# CWE-253.

Every Advisory and CVE whose sources give the weakness CWE-253, newest first.

## Records, newest first

- [ModSecurity: PCRE2 \`@rxGlobal\` match-limit errors are converted to no-match](https://agentprime.io/advisories/CVE-2026-103932.md)
  `CVE-2026-103932` · CVE record: owasp-modsecurity ModSecurity · CVSS 5.8 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-253
- [Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-15686.md)
  `CVE-2026-15686` · CVE record: Adminer Adminer · CVSS 7.2 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-253
- [Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification](https://agentprime.io/advisories/CVE-2026-59847.md)
  `CVE-2026-59847` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 3 more · CVSS 5.9 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-253, CWE-1310
- [chmod: recursive mode returns exit code 0 even when some files fail (last-file-wins)](https://agentprime.io/advisories/GHSA-4x34-chg5-mwjj.md)
  `GHSA-4x34-chg5-mwjj`, `CVE-2026-35339` · crates.io `uu_chmod`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 5.5 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-252, CWE-253, CWE-755
- [bpf: Fix ld\_{abs,ind} failure path analysis in subprogs](https://agentprime.io/advisories/CVE-2026-53090.md)
  `CVE-2026-53090` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-253
- [MCU Firmware Update Authentication Bypass on Caliptra Core](https://agentprime.io/advisories/CVE-2026-5818.md)
  `CVE-2026-5818` · CVE record: Caliptra Core Runtime Firmware · CVSS 7.2 High · Not analysed yet · Published 23 Jun 2026 · Tags: CWE-253
- [Yubico webauthn-server-core: Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly…](https://agentprime.io/advisories/CVE-2026-46419.md)
  `CVE-2026-46419` · CVE record: Yubico webauthn-server-core · CVSS 7.5 High · Not analysed yet · Published 14 May 2026 · Tags: CWE-253
- [mutt before 2.3.2 has an infinite loop in data_object_to_stream in crypt-gpgme.c.](https://agentprime.io/advisories/CVE-2026-43863.md)
  `CVE-2026-43863` · CVE record: mutt mutt · CVSS 3.7 Low · Not analysed yet · Published 4 May 2026 · Tags: CWE-253
- [Duplicate Advisory: uutils coreutils incorrectly handles exit codes when processing multiple files](https://agentprime.io/advisories/GHSA-vp6q-mv9j-j428.md)
  `GHSA-vp6q-mv9j-j428` · crates.io `coreutils`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 5.5 Medium · Withdrawn · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-253
- [Duplicate Advisory: uutils coreutils has an Incorrect Check of Function Return Value](https://agentprime.io/advisories/GHSA-88ch-q68x-36v7.md)
  `GHSA-88ch-q68x-36v7` · crates.io `coreutils`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 5.5 Medium · Withdrawn · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-253
- [uutils coreutils chown and chgrp False Success Exit Code in Recursive Mode](https://agentprime.io/advisories/CVE-2026-35340.md)
  `CVE-2026-35340` · CVE record: Uutils coreutils · CVSS 5.5 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-253
- [Corosync: corosync: denial of service and information disclosure via crafted udp packet](https://agentprime.io/advisories/CVE-2026-35091.md)
  `CVE-2026-35091` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.2 High · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-253
- [The vulnerability stems from an incorrect error-checking logic in the CreateCounter() function (in threadx/utility/rtos_compatibility_layers/OSEK/tx_osek.c) when handling the return value of osek_get…](https://agentprime.io/advisories/CVE-2026-0648.md)
  `CVE-2026-0648` · CVE record: Eclipse Foundation Eclipse ThreadX · CVSS 7.8 High · Not analysed yet · Published 27 Jan 2026 · Tags: CWE-253
- [GNU Binutils prdbg.c tg_tag_type return value](https://agentprime.io/advisories/CVE-2025-11839.md)
  `CVE-2025-11839` · CVE record: GNU Binutils · CVSS 4.8 Medium · Not analysed yet · Published 16 Oct 2025 · Tags: CWE-252, CWE-253
- [Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request](https://agentprime.io/advisories/CVE-2025-57767.md)
  `CVE-2025-57767` · CVE record: asterisk asterisk · CVSS 7.5 High · Not analysed yet · Published 28 Aug 2025 · Tags: CWE-253
- [Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64](https://agentprime.io/advisories/CVE-2025-54090.md)
  `CVE-2025-54090` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 6.3 Medium · Not analysed yet · Published 23 Jul 2025 · Tags: CWE-253
- [Windows Hyper-V Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2024-43521.md)
  `CVE-2024-43521` · CVE record: Microsoft Windows Server 2012 and 4 more · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2024 · Tags: CWE-253
- [Envoy RELEASE_ASSERT using auto_sni with :authority header > 255 bytes](https://agentprime.io/advisories/CVE-2024-32475.md)
  `CVE-2024-32475` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 18 Apr 2024 · Tags: Denial of service, CWE-253
- [Routinator terminates when RTR connection is reset too quickly after opening](https://agentprime.io/advisories/CVE-2024-1622.md)
  `CVE-2024-1622` · CVE record: NLnet Labs Routinator · CVSS 7.5 High · Not analysed yet · Published 26 Feb 2024 · Tags: CWE-253
- [An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_41284C function.](https://agentprime.io/advisories/CVE-2023-52040.md)
  `CVE-2023-52040` · CVE record · CVSS 8.8 High · Not analysed yet · Published 24 Jan 2024 · Tags: CWE-253
- [Denial of Service in Helper Process management](https://agentprime.io/advisories/CVE-2023-49286.md)
  `CVE-2023-49286` · CVE record: squid-cache squid · CVSS 8.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.10 · Not analysed yet · Published 4 Dec 2023 · Tags: Denial of service, CWE-253
- [Authentication bypass in OpenText (Micro Focus) Enterprise Server](https://agentprime.io/advisories/CVE-2023-4501.md)
  `CVE-2023-4501` · CVE record: OpenText Visual COBOL, COBOL Server, Enterprise Developer, Enterprise Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Sept 2023 · Tags: Authentication bypass, CWE-253, CWE-305, CWE-358
- [Arbitrary file read](https://agentprime.io/advisories/CVE-2023-24487.md)
  `CVE-2023-24487` · CVE record: Citrix Citrix ADC and Citrix Gateway · CVSS 6.3 Medium · Not analysed yet · Published 10 Jul 2023 · Tags: CWE-253
- [ink! vulnerable to incorrect decoding of storage value when using \`DelegateCall\`](https://agentprime.io/advisories/GHSA-853p-5678-hv8f.md)
  `GHSA-853p-5678-hv8f`, `CVE-2023-34449` · crates.io `ink` and 1 more: affected `>=4.0.0, <4.2.1`, fixed in `4.2.1` · CVSS 5.3 Medium · Not analysed yet · Published 14 Jun 2023 · Tags: CWE-253, CWE-754
- [Potential Captcha Validate Bypass in flask-session-captcha](https://agentprime.io/advisories/GHSA-7r87-cj48-wj45.md)
  `GHSA-7r87-cj48-wj45`, `CVE-2022-24880`, `PYSEC-2022-193` · PyPI `flask-session-captcha`: affected `<1.2.1`, fixed in `1.2.1` · CVSS 5.3 Medium · Not analysed yet · Published 26 Apr 2022 · Tags: CWE-253, CWE-394, CWE-754
- [Incorrect Check of Function Return Value in Skytable](https://agentprime.io/advisories/CVE-2021-37625.md)
  `CVE-2021-37625` · CVE record: skytable skytable · CVSS 7.5 High · Not analysed yet · Published 5 Aug 2021 · Tags: CWE-252, CWE-253
- [F2fs-Tools: An exploitable information disclosure vulnerability exists in the dev_read functionality…](https://agentprime.io/advisories/CVE-2020-6107.md)
  `CVE-2020-6107` · CVE record: F2fs-Tools · CVSS 4.4 Medium · Not analysed yet · Published 15 Oct 2020 · Tags: CWE-253
- [keycloak-connect and keycloak-js improperly handle invalid tokens](https://agentprime.io/advisories/GHSA-mw35-24gh-f82w.md)
  `GHSA-mw35-24gh-f82w`, `CVE-2017-7474` · npm `keycloak-connect` and 1 more: affected `>=2.5.0, <3.1.0`, fixed in `3.1.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Nov 2017 · Tags: CWE-253

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-253>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-253/>. Everything for agents: <https://agentprime.io/llms.txt>.