# CWE-353.

Every Advisory and CVE whose sources give the weakness CWE-353, newest first.

## Records, newest first

- [ast-cli: Auto-update downloads are not verified against a checksum before execution](https://agentprime.io/advisories/CVE-2026-77157.md)
  `CVE-2026-77157` · CVE record: Checkmarx github.com/checkmarx/ast-cli · CVSS 6.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-353
- [The issue was addressed with additional app bundle integrity checks.](https://agentprime.io/advisories/CVE-2026-28854.md)
  `CVE-2026-28854` · CVE record: Apple macOS · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-353
- [Unauthenticated Missing Integrity Verification allows Remote Code Execution in ClearPass Policy Manager Client Agent](https://agentprime.io/advisories/CVE-2026-79801.md)
  `CVE-2026-79801` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-353
- [Missing Integrity Verification in the OnGuard Agent of ClearPass Policy Manager Allows Unauthenticated Remote Code Execution](https://agentprime.io/advisories/CVE-2026-76751.md)
  `CVE-2026-76751` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-353
- [Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName](https://agentprime.io/advisories/CVE-2026-49450.md)
  `CVE-2026-49450` · CVE record: laurent22 joplin · CVSS 7.1 High · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-345, CWE-353, CWE-494
- [Netcore NR268 1.7.121109 Security Check Bypass in parame_put_file.cgi](https://agentprime.io/advisories/CVE-2026-76853.md)
  `CVE-2026-76853` · CVE record: Netcore NR268 · CVSS 7.2 High · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-353
- [A cryptographic issue was addressed with improved integrity checks.](https://agentprime.io/advisories/CVE-2026-84533.md)
  `CVE-2026-84533` · CVE record: Apple iOS and iPadOS and 3 more · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-353
- [Howyar｜WeenyGenius - Missing Support for Integrity Check](https://agentprime.io/advisories/CVE-2026-89179.md)
  `CVE-2026-89179` · CVE record: Howyar WeenyGenius · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-353
- [Dell ThinOS 10: Dell ThinOS 10, versions prior to 2605_10.2616…](https://agentprime.io/advisories/CVE-2026-81049.md)
  `CVE-2026-81049` · CVE record: Dell ThinOS 10 · CVSS 4.4 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: CWE-353
- [Samba: ctdb fails to do integrity checking of received packets](https://agentprime.io/advisories/CVE-2026-58224.md)
  `CVE-2026-58224` · CVE record: Red Hat Red Hat Ceph Storage 9.2 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: CWE-353
- [Thermo Fisher Applied Biosystems Genetic Analyzers Missing Support for Integrity Check](https://agentprime.io/advisories/CVE-2026-17583.md)
  `CVE-2026-17583` · CVE record: Thermo Fisher Applied Biosystems 3500/3500xL Series Data Collection Software and 4 more · CVSS 8.3 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-353
- [Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP](https://agentprime.io/advisories/CVE-2026-18536.md)
  `CVE-2026-18536` · CVE record: RRWO Data::Entropy · CVSS 7.5 High · Not analysed yet · Published 1 Aug 2026 · Tags: Weak cryptography or TLS, CWE-353
- [Integrity mechanism of KNX-device FW-files can be bypassed in ABB Update Tool](https://agentprime.io/advisories/CVE-2026-12705.md)
  `CVE-2026-12705` · CVE record: ABB KNX Update Tool (ABB) and 1 more · CVSS 5.9 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-353
- [pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile](https://agentprime.io/advisories/GHSA-hg3w-7f8c-63hp.md)
  `GHSA-hg3w-7f8c-63hp`, `CVE-2026-48995` · npm `pnpm`: affected `<10.33.4 || >=11.0.0, <11.0.7`, fixed in `10.33.4`, `11.0.7` · CVSS 4.8 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-353
- [Anthropic Claude Desktop Cowork VM Image Contents Not Validated Before Use](https://agentprime.io/advisories/CVE-2026-7574.md)
  `CVE-2026-7574` · CVE record: Anthropic Claude Desktop Cowork · CVSS 8.7 High · Not analysed yet · Published 23 Jun 2026 · Tags: CWE-353
- [PHP JWT Framework: Chacha20Poly1305 key-encryption algorithm discards the Poly1305 authentication tag, performing no authentication on decryption](https://agentprime.io/advisories/GHSA-6vvh-pxr4-25r7.md)
  `GHSA-6vvh-pxr4-25r7` · Packagist `web-token/jwt-experimental` and 1 more: affected `<=4.1.6`, no fixed version yet · CVSS 4.0, no score published · Not analysed yet · Published 18 Jun 2026 · Tags: Weak cryptography or TLS, CWE-353
- [electerm's encrypt method not safe enough](https://agentprime.io/advisories/GHSA-g29v-q6h7-76wh.md)
  `GHSA-g29v-q6h7-76wh`, `CVE-2026-45787` · npm `electerm`: affected `<3.9.5`, fixed in `3.9.5` · CVSS 6.0 Medium · Not analysed yet · Published 14 May 2026 · Tags: Weak cryptography or TLS, CWE-329, CWE-353, CWE-759
- [Null pointer accces in aggressive NSEC(3) cache](https://agentprime.io/advisories/CVE-2026-33261.md)
  `CVE-2026-33261` · CVE record: PowerDNS Recursor · CVSS 5.9 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-353
- [OpenClaw B-M3: ClawHub package downloads are not enforced with integrity verification](https://agentprime.io/advisories/GHSA-3vvq-q2qc-7rmp.md)
  `GHSA-3vvq-q2qc-7rmp`, `CVE-2026-42428` · npm `openclaw`: affected `<2026.4.8`, fixed in `2026.4.8` · CVSS 7.5 High · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-353
- [IBM Db2 Recovery Expert Missing Integrity Check](https://agentprime.io/advisories/CVE-2026-3856.md)
  `CVE-2026-3856` · CVE record: IBM Db2 Recovery Expert · CVSS 5.3 Medium · Not analysed yet · Published 17 Mar 2026 · Tags: CWE-353
- [Striae has a hash validation utility vulnerability](https://agentprime.io/advisories/GHSA-mmf8-487q-p45m.md)
  `GHSA-mmf8-487q-p45m`, `CVE-2026-31839` · npm `@striae-org/striae`: affected `>=0.9.22-0, <3.0.0`, fixed in `3.0.0` · CVSS 8.2 High · Not analysed yet · Published 11 Mar 2026 · Tags: Weak cryptography or TLS, CWE-353, CWE-354
- [Integrity Validation Bypass in CryptoPro Secure Disk for BitLocker](https://agentprime.io/advisories/CVE-2025-10010.md)
  `CVE-2025-10010` · CVE record: CPSD IT SERVICES GMBH CryptoPro Secure Disk for BitLocker · CVSS 6.8 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: CWE-353
- [Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword](https://agentprime.io/advisories/CVE-2025-15364.md)
  `CVE-2025-15364` · CVE record: codename065 Download Manager · CVSS 7.3 High · Not analysed yet · Published 6 Jan 2026 · Tags: CWE-353
- [eopkg vulnerable to package file list integrity bypass](https://agentprime.io/advisories/CVE-2026-21437.md)
  `CVE-2026-21437` · CVE record: getsolus eopkg · CVSS 2.0 Low · Not analysed yet · Published 1 Jan 2026 · Tags: CWE-353
- [KeePassXC-Browser thru 1.9.9.2 autofills or prompts to fill stored credentials into documents rendered under a browser-enforced CSP directive and iframe attribute sandbox, allowing attacker-controlle…](https://agentprime.io/advisories/CVE-2025-65203.md)
  `CVE-2025-65203` · CVE record · CVSS 7.1 High · Not analysed yet · Published 17 Dec 2025 · Tags: Cross-site request forgery (CSRF), CWE-353, CWE-640
- [Diebold Nixdorf Vynamic Security Suite through 4.3.0 SR01 does not validate file attributes or the contents of /root during integrity validation.](https://agentprime.io/advisories/CVE-2024-46917.md)
  `CVE-2024-46917` · CVE record · CVSS 8.1 High · Not analysed yet · Published 29 Aug 2025 · Tags: CWE-353
- [BIG-IP APM VPN web client for macOS vulnerability](https://agentprime.io/advisories/CVE-2025-48500.md)
  `CVE-2025-48500` · CVE record: F5 BIG-IP Edge Client and 1 more · CVSS 7.0 High · Not analysed yet · Published 13 Aug 2025 · Tags: CWE-353
- [Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2025-48811.md)
  `CVE-2025-48811` · CVE record: Microsoft Windows 10 Version 1507 and 4 more · CVSS 6.7 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: CWE-353
- [Windows Virtualization-Based Security (VBS) Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2025-48803.md)
  `CVE-2025-48803` · CVE record: Microsoft Windows 10 Version 1507 and 4 more · CVSS 6.7 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: CWE-353
- [An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12.](https://agentprime.io/advisories/CVE-2025-32890.md)
  `CVE-2025-32890` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 1 May 2025 · Tags: CWE-353
- [An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5.](https://agentprime.io/advisories/CVE-2025-32882.md)
  `CVE-2025-32882` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 1 May 2025 · Tags: CWE-353
- [goTenna Pro ATAK Plugin Missing Support for Integrity Check](https://agentprime.io/advisories/CVE-2024-43108.md)
  `CVE-2024-43108` · CVE record: goTenna Pro ATAK Plugin · CVSS 6.0 Medium · Not analysed yet · Published 26 Sept 2024 · Tags: CWE-353
- [Missing Support for Integrity Check in goTenna Pro](https://agentprime.io/advisories/CVE-2024-47123.md)
  `CVE-2024-47123` · CVE record: goTenna Pro · CVSS 6.0 Medium · Not analysed yet · Published 26 Sept 2024 · Tags: CWE-353
- [Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR15, 4.0.0 SR05, 4.1.0 SR03, and 4.2.0 SR02 fails to validate the directory contents of certain directories (e.g., ensuring the expected has…](https://agentprime.io/advisories/CVE-2023-28865.md)
  `CVE-2023-28865` · CVE record · CVSS 6.6 Medium · Not analysed yet · Published 8 Aug 2024 · Tags: CWE-353
- [The issue was addressed with improved checks.](https://agentprime.io/advisories/CVE-2024-27817.md)
  `CVE-2024-27817` · CVE record: Apple iOS and iPadOS and 3 more · CVSS 7.8 High · Not analysed yet · Published 10 Jun 2024 · Tags: CWE-353
- [Dell BIOS contains a missing support for integrity check vulnerability.](https://agentprime.io/advisories/CVE-2023-32475.md)
  `CVE-2023-32475` · CVE record: Dell CPG BIOS · CVSS 7.6 High · Not analysed yet · Published 7 Jun 2024 · Tags: CWE-353
- [Ciphertext Malleability in TETRA](https://agentprime.io/advisories/CVE-2022-24404.md)
  `CVE-2022-24404` · CVE record: ETSI TETRA Standard · CVSS 5.9 Medium · Not analysed yet · Published 19 Oct 2023 · Tags: CWE-353
- [Magento Open Source allows Incorrect Authorization](https://agentprime.io/advisories/GHSA-qw5m-vmp3-f553.md)
  `GHSA-qw5m-vmp3-f553`, `CVE-2023-29290`, `PKSA-4sd4-zdhg-q6p3`, `PKSA-wdj5-zdxc-xvxp` · Packagist `magento/community-edition` and 1 more: affected `>=2.4.4-p1, <2.4.4-p4 || >=2.4.5-p1, <2.4.5-p3`, fixed in `2.4.4-p4`, `2.4.5-p3` · CVSS 5.3 Medium · Not analysed yet · Published 15 Jun 2023 · Tags: CWE-353
- [Emerson Electric Proficy Machine Edition: Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to…](https://agentprime.io/advisories/CVE-2022-2793.md)
  `CVE-2022-2793` · CVE record: Emerson Electric Proficy Machine Edition · CVSS 5.9 Medium · Not analysed yet · Published 19 Aug 2022 · Tags: CWE-353
- [4NB VideoOffice: An arbitrary file download and execution vulnerability was found in the VideoOffice X2.9…](https://agentprime.io/advisories/CVE-2020-7878.md)
  `CVE-2020-7878` · CVE record: 4NB VideoOffice · No CVSS score · Not analysed yet · Published 28 Dec 2021 · Tags: CWE-353
- [godomall5 remote code execution vulnerability](https://agentprime.io/advisories/CVE-2021-26610.md)
  `CVE-2021-26610` · CVE record: NHN COMMERCE godomall5 Std, godomall5 Pro · CVSS 7.2 High · Not analysed yet · Published 27 Oct 2021 · Tags: CWE-353
- [Missing Support Integrity Check for Boston Scientific Zoom Latitude](https://agentprime.io/advisories/CVE-2021-38396.md)
  `CVE-2021-38396` · CVE record: Boston Scientific ZOOM LATITUDE · CVSS 6.5 Medium · Not analysed yet · Published 4 Oct 2021 · Tags: CWE-353
- [handysoft groupware arbitrary file download and execution vulnerability](https://agentprime.io/advisories/CVE-2021-26608.md)
  `CVE-2021-26608` · CVE record: handysoft HShell.dll · CVSS 8.8 High · Not analysed yet · Published 9 Sept 2021 · Tags: CWE-353
- [Acrobat Reader DC Missing Support for Integrity Check](https://agentprime.io/advisories/CVE-2021-28546.md)
  `CVE-2021-28546` · CVE record: Adobe Acrobat Reader · CVSS 6.5 Medium · Not analysed yet · Published 1 Apr 2021 · Tags: CWE-353
- [Acrobat Reader DC Missing Support for Integrity Check](https://agentprime.io/advisories/CVE-2021-28545.md)
  `CVE-2021-28545` · CVE record: Adobe Acrobat Reader · CVSS 8.1 High · Not analysed yet · Published 1 Apr 2021 · Tags: CWE-353
- [DLL Hijacking Vulnerabilities During Installation of LG Electronics Software](https://agentprime.io/advisories/CVE-2020-7807.md)
  `CVE-2020-7807` · CVE record: LG Electronics (LGPCSuite_Setup), (IPSFULLHD, LG_ULTRAWIDE, ULTRA_HD_Driver Setup) · CVSS 5.6 Medium · Not analysed yet · Published 14 Sept 2020 · Tags: CWE-353
- [Missing authentication in Diebold Nixdorf ProCash 2100xe USB ATM](https://agentprime.io/advisories/CVE-2020-9062.md)
  `CVE-2020-9062` · CVE record: Diebold Nixdorf ProCash 2100xe USB ATM · No CVSS score · Not analysed yet · Published 21 Aug 2020 · Tags: Authentication bypass, Weak cryptography or TLS, CWE-353
- [Missing authentication in NCR SelfServ ATM](https://agentprime.io/advisories/CVE-2020-10124.md)
  `CVE-2020-10124` · CVE record: NCR SelfServ ATM · No CVSS score · Not analysed yet · Published 21 Aug 2020 · Tags: Authentication bypass, Weak cryptography or TLS, CWE-353
- [HandySoft ActiveX File Download and Execution Vulnerability](https://agentprime.io/advisories/CVE-2020-7810.md)
  `CVE-2020-7810` · CVE record: Handysoft, Inc. hslogin2.dll · CVSS 8.8 High · Not analysed yet · Published 7 Aug 2020 · Tags: CWE-353
- [Cabsoftware Reportexpress ProPlus: Reportexpress ProPlus contains a vulnerability that could allow an arbitrary code…](https://agentprime.io/advisories/CVE-2019-19160.md)
  `CVE-2019-19160` · CVE record: Cabsoftware Reportexpress ProPlus · CVSS 5.7 Medium · Not analysed yet · Published 29 Jun 2020 · Tags: CWE-353
- [RAONWIZ Inc K Upload, arguments modiffication via missing support for integrity check vulnerability](https://agentprime.io/advisories/CVE-2020-7808.md)
  `CVE-2020-7808` · CVE record: RAONWIZ Inc K Upload · CVSS 8.7 High · Not analysed yet · Published 21 May 2020 · Tags: Command injection, CWE-353
- [Ubuntu kernel snap build process could use unauthenticated sources](https://agentprime.io/advisories/CVE-2019-11480.md)
  `CVE-2019-11480` · CVE record: Canonical pc-kernel · CVSS 8.4 High · Not analysed yet · Published 14 Apr 2020 · Tags: CWE-353
- [RVD#1487: No integrity checks on UR+ platform artifacts when installed in the robot](https://agentprime.io/advisories/CVE-2020-10266.md)
  `CVE-2020-10266` · CVE record: Universal Robots URx · CVSS 8.8 High · Not analysed yet · Published 6 Apr 2020 · Tags: CWE-353
- [Siemens SIMATIC Drive Controller family: A vulnerability has been identified in SIMATIC Drive Controller family (All versions)…](https://agentprime.io/advisories/CVE-2019-10943.md)
  `CVE-2019-10943` · CVE record: Siemens SIMATIC Drive Controller family and 4 more · No CVSS score · Not analysed yet · Published 13 Aug 2019 · Tags: CWE-353
- [Hunesion i-oneNet Missing Support for Integrity Check vulnerability](https://agentprime.io/advisories/CVE-2019-12804.md)
  `CVE-2019-12804` · CVE record: Hunesion i-oneNet · CVSS 7.8 High · Not analysed yet · Published 10 Jul 2019 · Tags: CWE-353

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-353>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-353/>. Everything for agents: <https://agentprime.io/llms.txt>.