# CWE-345.

Every Advisory and CVE whose sources give the weakness CWE-345, newest first.

## Records, newest first (an older page)

- [Gradient: Unauthenticated worker on /proto → arbitrary NAR write / cache poisoning](https://agentprime.io/advisories/CVE-2026-44592.md)
  `CVE-2026-44592` · CVE record: wavelens gradient · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2026 · Tags: Authentication bypass, Broken access control, CWE-345
- [CubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host Header](https://agentprime.io/advisories/CVE-2026-45055.md)
  `CVE-2026-45055` · CVE record: cubecart v6 · CVSS 8.1 High · Not analysed yet · Published 13 May 2026 · Tags: Open redirect, CWE-20, CWE-345, CWE-784
- [Duplicate Advisory: OpenClaw: Isolated cron awareness events were recorded as trusted system events](https://agentprime.io/advisories/GHSA-m5j2-r859-r5cv.md)
  `GHSA-m5j2-r859-r5cv` · npm `openclaw`: affected `<2026.4.20`, fixed in `2026.4.20` · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 11 May 2026 · Tags: CWE-345
- [go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git](https://agentprime.io/advisories/GHSA-389r-gv7p-r3rp.md)
  `GHSA-389r-gv7p-r3rp`, `CVE-2026-45022`, `GO-2026-5074` · Go `github.com/go-git/go-git/v5` and 1 more: affected `<5.19.0`, fixed in `5.19.0` · CVSS 7.0 High · Not analysed yet · Published 11 May 2026 · Tags: CWE-180, CWE-345
- [Note Mark has a JWT Secret Weakness that allows Full Account Takeover via Token Forgery](https://agentprime.io/advisories/GHSA-q6mh-rqwh-g786.md)
  `GHSA-q6mh-rqwh-g786`, `CVE-2026-44523`, `GO-2026-5567` · Go `github.com/enchant97/note-mark/backend`: affected `<0.0.0-20260501152247-18b587758667`, fixed in `0.0.0-20260501152247-18b587758667` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 May 2026 · Tags: Weak cryptography or TLS, CWE-345
- [Spring Cloud AWS missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications](https://agentprime.io/advisories/GHSA-r4w4-wv68-qv85.md)
  `GHSA-r4w4-wv68-qv85`, `CVE-2026-44308` · Maven `io.awspring.cloud:spring-cloud-aws-sns`: affected `>=4.0.0, <4.0.2 || >=3.0.0, <=3.4.2`, fixed in `4.0.2` · CVSS 6.3 Medium · Not analysed yet · Published 7 May 2026 · Tags: CWE-345
- [axonflow-sdk-java: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification](https://agentprime.io/advisories/GHSA-248h-974q-xrc2.md)
  `GHSA-248h-974q-xrc2` · Maven `com.getaxonflow:axonflow-sdk`: affected `<7.0.0`, fixed in `7.0.0` · CVSS 5.9 Medium · Not analysed yet · Published 6 May 2026 · Tags: Weak cryptography or TLS, CWE-345
- [axonflow-sdk-typescript: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification](https://agentprime.io/advisories/GHSA-mph8-9v29-pm42.md)
  `GHSA-mph8-9v29-pm42` · npm `@axonflow/sdk`: affected `<6.0.0`, fixed in `6.0.0` · CVSS 5.9 Medium · Not analysed yet · Published 6 May 2026 · Tags: Weak cryptography or TLS, CWE-345
- [axonflow-sdk-go: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification](https://agentprime.io/advisories/GHSA-mhc4-qq83-fmrr.md)
  `GHSA-mhc4-qq83-fmrr`, `GO-2026-5508` · Go `github.com/getaxonflow/axonflow-sdk-go/v5`: affected `<5.7.0`, fixed in `5.7.0` · CVSS 5.9 Medium · Not analysed yet · Published 6 May 2026 · Tags: Weak cryptography or TLS, CWE-345
- [axonflow-sdk-python: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification](https://agentprime.io/advisories/GHSA-7f4h-6264-89fr.md)
  `GHSA-7f4h-6264-89fr` · PyPI `axonflow`: affected `<6.7.0`, fixed in `6.7.0` · CVSS 5.9 Medium · Not analysed yet · Published 6 May 2026 · Tags: Weak cryptography or TLS, CWE-345
- [Vaultwarden WebAuthn credential metadata tampered before signature verification](https://agentprime.io/advisories/CVE-2026-31835.md)
  `CVE-2026-31835` · CVE record: dani-garcia vaultwarden · CVSS 5.3 Medium · Not analysed yet · Published 5 May 2026 · Tags: CWE-345
- [awslabs/tough is Missing Delegated Metadata Validation](https://agentprime.io/advisories/GHSA-4v58-8p28-2rq3.md)
  `GHSA-4v58-8p28-2rq3`, `CVE-2026-6967` · crates.io `tough` and 1 more: affected `>=0.9.0, <0.22.0`, fixed in `0.22.0` · CVSS 7.1 High · Not analysed yet · Published 5 May 2026 · Tags: CWE-345
- [nuts-node has JWT type confusion in v1 access token introspection that allows VP replay as access token](https://agentprime.io/advisories/GHSA-9hmg-827w-9rhj.md)
  `GHSA-9hmg-827w-9rhj`, `CVE-2026-41164`, `GO-2026-5291` · Go `github.com/nuts-foundation/nuts-node`: affected `<=1.1.0`, no fixed version yet · CVSS 4.4 Medium · Not analysed yet · Published 5 May 2026 · Tags: CWE-345
- [apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)](https://agentprime.io/advisories/GHSA-hcwr-pq9g-rq3m.md)
  `GHSA-hcwr-pq9g-rq3m`, `CVE-2026-42575`, `GO-2026-5422` · Go `chainguard.dev/apko`: affected `<1.2.7`, fixed in `1.2.7` · CVSS 7.5 High · Not analysed yet · Published 4 May 2026 · Tags: CWE-345, CWE-494
- [Dolibarr has Insufficient Verification of Data Authenticity](https://agentprime.io/advisories/GHSA-jggh-5rmh-r6h5.md)
  `GHSA-jggh-5rmh-r6h5`, `CVE-2026-7689`, `PKSA-dxkr-sbbp-889v` · Packagist `dolibarr/dolibarr`: affected `<=15.0.3`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 3 May 2026 · Tags: Weak cryptography or TLS, CWE-345
- [TRENDnet TEW-821DAP Firmware Update cameo_dev.sh platform_do_upgrade_cameo_dev data authenticity](https://agentprime.io/advisories/CVE-2026-7611.md)
  `CVE-2026-7611` · CVE record: TRENDnet TEW-821DAP · CVSS 6.3 Medium · Not analysed yet · Published 2 May 2026 · Tags: CWE-345
- [TRENDnet TEW-821DAP Firmware Update new_gui_update_firmware data authenticity](https://agentprime.io/advisories/CVE-2026-7606.md)
  `CVE-2026-7606` · CVE record: TRENDnet TEW-821DAP · CVSS 6.3 Medium · Not analysed yet · Published 2 May 2026 · Tags: CWE-345
- [Hickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation](https://agentprime.io/advisories/GHSA-83hf-93m4-rgwq.md)
  `GHSA-83hf-93m4-rgwq`, `CVE-2026-42254` · crates.io `hickory-recursor`: affected `>=0.24.0, <0.26.0`, fixed in `0.26.0` · CVSS 4.0 Medium · Not analysed yet · Published 30 Apr 2026 · Tags: CWE-345, CWE-706
- [Five Star Restaurant Reservations <= 2.7.16 - Unauthenticated Payment Bypass via PHP Type Juggling in 'payment_id' Parameter](https://agentprime.io/advisories/CVE-2026-6498.md)
  `CVE-2026-6498` · CVE record: rustaurius Five Star Restaurant Reservations – WordPress Booking Plugin · CVSS 5.3 Medium · Not analysed yet · Published 30 Apr 2026 · Tags: CWE-345
- [OpenID Connect nonce generated but never validated — ID token replay attack](https://agentprime.io/advisories/GHSA-3gx8-q682-38mx.md)
  `GHSA-3gx8-q682-38mx`, `CVE-2026-42206`, `PKSA-h9v7-gkkk-sf31` · Packagist `roadiz/openid`: affected `<2.3.43 || >=2.5.0, <2.5.45 || >=2.6.0, <2.6.31 || >=2.7.0, <2.7.18`, fixed in `2.3.43`, `2.5.45`, `2.6.31`, `2.7.18` · CVSS 5.7 Medium · Not analysed yet · Published 29 Apr 2026 · Tags: CWE-345
- [OpenClaw: Isolated cron awareness events were recorded as trusted system events](https://agentprime.io/advisories/GHSA-57r2-h2wj-g887.md)
  `GHSA-57r2-h2wj-g887`, `CVE-2026-44999` · npm `openclaw`: affected `<2026.4.20`, fixed in `2026.4.20` · CVSS 6.3 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: CWE-345
- [Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification](https://agentprime.io/advisories/CVE-2026-6986.md)
  `CVE-2026-6986` · CVE record: Cesanta Mongoose · CVSS 6.3 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Weak cryptography or TLS, CWE-345
- [Traefik's ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authentication](https://agentprime.io/advisories/GHSA-6384-m2mw-rf54.md)
  `GHSA-6384-m2mw-rf54`, `CVE-2026-35051`, `GO-2026-5163` · Go `github.com/traefik/traefik` and 2 more: affected `<=1.7.34`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 24 Apr 2026 · Tags: CWE-345, CWE-501
- [New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud](https://agentprime.io/advisories/GHSA-xff3-5c9p-2mr4.md)
  `GHSA-xff3-5c9p-2mr4`, `CVE-2026-41432`, `GO-2026-5753` · Go `github.com/QuantumNous/new-api`: affected `<0.12.10`, fixed in `0.12.10` · CVSS 7.1 High · Not analysed yet · Published 24 Apr 2026 · Tags: Broken access control, CWE-345, CWE-1188
- [nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation](https://agentprime.io/advisories/GHSA-6973-8887-87ff.md)
  `GHSA-6973-8887-87ff`, `CVE-2026-33471` · crates.io `nimiq-block`: affected `<1.7.2`, fixed in `1.7.2` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Apr 2026 · Tags: Memory corruption, CWE-20, CWE-345, CWE-1284
- [Postiz Has Unrestricted File Upload via MIME Type Spoofing that Leads to Stored XSS](https://agentprime.io/advisories/CVE-2026-40487.md)
  `CVE-2026-40487` · CVE record: gitroomhq postiz-app · CVSS 8.9 High · Not analysed yet · Published 18 Apr 2026 · Tags: Cross-site scripting (XSS), Unrestricted file upload, CWE-345
- [OpenClaw: Agent hook events could enqueue trusted system events from unsanitized external input](https://agentprime.io/advisories/GHSA-7g8c-cfr3-vqqr.md)
  `GHSA-7g8c-cfr3-vqqr`, `CVE-2026-43534` · npm `openclaw`: affected `<2026.4.10`, fixed in `2026.4.10` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Apr 2026 · Tags: Privilege escalation, CWE-345
- [Paperclip: Approval decision attribution spoofing via client-controlled \`decidedByUserId\` in paperclip server](https://agentprime.io/advisories/GHSA-p7mm-r948-4q3q.md)
  `GHSA-p7mm-r948-4q3q` · npm `@paperclipai/server`: affected `<2026.416.0`, fixed in `2026.416.0` · CVSS 4.3 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: CWE-345
- [Defense in Depth update for NuGet Client](https://agentprime.io/advisories/GHSA-g4vj-cjjj-v7hg.md)
  `GHSA-g4vj-cjjj-v7hg` · NuGet `NuGet.CommandLine` and 2 more: affected `>=4.9.0, <4.9.7 || >=5.11.0, <5.11.7 || >=6.8.0, <6.8.2 || >=6.11.0, <6.11.2 || >=6.12.0, <6.12.5 || >=6.14.0, <6.14.3 || >=7.0.0, <7.0.3 || >=7.3.0, <7.3.1`, fixed in `4.9.7`, `5.11.7`, `6.8.2`, `6.11.2`, `6.12.5`, `6.14.3`, `7.0.3`, `7.3.1` · No CVSS score · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-345
- [SP1 V6 Recursion Circuit Row-Count Binding Gap](https://agentprime.io/advisories/GHSA-63x8-x938-vx33.md)
  `GHSA-63x8-x938-vx33`, `CVE-2026-40323` · crates.io `sp1_prover` and 2 more: affected `>=6.0.0, <6.1.0`, fixed in `6.1.0` · CVSS 8.9 High · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-345, CWE-354
- [Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering](https://agentprime.io/advisories/GHSA-h9cx-xjg6-5v2w.md)
  `GHSA-h9cx-xjg6-5v2w`, `CVE-2026-40109`, `GO-2026-5419` · Go `github.com/fluxcd/notification-controller`: affected `<1.8.3`, fixed in `1.8.3` · CVSS 3.1 Low · Not analysed yet · Published 10 Apr 2026 · Tags: Authentication bypass, CWE-345
- [Base64 decoding stops at first padded quad by default](https://agentprime.io/advisories/CVE-2026-3446.md)
  `CVE-2026-3446` · CVE record: Python Software Foundation CPython · CVSS 6.0 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-345
- [OpenClaw: \`fetchWithSsrFGuard\` replays unsafe request bodies across cross-origin redirects](https://agentprime.io/advisories/GHSA-qx8j-g322-qj6m.md)
  `GHSA-qx8j-g322-qj6m`, `CVE-2026-40037` · npm `openclaw`: affected `<2026.4.8`, fixed in `2026.4.8` · CVSS 7.1 High · Not analysed yet · Published 9 Apr 2026 · Tags: Open redirect, CWE-345
- [LobeHub: Unauthenticated authentication bypass on \`webapi\` routes via forgeable \`X-lobe-chat-auth\` header](https://agentprime.io/advisories/GHSA-5mwj-v5jw-5c97.md)
  `GHSA-5mwj-v5jw-5c97`, `CVE-2026-39411` · npm `@lobehub/lobehub`: affected `<2.1.48`, fixed in `2.1.48` · CVSS 5.0 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Authentication bypass, CWE-345
- [Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization](https://agentprime.io/advisories/GHSA-33qg-7wpp-89cq.md)
  `GHSA-33qg-7wpp-89cq`, `CVE-2026-39324` · RubyGems `rack-session`: affected `>=2.0.0, <2.1.2`, fixed in `2.1.2` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Apr 2026 · Tags: Authentication bypass, Insecure deserialization, CWE-345, CWE-565
- [WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php](https://agentprime.io/advisories/GHSA-mmw7-wq3c-wf9p.md)
  `GHSA-mmw7-wq3c-wf9p`, `CVE-2026-39366`, `PKSA-1dhf-r34w-p2f7` · Packagist `wwbn/avideo`: affected `<=26.0`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-345
- [Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Str…](https://agentprime.io/advisories/CVE-2026-3177.md)
  `CVE-2026-3177` · CVE record: smub Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More · CVSS 5.3 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-345
- [OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter](https://agentprime.io/advisories/GHSA-9jpj-g8vv-j5mf.md)
  `GHSA-9jpj-g8vv-j5mf`, `CVE-2026-34511` · npm `openclaw`: affected `<2026.4.2`, fixed in `2026.4.2` · CVSS 6.0 Medium · Not analysed yet · Published 4 Apr 2026 · Tags: Weak cryptography or TLS, CWE-345
- [nimiq/core-rs-albatross: Macro block proposal interlink bug](https://agentprime.io/advisories/CVE-2026-34061.md)
  `CVE-2026-34061` · CVE record: nimiq core-rs-albatross · CVSS 4.9 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-345
- [fast-jwt accepts unknown \`crit\` header extensions (RFC 7515 violation)](https://agentprime.io/advisories/GHSA-hm7r-c7qw-ghp6.md)
  `GHSA-hm7r-c7qw-ghp6`, `CVE-2026-35042` · npm `fast-jwt`: affected `<=6.1.0`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-345, CWE-636
- [fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)](https://agentprime.io/advisories/GHSA-rp9m-7r4c-75qg.md)
  `GHSA-rp9m-7r4c-75qg`, `CVE-2026-35039` · npm `fast-jwt`: affected `>=0.0.1, <6.2.0`, fixed in `6.2.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-345, CWE-706, CWE-1289
- [Electron: Service worker can spoof executeJavaScript IPC replies](https://agentprime.io/advisories/GHSA-xj5x-m3f3-5x3h.md)
  `GHSA-xj5x-m3f3-5x3h`, `CVE-2026-34778` · npm `electron`: affected `<38.8.6 || >=39.0.0-alpha.1, <39.8.1 || >=40.0.0-alpha.1, <40.8.1 || >=41.0.0-alpha.1, <41.0.0`, fixed in `38.8.6`, `39.8.1`, `40.8.1`, `41.0.0` · CVSS 5.9 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Authentication bypass, CWE-345
- [An issue in the firmware update mechanism of Qianniao QN-L23PA0904 v20250721.1640 allows attackers to gain root access, install backdoors, and exfiltrate data via supplying a crafted iu.sh script con…](https://agentprime.io/advisories/CVE-2026-30603.md)
  `CVE-2026-30603` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-345, CWE-494
- [openssl-encrypt silently skips schema validation when jsonschema library is not installed](https://agentprime.io/advisories/GHSA-425g-fjhq-5h92.md)
  `GHSA-425g-fjhq-5h92`, `CVE-2026-74875`, `PYSEC-2026-3755` · PyPI `openssl-encrypt`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Mar 2026 · Tags: CWE-20, CWE-345
- [mpp has multiple payment bypass and griefing vulnerabilities](https://agentprime.io/advisories/GHSA-fxc9-7j2w-vx54.md)
  `GHSA-fxc9-7j2w-vx54` · crates.io `mpp`: affected `<0.8.0`, fixed in `0.8.0` · CVSS 4.0, no score published · Not analysed yet · Published 29 Mar 2026 · Tags: Authentication bypass, CWE-345
- [mppx has multiple payment bypass and griefing vulnerabilities](https://agentprime.io/advisories/GHSA-8x4m-qw58-3pcx.md)
  `GHSA-8x4m-qw58-3pcx` · npm `mppx`: affected `<0.4.8`, fixed in `0.4.8` · CVSS 4.0, no score published · Not analysed yet · Published 29 Mar 2026 · Tags: Authentication bypass, CWE-345
- [Botpress - Credential Disclosure via Twilio Webhook Handler](https://agentprime.io/advisories/CVE-2026-4984.md)
  `CVE-2026-4984` · CVE record: botpress botpress · CVSS 8.2 High · Not analysed yet · Published 27 Mar 2026 · Tags: Cross-site request forgery (CSRF), CWE-345
- [OpenClaw: Bonjour/DNS-SD TXT metadata steers CLI routing after failed service resolution](https://agentprime.io/advisories/GHSA-rvqr-hrcc-j9vv.md)
  `GHSA-rvqr-hrcc-j9vv`, `CVE-2026-35659` · npm `openclaw`: affected `<2026.3.22`, fixed in `2026.3.22` · CVSS 5.1 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-345, CWE-642
- [OpenFGA has an Authorization Bypass through cached keys](https://agentprime.io/advisories/GHSA-h6c8-cww8-35hf.md)
  `GHSA-h6c8-cww8-35hf`, `CVE-2026-33729`, `GO-2026-4857` · Go `github.com/openfga/openfga`: affected `<1.13.1`, fixed in `1.13.1` · CVSS 5.8 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-20, CWE-345, CWE-1289
- [PuTTY Ed25519 Signature ecc-ssh.c eddsa_verify signature verification](https://agentprime.io/advisories/CVE-2026-4115.md)
  `CVE-2026-4115` · CVE record: PuTTY · CVSS 6.3 Medium · Not analysed yet · Published 22 Mar 2026 · Tags: Weak cryptography or TLS, CWE-345
- [janmojzis tinyssh Ed25519 Signature crypto_sign_ed25519_tinyssh.c signature verification](https://agentprime.io/advisories/CVE-2026-4541.md)
  `CVE-2026-4541` · CVE record: janmojzis tinyssh · CVSS 2.0 Low · Not analysed yet · Published 22 Mar 2026 · Tags: Weak cryptography or TLS, CWE-345
- [barebox: FIT Signature Verification Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-33243.md)
  `CVE-2026-33243` · CVE record: barebox barebox · CVSS 8.3 High · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-345
- [Yi Technology YI Home Camera HTTP Firmware Update ipc signature verification](https://agentprime.io/advisories/CVE-2026-4478.md)
  `CVE-2026-4478` · CVE record: Yi Technology YI Home Camera · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2026 · Tags: Weak cryptography or TLS, CWE-345
- [Nhost Storage Affected by MIME Type Spoofing via Trusted Client Content-Type Header in Storage Upload](https://agentprime.io/advisories/GHSA-g9f6-9775-hffm.md)
  `GHSA-g9f6-9775-hffm`, `CVE-2026-33221`, `GO-2026-4759` · Go `github.com/nhost/nhost`: affected `<0.0.0-20260318074820-c4bd53f042d7`, fixed in `0.0.0-20260318074820-c4bd53f042d7` · CVSS 2.1 Low · Not analysed yet · Published 18 Mar 2026 · Tags: Unrestricted file upload, CWE-343, CWE-345
- [OneUptime WhatsApp Webhook Missing Signature Verification](https://agentprime.io/advisories/GHSA-g5ph-f57v-mwjc.md)
  `GHSA-g5ph-f57v-mwjc`, `CVE-2026-33143` · npm `oneuptime`: affected `<10.0.34`, fixed in `10.0.34` · CVSS 8.7 High · Not analysed yet · Published 18 Mar 2026 · Tags: CWE-345
- [JetKVM insufficient firmware verification](https://agentprime.io/advisories/CVE-2026-32294.md)
  `CVE-2026-32294` · CVE record: JetKVM JetKVM · CVSS 7.0 High · Not analysed yet · Published 17 Mar 2026 · Tags: Weak cryptography or TLS, CWE-345
- [GL-iNet Comet (GL-RM1) KVM insufficient firmware verification](https://agentprime.io/advisories/CVE-2026-32290.md)
  `CVE-2026-32290` · CVE record: GL-iNet Comet KVM · CVSS 7.0 High · Not analysed yet · Published 17 Mar 2026 · Tags: CWE-345
- [ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack](https://agentprime.io/advisories/GHSA-hqmj-h5c6-369m.md)
  `GHSA-hqmj-h5c6-369m`, `CVE-2026-28500`, `PYSEC-2026-103` · PyPI `onnx`: affected `<1.21.0rc1`, fixed in `1.21.0rc1` · CVSS 8.6 High · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-345, CWE-494, CWE-693, CWE-829
- [HCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient authenticity verification.](https://agentprime.io/advisories/CVE-2025-52645.md)
  `CVE-2025-52645` · CVE record: HCL AION · CVSS 1.9 Low · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-345
- [Multiple security vulnerabilities affect HCL AION](https://agentprime.io/advisories/CVE-2025-52638.md)
  `CVE-2025-52638` · CVE record: HCL AION · CVSS 5.6 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-345

Newest: <https://agentprime.io/advisories/tag/cwe-345.md>
Older: <https://agentprime.io/advisories/tag/cwe-345.md?cursor=WyIyMDI2LTAzLTE2VDEyOjM1OjA2LjIyMjAwMFoiLCJDVkUtMjAyNS01MjYzOCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-345&cursor=WyIyMDI2LTA1LTE0VDIwOjE1OjQyLjAwMDAwMFoiLCJHSFNBLWpnZzktcnczMi00NHBqIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-345/?cursor=WyIyMDI2LTA1LTE0VDIwOjE1OjQyLjAwMDAwMFoiLCJHSFNBLWpnZzktcnczMi00NHBqIl0>. Everything for agents: <https://agentprime.io/llms.txt>.