f28.md)
  `GHSA-47h8-jmp3-9f28`, `CVE-2024-56327`, `PYSEC-2026-1839` · PyPI `pyrage`: affected `>=1.2.0, <1.2.3`, fixed in `1.2.3` · CVSS 7.7 High · Not analysed yet · Published 19 Dec 2024 · Tags: Code injection, CWE-25, CWE-1395
- [GFI Archiver Telerik Web UI Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-11948.md)
  `CVE-2024-11948` · CVE record: GFI Archiver · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Dec 2024 · Tags: CWE-1395
- [Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify](https://agentprime.io/advisories/GHSA-m4gq-x24j-jpmf.md)
  `GHSA-m4gq-x24j-jpmf` · npm `mermaid`: affected `<10.9.3`, fixed in `10.9.3` · CVSS 7.0 High · Not analysed yet · Published 22 Oct 2024 · Tags: Prototype pollution, CWE-1395
- [curl_cffi bundles a version of libcurl affected by High Severity vulnerability](https://agentprime.io/advisories/GHSA-3vpc-4p9p-47hc.md)
  `GHSA-3vpc-4p9p-47hc` · PyPI `curl-cffi`: affected `<0.7.0b6`, fixed in `0.7.0b6` · No CVSS score · Not analysed yet · Published 22 Oct 2024 · Tags: CWE-1395
- [hermes-management is vulnerable to RCE due to Apache commons-jxpath](https://agentprime.io/advisories/GHSA-2gh6-wc3m-g37f.md)
  `GHSA-2gh6-wc3m-g37f` · Maven `pl.allegro.tech.hermes:hermes-management`: affected `>=0.8.2, <2.2.9`, fixed in `2.2.9` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2024 · Tags: CWE-1395
- [Kimai has an XXE Leading to Local File Read](https://agentprime.io/advisories/GHSA-534c-hcr7-67jg.md)
  `GHSA-534c-hcr7-67jg`, `PKSA-xxx2-wfk5-mvc4` · Packagist `kimai/kimai`: affected `<2.21.0`, fixed in `2.21.0` · CVSS 6.5 Medium · Not analysed yet · Published 17 Sept 2024 · Tags: XML external entities (XXE), CWE-1395
- [Indico has a Cross-Site-Scripting during account creation](https://agentprime.io/advisories/GHSA-rrqf-w74j-24ff.md)
  `GHSA-rrqf-w74j-24ff`, `CVE-2024-45399`, `PYSEC-2024-90` · PyPI `indico`: affected `<3.3.4`, fixed in `3.3.4` · CVSS 4.3 Medium · Not analysed yet · Published 4 Sept 2024 · Tags: Cross-site scripting (XSS), CWE-1395
- [pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels](https://agentprime.io/advisories/GHSA-h4gh-qq45-vh27.md)
  `GHSA-h4gh-qq45-vh27` · PyPI `cryptography`: affected `>=37.0.0, <43.0.1`, fixed in `43.0.1` · No CVSS score · Not analysed yet · Published 3 Sept 2024 · Tags: CWE-1395
- [NI SystemLink Server Ships Out of Date Redis Version](https://agentprime.io/advisories/CVE-2024-6121.md)
  `CVE-2024-6121` · CVE record: NI SystemLink Server and 1 more · CVSS 7.8 High · Not analysed yet · Published 22 Jul 2024 · Tags: CWE-1395
- [Silverstripe uses TinyMCE which allows svg files linked in object tags](https://agentprime.io/advisories/GHSA-52cw-pvq9-9m5v.md)
  `GHSA-52cw-pvq9-9m5v`, `PKSA-374x-kczb-dk1n` · Packagist `silverstripe/framework`: affected `<5.2.16`, fixed in `5.2.16` · CVSS 5.4 Medium · Not analysed yet · Published 17 Jul 2024 · Tags: Cross-site scripting (XSS), CWE-1395
- [Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib](https://agentprime.io/advisories/GHSA-q5fm-55c2-v6j9.md)
  `GHSA-q5fm-55c2-v6j9` · PyPI `fiona`: affected `<1.10b1`, fixed in `1.10b1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jul 2024 · Tags: Memory corruption, CWE-1395
- [TYCO Illustra Pro Gen 4 - JQuery version](https://agentprime.io/advisories/CVE-2024-32753.md)
  `CVE-2024-32753` · CVE record: Johnson Controls TYCO Illustra Pro4 Fixed cameras and 4 more · CVSS 7.0 High · Not analysed yet · Published 11 Jul 2024 · Tags: CWE-1395
- [pdoc embeds link to malicious CDN if math mode is enabled](https://agentprime.io/advisories/GHSA-5vgj-ggm4-fg62.md)
  `GHSA-5vgj-ggm4-fg62`, `CVE-2024-38526`, `PYSEC-2026-1764` · PyPI `pdoc`: affected `<14.5.1`, fixed in `14.5.1` · CVSS 0.0 None · Not analysed yet · Published 25 Jun 2024 · Tags: CWE-1395
- [NETGEAR ProSAFE Network Management System Tomcat Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-5246.md)
  `CVE-2024-5246` · CVE record: NETGEAR ProSAFE Network Management System · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.31 · Not analysed yet · Published 23 May 2024 · Tags: CWE-1395
- [Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881](https://agentprime.io/advisories/GHSA-vjwg-28gv-pm8h.md)
  `GHSA-vjwg-28gv-pm8h`, `PKSA-8cp9-pysj-5xkk` · Packagist `pimcore/pimcore`: affected `>=11.0.0-ALPHA1, <11.1.6.5 || >=11.2.0, <11.2.3`, fixed in `11.1.6.5`, `11.2.3` · CVSS 6.1 Medium · Not analysed yet · Published 24 Apr 2024 · Tags: Cross-site scripting (XSS), CWE-1395
- [Azure SDK Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2024-21421.md)
  `CVE-2024-21421` · CVE record: Microsoft Azure SDK · CVSS 7.5 High · Not analysed yet · Published 12 Mar 2024 · Tags: CWE-1395
- [SAML authentication bypass due to missing validation on unsigned SAML messages](https://agentprime.io/advisories/GHSA-hx5q-v6pj-533r.md)
  `GHSA-hx5q-v6pj-533r` · Maven `com.linecorp.centraldogma:centraldogma-server-auth-saml`: affected `<0.64.3`, fixed in `0.64.3` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Feb 2024 · Tags: CWE-1395
- [Intumit inc. SmartRobot - Remote Code Execution](https://agentprime.io/advisories/CVE-2024-0552.md)
  `CVE-2024-0552` · CVE record: Intumit inc. SmartRobot · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jan 2024 · Tags: CWE-1395
- [Dependency on Vulnerable Third-Party Component in GitLab](https://agentprime.io/advisories/CVE-2023-5332.md)
  `CVE-2023-5332` · CVE record: GitLab GitLab · CVSS 5.9 Medium · Not analysed yet · Published 4 Dec 2023 · Tags: CWE-1395
- [ntpd has Dependency on Vulnerable Third-Party Component](https://agentprime.io/advisories/GHSA-37xq-q42p-rv3p.md)
  `GHSA-37xq-q42p-rv3p` · crates.io `ntpd`: affected `<0.3.7`, fixed in `0.3.7` · CVSS 2.6 Low · Not analysed yet · Published 24 Aug 2023 · Tags: CWE-1395

Newest: <https://agentprime.io/advisories/tag/cwe-1395.md>
Older: <https://agentprime.io/advisories/tag/cwe-1395.md?cursor=WyIyMDIzLTA4LTI0VDIyOjE4OjM5LjAwMDAwMFoiLCJHSFNBLTM3eHEtcTQycC1ydjNwIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1395&cursor=WyIyMDI1LTEyLTE3VDIwOjU3OjA5LjAwMDAwMFoiLCJHSFNBLXZ2ZzctOHJtcS05Mmc3Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1395/?cursor=WyIyMDI1LTEyLTE3VDIwOjU3OjA5LjAwMDAwMFoiLCJHSFNBLXZ2ZzctOHJtcS05Mmc3Il0>. Everything for agents: <https://agentprime.io/llms.txt>.