# CWE-345.

Every Advisory and CVE whose sources give the weakness CWE-345, newest first.

## Records, newest first (an older page)

- [chi Has an IP Spoofing Vulnerability in \`middleware.RealIP\`](https://agentprime.io/advisories/GHSA-3fxj-6jh8-hvhx.md)
  `GHSA-3fxj-6jh8-hvhx`, `CVE-2026-72815`, `GO-2026-5774` · Go `github.com/go-chi/chi/v5` and 1 more: affected `>=5.2.1, <5.3.0`, fixed in `5.3.0` · CVSS 6.9 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Authentication bypass, CWE-345
- [chi Middleware Vulnerable to Potential IP Spoofing via \`X-Forwarded-For\` Header in \`Request.RemoteAddr\` Resolution](https://agentprime.io/advisories/GHSA-9g5q-2w5x-hmxf.md)
  `GHSA-9g5q-2w5x-hmxf`, `CVE-2026-72817`, `GO-2026-5775` · Go `github.com/go-chi/chi/middleware` and 4 more: affected `>=0.9.0, <=1.5.5`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-345, CWE-346
- [Gogs: LFS dedupe path leaks private repo content across tenants](https://agentprime.io/advisories/GHSA-6p9m-q3jp-47h4.md)
  `GHSA-6p9m-q3jp-47h4`, `CVE-2026-52812`, `GO-2026-5184` · Go `gogs.io/gogs`: affected `<0.14.3`, fixed in `0.14.3` · CVSS 7.1 High · Not analysed yet · Published 23 Jun 2026 · Tags: Broken access control, CWE-345
- [Paymenter doesn't reset email verification status after email change](https://agentprime.io/advisories/GHSA-rv89-wch8-c574.md)
  `GHSA-rv89-wch8-c574`, `CVE-2026-44584`, `PKSA-db93-h5mg-r9z4` · Packagist `paymenter/paymenter`: affected `<1.5.0`, fixed in `1.5.0` · CVSS 4.3 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: Authentication bypass, CWE-345
- [AVideo has an Authorize.Net Webhook Signature Bypass that Enables Wallet Balance Inflation via Forged Payment Data](https://agentprime.io/advisories/GHSA-95jh-7r58-xmxw.md)
  `GHSA-95jh-7r58-xmxw`, `CVE-2026-33731`, `PKSA-pwzs-6qqr-1tpq` · Packagist `wwbn/avideo`: affected `<29.0`, fixed in `29.0` · CVSS 6.5 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: CWE-345
- [Cap-go - OTP Bypass via Response Manipulation in Email Verification](https://agentprime.io/advisories/CVE-2026-56073.md)
  `CVE-2026-56073` · CVE record: Cap-go capgo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-345
- [http4k: \`HmacSha256.hash\` (despite the \`Hmac\` naming) computed a plain unkeyed digest; clarified by deprecation in favour of \`Sha256.hash\` / \`Sha256.hmac\`](https://agentprime.io/advisories/GHSA-m4w9-hjfw-vwj4.md)
  `GHSA-m4w9-hjfw-vwj4` · Maven `org.http4k:http4k-core`: affected `<6.49.0.0`, fixed in `6.49.0.0` · CVSS 4.0, no score published · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-345
- [Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag](https://agentprime.io/advisories/GHSA-wfqx-gjrf-g28r.md)
  `GHSA-wfqx-gjrf-g28r`, `GO-2026-5709` · Go `github.com/crossplane/crossplane` and 1 more: affected `<=1.21.0-rc.0`, no fixed version yet · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Jun 2026 · Tags: Race condition, CWE-345
- [CoreWCF: XML Signature Wrapping in WS-Security endorsing/supporting signature verification allows replay of captured signed messages](https://agentprime.io/advisories/GHSA-gqv6-pwcg-87r8.md)
  `GHSA-gqv6-pwcg-87r8`, `CVE-2026-54783` · NuGet `CoreWCF.Primitives`: affected `<1.8.1 || >=1.9.0, <1.9.1`, fixed in `1.8.1`, `1.9.1` · CVSS 7.4 High · Not analysed yet · Published 19 Jun 2026 · Tags: Authentication bypass, Weak cryptography or TLS, CWE-345
- [CoreWCF: SAML SubjectConfirmation methods and holder-of-key proof keys are not enforced](https://agentprime.io/advisories/GHSA-48pq-2xq3-c2m4.md)
  `GHSA-48pq-2xq3-c2m4`, `CVE-2026-54781` · NuGet `CoreWCF.Primitives`: affected `<1.8.1 || >=1.9.0, <1.9.1`, fixed in `1.8.1`, `1.9.1` · CVSS 7.4 High · Not analysed yet · Published 19 Jun 2026 · Tags: Authentication bypass, CWE-345
- [CoreWCF: SamlSerializer skips SignatureValue verification when SAML signing token is not an X.509 certificate](https://agentprime.io/advisories/GHSA-rpj7-hr7h-w6p9.md)
  `GHSA-rpj7-hr7h-w6p9`, `CVE-2026-54774` · NuGet `CoreWCF.Primitives`: affected `<1.8.1 || >=1.9.0, <1.9.1`, fixed in `1.8.1`, `1.9.1` · CVSS 7.4 High · Not analysed yet · Published 19 Jun 2026 · Tags: Weak cryptography or TLS, CWE-345
- [containerd: CRI checkpoint import allows local image tag poisoning](https://agentprime.io/advisories/GHSA-cvxm-645q-p574.md)
  `GHSA-cvxm-645q-p574`, `CVE-2026-50195`, `GO-2026-5338` · Go `github.com/containerd/containerd/v2`: affected `>=2.1.0, <2.1.9 || >=2.2.0, <2.2.5 || >=2.3.0, <2.3.2`, fixed in `2.1.9`, `2.2.5`, `2.3.2` · CVSS 5.6 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-345, CWE-829
- [symfony/ux-live-component: LiveComponentHydrator HMAC checksum lacks component and slot binding](https://agentprime.io/advisories/GHSA-34w5-c283-j9fg.md)
  `GHSA-34w5-c283-j9fg`, `CVE-2026-49212`, `PKSA-wxdb-kw41-yhdy` · Packagist `symfony/ux-live-component`: affected `>=2.8.0, <2.36.0 || >=3.0.0, <3.1.0`, fixed in `2.36.0`, `3.1.0` · CVSS 6.9 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-345
- [Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream](https://agentprime.io/advisories/GHSA-6m68-r693-78qx.md)
  `GHSA-6m68-r693-78qx`, `CVE-2026-55883`, `GO-2026-5181` · Go `github.com/tilt-dev/tilt`: affected `>=0.24.0, <0.37.4`, fixed in `0.37.4` · CVSS 8.3 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-345
- [Apache APISIX: Openid-connect plugin Identity Header Spoofing](https://agentprime.io/advisories/CVE-2026-44087.md)
  `CVE-2026-44087` · CVE record: Apache Software Foundation Apache APISIX · CVSS 5.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-345
- [PHP JWT Framework: JWSVerifier uses algorithm from unprotected header, enabling algorithm confusion attacks](https://agentprime.io/advisories/GHSA-jc38-x7x8-2xc8.md)
  `GHSA-jc38-x7x8-2xc8` · Packagist `web-token/jwt-bundle` and 3 more: affected `<3.4.10 || >=4.0.0, <4.0.7 || >=4.1.0, <4.1.7`, fixed in `3.4.10`, `4.0.7`, `4.1.7` · CVSS 4.0, no score published · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-345
- [OpenClaw: Bootstrap token replay could widen pending pairing scopes](https://agentprime.io/advisories/GHSA-9v8j-9c9g-w66c.md)
  `GHSA-9v8j-9c9g-w66c`, `CVE-2026-53862` · npm `openclaw`: affected `<2026.5.12`, fixed in `2026.5.12` · CVSS 2.3 Low · Not analysed yet · Published 18 Jun 2026 · Tags: Privilege escalation, CWE-345
- [PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)](https://agentprime.io/advisories/GHSA-x92v-rpx6-p6cw.md)
  `GHSA-x92v-rpx6-p6cw`, `CVE-2026-57122`, `PYSEC-2026-3523` · PyPI `praisonai`: affected `<4.6.59`, fixed in `4.6.59` · CVSS 8.6 High · Not analysed yet · Published 18 Jun 2026 · Tags: Weak cryptography or TLS, CWE-345
- [PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals](https://agentprime.io/advisories/GHSA-8579-rgg5-ph2m.md)
  `GHSA-8579-rgg5-ph2m`, `CVE-2026-56832`, `PYSEC-2026-3506` · PyPI `praisonai`: affected `>=4.5.2, <4.6.59`, fixed in `4.6.59` · CVSS 8.8 High · Not analysed yet · Published 18 Jun 2026 · Tags: Broken access control, CWE-345
- [Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription](https://agentprime.io/advisories/CVE-2026-48783.md)
  `CVE-2026-48783` · CVE record: gitroomhq postiz-app · CVSS 4.8 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Broken access control, CWE-345, CWE-749
- [Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgery](https://agentprime.io/advisories/CVE-2026-48781.md)
  `CVE-2026-48781` · CVE record: gitroomhq postiz-app · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: Broken access control, CWE-302, CWE-345
- [hono: Body Limit Middleware can be bypassed on AWS Lambda by understating \`Content-Length\`](https://agentprime.io/advisories/GHSA-rv63-4mwf-qqc2.md)
  `GHSA-rv63-4mwf-qqc2`, `CVE-2026-54288` · npm `hono`: affected `<4.12.25`, fixed in `4.12.25` · CVSS 6.5 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-345
- [Cookie injection was possible when opening a PDF link](https://agentprime.io/advisories/CVE-2026-53900.md)
  `CVE-2026-53900` · CVE record: Mozilla Firefox for iOS · CVSS 4.3 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Authentication bypass, CWE-345
- [Cross-origin cookies could be leaked when opening a PDF link](https://agentprime.io/advisories/CVE-2026-53899.md)
  `CVE-2026-53899` · CVE record: Mozilla Firefox for iOS · CVSS 6.5 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-345
- [@angular/common: Weak 32-Bit Cache Key Hashing in \`HttpTransferCache\` Leading to Cross-Request Data Leakage and State Poisoning](https://agentprime.io/advisories/GHSA-39pv-4j6c-2g6v.md)
  `GHSA-39pv-4j6c-2g6v`, `CVE-2026-54266` · npm `@angular/common`: affected `<=19.2.25 || >=20.0.0-next.0, <20.3.25 || >=21.0.0-next.0, <21.2.17 || >=22.0.0-next.0, <22.0.1`, fixed in `20.3.25`, `21.2.17`, `22.0.1` · CVSS 8.8 High · Not analysed yet · Published 15 Jun 2026 · Tags: Weak cryptography or TLS, CWE-345
- [Mastodon has a consent-check bypass in its remote Collections](https://agentprime.io/advisories/CVE-2026-47777.md)
  `CVE-2026-47777` · CVE record: mastodon mastodon · CVSS 7.5 High · Not analysed yet · Published 15 Jun 2026 · Tags: Broken access control, CWE-345
- [Insufficient verification of data authenticity in Zoom Communications Remote Control for Zoom Contact Center](https://agentprime.io/advisories/CVE-2026-53406.md)
  `CVE-2026-53406` · CVE record: Zoom Communications Remote Control for Zoom Contact Center · CVSS 7.8 High · Not analysed yet · Published 12 Jun 2026 · Tags: CWE-345
- [OpenFGA has cache-key delimiter injection in shared-iterator and v2 iterator that caches enables intra-store authorization-decision poisoning](https://agentprime.io/advisories/GHSA-8396-jffm-qx4w.md)
  `GHSA-8396-jffm-qx4w`, `CVE-2026-48096`, `GO-2026-5239` · Go `github.com/openfga/openfga`: affected `<1.16.0`, fixed in `1.16.0` · CVSS 5.0 Medium · Not analysed yet · Published 11 Jun 2026 · Tags: Information disclosure, CWE-345
- [Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload](https://agentprime.io/advisories/GHSA-qvv5-jq5g-4cgg.md)
  `GHSA-qvv5-jq5g-4cgg`, `CVE-2026-48063` · npm `baileys` and 1 more: affected `<6.7.22 || >=7.0.0-rc.1, <7.0.0-rc12`, fixed in `6.7.22`, `7.0.0-rc12` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jun 2026 · Tags: Authentication bypass, CWE-345, CWE-346
- [vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processors](https://agentprime.io/advisories/GHSA-3ww4-5jv9-j5gm.md)
  `GHSA-3ww4-5jv9-j5gm`, `CVE-2026-47155`, `PYSEC-2026-2301` · PyPI `vllm`: affected `<0.22.0`, fixed in `0.22.0` · CVSS 6.5 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: CWE-345
- [Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections](https://agentprime.io/advisories/GHSA-2vqw-3mp8-cgmx.md)
  `GHSA-2vqw-3mp8-cgmx`, `CVE-2026-47737` · RubyGems `puma`: affected `>=5.5.0, <7.2.1 || >=8.0.0, <8.0.2`, fixed in `7.2.1`, `8.0.2` · CVSS 7.5 High · Not analysed yet · Published 9 Jun 2026 · Tags: Authentication bypass, CWE-345
- [Netty has Insufficient Bailiwick Validation for NS Records](https://agentprime.io/advisories/GHSA-5pvg-856g-cp85.md)
  `GHSA-5pvg-856g-cp85`, `CVE-2026-47691` · Maven `io.netty:netty-resolver-dns`: affected `>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final`, fixed in `4.2.15.Final`, `4.1.135.Final` · CVSS 8.7 High · Not analysed yet · Published 8 Jun 2026 · Tags: CWE-345, CWE-346
- [Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records](https://agentprime.io/advisories/GHSA-676x-f7gg-47vc.md)
  `GHSA-676x-f7gg-47vc`, `CVE-2026-45674` · Maven `io.netty:netty-resolver-dns`: affected `>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final`, fixed in `4.2.15.Final`, `4.1.135.Final` · CVSS 8.7 High · Not analysed yet · Published 8 Jun 2026 · Tags: CWE-345, CWE-346
- [WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint](https://agentprime.io/advisories/CVE-2026-7792.md)
  `CVE-2026-7792` · CVE record: smub WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More · CVSS 5.3 Medium · Not analysed yet · Published 6 Jun 2026 · Tags: CWE-345
- [Event Monster <= 2.1.0 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via em_capture_payment AJAX Action](https://agentprime.io/advisories/CVE-2026-8608.md)
  `CVE-2026-8608` · CVE record: awordpresslife Event Monster – Event Manager, Ticket Booking & Registration · CVSS 5.3 Medium · Not analysed yet · Published 5 Jun 2026 · Tags: CWE-345
- [WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint](https://agentprime.io/advisories/GHSA-9392-pj54-qqf8.md)
  `GHSA-9392-pj54-qqf8`, `CVE-2026-47696`, `PKSA-59k2-q697-bf8x` · Packagist `WWBN/AVideo`: affected `<=29.0`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-345
- [Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending](https://agentprime.io/advisories/GHSA-cq3f-vc6p-68fh.md)
  `GHSA-cq3f-vc6p-68fh`, `CVE-2026-45337` · npm `better-auth`: affected `>=1.6.0, <1.6.11`, fixed in `1.6.11` · CVSS 7.6 High · Not analysed yet · Published 4 Jun 2026 · Tags: Broken access control, CWE-345
- [Shared Secret Quota Inflation](https://agentprime.io/advisories/CVE-2026-50214.md)
  `CVE-2026-50214` · CVE record: Acer Connect M6E 5G Portable WiFi Router · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-345
- [Incomplete message edit validation in matrix-sdk-ui](https://agentprime.io/advisories/GHSA-h97m-27fx-42rx.md)
  `GHSA-h97m-27fx-42rx`, `CVE-2026-45057`, `RUSTSEC-2026-0158` · crates.io `matrix-sdk-ui`: affected `>=0.0.0-0, <0.16.1`, fixed in `0.16.1` · CVSS 4.9 Medium · Not analysed yet · Published 3 Jun 2026 · Tags: CWE-345
- [Dräger Infinity M540 VG4.1.1 Spoofed Network Message Handling DoS/Tampering](https://agentprime.io/advisories/CVE-2022-4992.md)
  `CVE-2022-4992` · CVE record: Dräger Infinity Acute Care System and 1 more · CVSS 8.8 High · Not analysed yet · Published 2 Jun 2026 · Tags: CWE-345
- [authentik: SAML source does not validate Conditions, timing, or audience on assertions](https://agentprime.io/advisories/CVE-2026-41577.md)
  `CVE-2026-41577` · CVE record: goauthentik authentik · CVSS 6.9 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: CWE-345
- [stigmem-node's federation peer registration lacked explicit out-of-band approval](https://agentprime.io/advisories/GHSA-9vp8-3hmv-8fgh.md)
  `GHSA-9vp8-3hmv-8fgh`, `CVE-2026-76242` · PyPI `stigmem-node`: affected `<0.9.0a2`, fixed in `0.9.0a2` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2026 · Tags: Weak cryptography or TLS, CWE-345
- [stigmem-node's federation peer token timestamp validation may reject valid peer tokens](https://agentprime.io/advisories/GHSA-xh5j-xjfq-qvvx.md)
  `GHSA-xh5j-xjfq-qvvx`, `CVE-2026-76245` · PyPI `stigmem-node`: affected `<0.9.0a2`, fixed in `0.9.0a2` · CVSS 7.1 High · Not analysed yet · Published 29 May 2026 · Tags: CWE-345
- [FreeScout: Agent Impersonation via Missing HMAC Verification on Notification Reply Message-ID Path](https://agentprime.io/advisories/CVE-2026-47123.md)
  `CVE-2026-47123` · CVE record: freescout-help-desk freescout · CVSS 7.5 High · Not analysed yet · Published 29 May 2026 · Tags: Authentication bypass, CWE-345
- [Contact Form 7 – PayPal & Stripe Add-on <= 2.4.9 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification)](https://agentprime.io/advisories/CVE-2026-9189.md)
  `CVE-2026-9189` · CVE record: scottpaterson Contact Form 7 – PayPal & Stripe Add-on · CVSS 5.3 Medium · Not analysed yet · Published 29 May 2026 · Tags: CWE-345
- [Microsoft UFO accepts cross-device TASK_END messages by session_id only, allowing peer task-result injection](https://agentprime.io/advisories/CVE-2026-46538.md)
  `CVE-2026-46538` · CVE record: microsoft UFO · CVSS 5.9 Medium · Not analysed yet · Published 27 May 2026 · Tags: Authentication bypass, CWE-345
- [Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims](https://agentprime.io/advisories/GHSA-29fc-p6c4-24cg.md)
  `GHSA-29fc-p6c4-24cg`, `CVE-2026-45069`, `PKSA-7tp5-63ss-rycr`, `PKSA-jzjr-4n2h-knvd` · Packagist `symfony/security-http` and 1 more: affected `>=6.3.0, <6.4.40 || >=7.4.0, <7.4.12 || >=8.0.0, <8.0.12`, fixed in `6.4.40`, `7.4.12`, `8.0.12` · CVSS 8.8 High · Not analysed yet · Published 27 May 2026 · Tags: CWE-345, CWE-1287
- [Samba: group policy certificate enrollment uses http\:// without validation](https://agentprime.io/advisories/CVE-2026-3012.md)
  `CVE-2026-3012` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.0 High · Not analysed yet · Published 27 May 2026 · Tags: CWE-345
- [Kavita: Pre-Auth Account Takeover](https://agentprime.io/advisories/CVE-2026-47202.md)
  `CVE-2026-47202` · CVE record: Kareadita Kavita · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 May 2026 · Tags: Authentication bypass, CWE-345, CWE-697
- [TypeBot: WhatsApp Webhook Endpoint Missing Signature Verification](https://agentprime.io/advisories/CVE-2026-39969.md)
  `CVE-2026-39969` · CVE record: baptisteArno typebot.io · CVSS 6.5 Medium · Not analysed yet · Published 22 May 2026 · Tags: Authentication bypass, CWE-345
- [@hulumi/drift: Orphan reconciler accepted externally supplied execute plans](https://agentprime.io/advisories/GHSA-2ffm-hxrq-qqmm.md)
  `GHSA-2ffm-hxrq-qqmm`, `CVE-2026-82858` · npm `@hulumi/drift`: affected `<1.3.2`, fixed in `1.3.2` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 May 2026 · Tags: CWE-345
- [Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss](https://agentprime.io/advisories/GHSA-vj64-rjf3-w3v7.md)
  `GHSA-vj64-rjf3-w3v7`, `CVE-2026-46654` · crates.io `p3-challenger`: affected `<0.4.3 || >=0.5.0, <0.5.3`, fixed in `0.4.3`, `0.5.3` · CVSS 8.9 High · Not analysed yet · Published 21 May 2026 · Tags: CWE-345, CWE-1240
- [nimiq-primitives: BlockInclusionProof interlink issue when hops are empty](https://agentprime.io/advisories/GHSA-799f-29jm-gr6c.md)
  `GHSA-799f-29jm-gr6c`, `CVE-2026-46539` · crates.io `nimiq-primitives`: affected `<=0.2.0`, no fixed version yet · CVSS 5.9 Medium · Not analysed yet · Published 21 May 2026 · Tags: CWE-345
- [RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM](https://agentprime.io/advisories/GHSA-fvvm-949w-qj4w.md)
  `GHSA-fvvm-949w-qj4w`, `CVE-2026-45792` · crates.io `rtk`: affected `<0.32.0`, fixed in `0.32.0` · CVSS 6.9 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-345, CWE-426
- [Insufficient verification of data authenticity in Mesalvo Meona Server and others](https://agentprime.io/advisories/CVE-2026-25602.md)
  `CVE-2026-25602` · CVE record: Mesalvo Meona Server and 1 more · CVSS 2.3 Low · Not analysed yet · Published 20 May 2026 · Tags: CWE-345
- [AutoGPT Platform: Remote Code Execution via Unsafe Pickle Deserialization of Redis Cache Entries](https://agentprime.io/advisories/CVE-2026-33233.md)
  `CVE-2026-33233` · CVE record: Significant-Gravitas AutoGPT · CVSS 7.6 High · Not analysed yet · Published 19 May 2026 · Tags: Code injection, Insecure deserialization, CWE-345
- [Mullvad VPN for macOS: Local Privilege Escalation via unverified bundle path in installer](https://agentprime.io/advisories/CVE-2026-32323.md)
  `CVE-2026-32323` · CVE record: mullvad mullvadvpn-app · CVSS 7.3 High · Not analysed yet · Published 19 May 2026 · Tags: Privilege escalation, CWE-345, CWE-427
- [arnika is affected by medium-severity issues in UDP rotation, PQC handling, and KMS TLS](https://agentprime.io/advisories/GHSA-rc6v-5rmx-w5mv.md)
  `GHSA-rc6v-5rmx-w5mv`, `GO-2026-5614` · Go `github.com/arnika-project/arnika`: affected `<1.0.1`, fixed in `1.0.1` · CVSS 2.8 Low · Not analysed yet · Published 15 May 2026 · Tags: Authentication bypass, Weak cryptography or TLS, CWE-345
- [Better Auth: OAuth callback accepts mismatched \`state\` when cookie-backed state storage is used without PKCE](https://agentprime.io/advisories/GHSA-wxw3-q3m9-c3jr.md)
  `GHSA-wxw3-q3m9-c3jr`, `CVE-2026-67335` · npm `better-auth`: affected `<1.6.2`, fixed in `1.6.2` · CVSS 6.0 Medium · Not analysed yet · Published 15 May 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF), CWE-345
- [Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark](https://agentprime.io/advisories/GHSA-jgg9-rw32-44pj.md)
  `GHSA-jgg9-rw32-44pj`, `CVE-2026-45058` · npm `electerm`: affected `<=3.8.8`, no fixed version yet · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2026 · Tags: Code injection, Broken access control, CWE-345, CWE-494

Newest: <https://agentprime.io/advisories/tag/cwe-345.md>
Older: <https://agentprime.io/advisories/tag/cwe-345.md?cursor=WyIyMDI2LTA1LTE0VDIwOjE1OjQyLjAwMDAwMFoiLCJHSFNBLWpnZzktcnczMi00NHBqIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-345&cursor=WyIyMDI2LTA2LTI2VDIyOjUyOjMzLjAwMDAwMFoiLCJHSFNBLTU0aGgtZzVteC1qcWNwIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-345/?cursor=WyIyMDI2LTA2LTI2VDIyOjUyOjMzLjAwMDAwMFoiLCJHSFNBLTU0aGgtZzVteC1qcWNwIl0>. Everything for agents: <https://agentprime.io/llms.txt>.