# CWE-20.

Every Advisory and CVE whose sources give the weakness CWE-20, newest first.

## Records, newest first (an older page)

- [IXP Manager has authenticated non-administrator privilege escalation](https://agentprime.io/advisories/CVE-2026-63339.md)
  `CVE-2026-63339` · CVE record: inex IXP-Manager · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Privilege escalation, CWE-20
- [libriscv: Out of bounds read vuln in the ELF parser (Denial of service)](https://agentprime.io/advisories/CVE-2026-62958.md)
  `CVE-2026-62958` · CVE record: libriscv libriscv · CVSS 7.9 High · Not analysed yet · Published 30 Oct 2026 · Tags: Memory corruption, CWE-20
- [Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass](https://agentprime.io/advisories/CVE-2026-119342.md)
  `CVE-2026-119342` · CVE record: Stirling-Tools Stirling-PDF · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal, Server-side request forgery (SSRF), CWE-20, CWE-610
- [Tesseract: Crafted LSTM model (\`WeightMatrix\` mode byte) triggers \`ASSERT_HOST\` abort in \`WeightMatrix::DeSerializeOld\` under \`FAST_FLOAT\` — Denial of Service](https://agentprime.io/advisories/CVE-2026-119339.md)
  `CVE-2026-119339` · CVE record: tesseract-ocr tesseract · CVSS 5.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service, CWE-20
- [OpenVM: MemoryMerkleAir allows below-leaf rows to alter memory roots](https://agentprime.io/advisories/CVE-2026-62333.md)
  `CVE-2026-62333` · CVE record: openvm-org openvm · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-20
- [OpenVM's OpenVmHalo2Verifier accepts non-canonical app commitments](https://agentprime.io/advisories/CVE-2026-62335.md)
  `CVE-2026-62335` · CVE record: openvm-org openvm · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-20
- [SNARK Verifier: Halo 2 aggregation mishandles point-at-infinity proof elements](https://agentprime.io/advisories/CVE-2026-62337.md)
  `CVE-2026-62337` · CVE record: axiom-crypto snark-verifier · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-20
- [SNARK Verifier: noncanonical accumulator limb decoding](https://agentprime.io/advisories/CVE-2026-61618.md)
  `CVE-2026-61618` · CVE record: axiom-crypto snark-verifier · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-20
- [AdminNeo: version-cache array injection causes persistent denial of service](https://agentprime.io/advisories/GHSA-jm85-8cpp-9cjc.md)
  `GHSA-jm85-8cpp-9cjc`, `CVE-2026-59978`, `PKSA-j37s-v4jh-54ry` · Packagist `adminneo-org/adminneo`: affected `>=4.6.2, <5.5.0`, fixed in `5.5.0` · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-20
- [Improper input validation in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-91917.md)
  `CVE-2026-91917` · CVE record: Dell OpenManage Enterprise · CVSS 8.0 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-20
- [GroupEx PRO ( Daxko ) integration - Critical - Unsupported - SA-CONTRIB-2026-278](https://agentprime.io/advisories/CVE-2026-118565.md)
  `CVE-2026-118565` · CVE record: Drupal GroupEx PRO ( Daxko ) integration · CVSS 7.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-20
- [Improper input validation in Google Chrome](https://agentprime.io/advisories/CVE-2026-76029.md)
  `CVE-2026-76029` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-20
- [Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption](https://agentprime.io/advisories/CVE-2026-118776.md)
  `CVE-2026-118776` · CVE record: digitalbazaar forge · CVSS 3.7 Low · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-20, CWE-354
- [Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence](https://agentprime.io/advisories/GHSA-c33x-vcv4-vg3g.md)
  `GHSA-c33x-vcv4-vg3g` · crates.io `cedar-policy` and 1 more: affected `>=3.0.0, <3.4.3 || >=4.0.0, <4.11.1`, fixed in `3.4.3`, `4.11.1` · CVSS 4.0, no score published · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-20
- [Pre-Authentication SSH Denial of Service via Malformed Public-Key Signature in Progress WS_FTP Server](https://agentprime.io/advisories/CVE-2026-90869.md)
  `CVE-2026-90869` · CVE record: Progress Software WS_FTP Server · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Memory corruption, CWE-20
- [Improper input validation in Samsung Mobile Bixby](https://agentprime.io/advisories/CVE-2026-21157.md)
  `CVE-2026-21157` · CVE record: Samsung Mobile Bixby · CVSS 8.3 High · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-20
- [Improper input validation in Apple swift-crypto](https://agentprime.io/advisories/CVE-2026-86983.md)
  `CVE-2026-86983` · CVE record: Apple swift-crypto · CVSS 5.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-20
- [a2ui Image Player/Video Player/Audio Player Image.js input validation](https://agentprime.io/advisories/CVE-2026-118537.md)
  `CVE-2026-118537` · CVE record: a2ui · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-20
- [OpenCATS: Authenticated SQL injection in activity DataGrid date filters](https://agentprime.io/advisories/CVE-2026-54455.md)
  `CVE-2026-54455` · CVE record: opencats OpenCATS · CVSS 7.6 High · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection, CWE-20
- [vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE](https://agentprime.io/advisories/GHSA-h3rc-j82p-2c3h.md)
  `GHSA-h3rc-j82p-2c3h`, `CVE-2026-115915`, `PYSEC-2026-4346` · PyPI `vllm`: affected `<0.32.0`, fixed in `0.32.0` · CVSS 8.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-20, CWE-183
- [zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE](https://agentprime.io/advisories/GHSA-m665-v7pm-7grj.md)
  `GHSA-m665-v7pm-7grj`, `CVE-2026-115905` · crates.io `zip`: affected `<9.0.5`, fixed in `9.0.5` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-20, CWE-436
- [Server-side expression parser denial of service](https://agentprime.io/advisories/CVE-2026-88858.md)
  `CVE-2026-88858` · CVE record: Grafana Grafana OSS and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service, CWE-20
- [Azure Monitor access token disclosure via SSRF](https://agentprime.io/advisories/CVE-2026-88967.md)
  `CVE-2026-88967` · CVE record: Grafana Grafana Enterprise and 1 more · CVSS 7.7 High · Not analysed yet · Published 28 Oct 2026 · Tags: Hard-coded credentials, Server-side request forgery (SSRF), CWE-20
- [Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation](https://agentprime.io/advisories/CVE-2026-111551.md)
  `CVE-2026-111551` · CVE record: Apache Software Foundation Apache Kafka · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service, CWE-20
- [HCL BigFix AEX is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-21830.md)
  `CVE-2026-21830` · CVE record: HCL Software BigFix AEX · CVSS 3.7 Low · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-20
- [Request forgery via news: links](https://agentprime.io/advisories/CVE-2026-118179.md)
  `CVE-2026-118179` · CVE record: Mozilla Thunderbird · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-20
- [MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement](https://agentprime.io/advisories/CVE-2026-118173.md)
  `CVE-2026-118173` · CVE record: MISP misp-guard · CVSS 6.1 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control, CWE-20
- [Fireware OS XPath Injection in SSH Authentication Allows Blind Extraction of Configuration Secrets](https://agentprime.io/advisories/CVE-2026-93434.md)
  `CVE-2026-93434` · CVE record: WatchGuard Fireware OS · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Other injection, CWE-20, CWE-208
- [LiteLLM: internal_user_viewer arbitrary local file read via \`vertex_ai_credentials\`](https://agentprime.io/advisories/GHSA-g5ff-637f-6q2m.md)
  `GHSA-g5ff-637f-6q2m` · PyPI `litellm`: affected `<1.95.0`, fixed in `1.95.0` · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Path traversal, CWE-20
- [Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped](https://agentprime.io/advisories/GHSA-g73g-hqqh-jr95.md)
  `GHSA-g73g-hqqh-jr95`, `CVE-2026-110870` · npm `nodemailer`: affected `>=3.0.0, <10.0.13`, fixed in `10.0.13` · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-20, CWE-436
- [Authlib: empty signatures validation in JWS JSON deserialization](https://agentprime.io/advisories/GHSA-6v38-4h7w-rj9h.md)
  `GHSA-6v38-4h7w-rj9h`, `CVE-2026-96760` · PyPI `authlib`: affected `<1.9.0`, fixed in `1.9.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Weak cryptography or TLS, CWE-20, CWE-358, CWE-670
- [Other issue in the SVG component](https://agentprime.io/advisories/CVE-2026-118025.md)
  `CVE-2026-118025` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-20
- [MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)](https://agentprime.io/advisories/GHSA-6hp3-vr39-rqw8.md)
  `GHSA-6hp3-vr39-rqw8`, `CVE-2026-48705` · PyPI `monai`: affected `<1.6.1`, fixed in `1.6.1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-20, CWE-682
- [dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS](https://agentprime.io/advisories/GHSA-px68-xx5g-48q5.md)
  `GHSA-px68-xx5g-48q5`, `CVE-2026-46350` · npm `dcmjs`: affected `<0.52.0`, fixed in `0.52.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-20, CWE-1284
- [Improper input validation in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112682.md)
  `CVE-2026-112682` · CVE record: Apple iOS and iPadOS and 3 more · CVSS 7.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-20
- [Improper input validation in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112620.md)
  `CVE-2026-112620` · CVE record: Apple iOS and iPadOS and 3 more · CVSS 7.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-20
- [Improper input validation in Apple macOS](https://agentprime.io/advisories/CVE-2026-113899.md)
  `CVE-2026-113899` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-20
- [Improper input validation in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-113913.md)
  `CVE-2026-113913` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-20
- [Improper input validation in Apple macOS](https://agentprime.io/advisories/CVE-2026-112555.md)
  `CVE-2026-112555` · CVE record: Apple macOS · CVSS 8.2 High · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-20
- [Improper input validation in Apple macOS](https://agentprime.io/advisories/CVE-2026-112430.md)
  `CVE-2026-112430` · CVE record: Apple macOS · CVSS 8.4 High · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-20
- [Improper input validation in Apple Safari and others](https://agentprime.io/advisories/CVE-2026-86985.md)
  `CVE-2026-86985` · CVE record: Apple Safari and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-20
- [Improper input validation in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112658.md)
  `CVE-2026-112658` · CVE record: Apple iOS and iPadOS and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-20
- [Infinite loop in Xpdf due to missing validation in JPEG 2000 decoder](https://agentprime.io/advisories/CVE-2026-116671.md)
  `CVE-2026-116671` · CVE record: Xpdf Xpdf · CVSS 2.1 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Denial of service, CWE-20
- [MISP Guard Case-Sensitive Policy Bypass Allows Unauthorized Feed Data Forwarding](https://agentprime.io/advisories/CVE-2026-116469.md)
  `CVE-2026-116469` · CVE record: MISP misp-guard · CVSS 7.1 High · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-20, CWE-178
- [MISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules](https://agentprime.io/advisories/CVE-2026-116372.md)
  `CVE-2026-116372` · CVE record: MISP misp-guard · CVSS 7.7 High · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-20
- [Ndemic Creations Plague Inc Evolved Workshop Scenario Loader deserialization](https://agentprime.io/advisories/CVE-2026-116230.md)
  `CVE-2026-116230` · CVE record: Ndemic Creations Plague Inc Evolved · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Insecure deserialization, CWE-20
- [GiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency](https://agentprime.io/advisories/CVE-2026-111974.md)
  `CVE-2026-111974` · CVE record: Unknown GiveWP · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-20
- [SteelRaven7 Ravenfield RFL Custom Map Handler/RFLD Custom Map cacheCoverPoints deserialization](https://agentprime.io/advisories/CVE-2026-116098.md)
  `CVE-2026-116098` · CVE record: SteelRaven7 Ravenfield · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Insecure deserialization, CWE-20
- [vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the engine by sending inconsistent multimodal metadata to the disaggregated /inferenc...](https://agentprime.io/advisories/GHSA-34qw-q2h2-jp3m.md)
  `GHSA-34qw-q2h2-jp3m`, `CVE-2026-116178`, `PYSEC-2026-4353` · PyPI `vllm`: affected `>=0.20.0, <0.30.0`, fixed in `0.30.0` · CVSS 8.2 High · Not analysed yet · Published 25 Oct 2026 · Tags: CWE-20
- [vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate EngineCore by bypassing logprob_token_ids limits in the Rust gRPC frontend. Attac...](https://agentprime.io/advisories/GHSA-6pgw-f3pv-4h8q.md)
  `GHSA-6pgw-f3pv-4h8q`, `CVE-2026-116173`, `PYSEC-2026-4350` · PyPI `vllm`: affected `>=0.22.0, <0.24.0`, fixed in `0.24.0` · CVSS 8.2 High · Not analysed yet · Published 25 Oct 2026 · Tags: CWE-20
- [vLLM 0.22.0 before 0.24.0 Denial of Service via Rust gRPC Generate](https://agentprime.io/advisories/CVE-2026-116174.md)
  `CVE-2026-116174` · CVE record: vllm-project vllm · CVSS 8.2 High · Not analysed yet · Published 25 Oct 2026 · Tags: CWE-20
- [vLLM 0.22.0 before 0.24.0 DoS via Rust gRPC CandidateTokens.top_n](https://agentprime.io/advisories/CVE-2026-116172.md)
  `CVE-2026-116172` · CVE record: vllm-project vllm · CVSS 8.2 High · Not analysed yet · Published 25 Oct 2026 · Tags: CWE-20
- [Parse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes](https://agentprime.io/advisories/CVE-2026-116164.md)
  `CVE-2026-116164` · CVE record: parse-community parse-server · CVSS 6.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: CWE-20
- [LangGraph: Namespace labels containing \`.\` reach other namespaces in Postgres and SQLite stores](https://agentprime.io/advisories/GHSA-6hmw-9432-67qq.md)
  `GHSA-6hmw-9432-67qq`, `CVE-2026-115883` · PyPI `langgraph-checkpoint-postgres` and 1 more: affected `<3.1.3`, fixed in `3.1.3` · CVSS 6.0 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control, CWE-20
- [Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient](https://agentprime.io/advisories/GHSA-8c8m-p3m8-cjg8.md)
  `GHSA-8c8m-p3m8-cjg8`, `CVE-2026-121424` · npm `nodemailer`: affected `>=3.0.0, <10.1.4`, fixed in `10.1.4` · CVSS 8.3 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-20, CWE-436
- [Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient](https://agentprime.io/advisories/GHSA-m943-m63m-w62w.md)
  `GHSA-m943-m63m-w62w`, `CVE-2026-121425` · npm `nodemailer`: affected `>=3.0.0, <10.1.4`, fixed in `10.1.4` · CVSS 8.3 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-20, CWE-436
- [Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name](https://agentprime.io/advisories/GHSA-85x2-q946-cp5h.md)
  `GHSA-85x2-q946-cp5h`, `CVE-2026-121426` · npm `nodemailer`: affected `>=3.0.0, <10.1.4`, fixed in `10.1.4` · CVSS 8.3 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-20, CWE-436
- [fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization](https://agentprime.io/advisories/GHSA-wjr9-j795-jxcr.md)
  `GHSA-wjr9-j795-jxcr`, `CVE-2026-110180` · npm `fast-uri`: affected `>=2.4.2, <2.4.8 || >=3.1.3, <3.1.9 || >=4.0.1, <4.2.3`, fixed in `2.4.8`, `3.1.9`, `4.2.3` · CVSS 4.8 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-20, CWE-436
- [Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters](https://agentprime.io/advisories/CVE-2026-55444.md)
  `CVE-2026-55444` · CVE record: intranda goobi-viewer-core · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: SQL injection, Other injection, CWE-20
- [Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection](https://agentprime.io/advisories/CVE-2026-55442.md)
  `CVE-2026-55442` · CVE record: intranda goobi-viewer-core · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-20, CWE-116

Newest: <https://agentprime.io/advisories/tag/cwe-20.md>
Older: <https://agentprime.io/advisories/tag/cwe-20.md?cursor=WyIyMDI2LTEwLTIzVDE0OjE0OjI2LjQ1NTAwMFoiLCJDVkUtMjAyNi01NTQ0MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-20&cursor=WyIyMDI2LTEwLTMwVDIyOjUyOjQ3LjAwMDAwMFoiLCJHSFNBLTc5d3YtOHJoMi05dnAyIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-20/?cursor=WyIyMDI2LTEwLTMwVDIyOjUyOjQ3LjAwMDAwMFoiLCJHSFNBLTc5d3YtOHJoMi05dnAyIl0>. Everything for agents: <https://agentprime.io/llms.txt>.