# CWE-354.

Every Advisory and CVE whose sources give the weakness CWE-354, newest first.

## Records, newest first

- [bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list](https://agentprime.io/advisories/CVE-2026-107846.md)
  `CVE-2026-107846` · CVE record: bitcoinjs bitcoinjs-lib · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-354
- [Forge: AES-GCM authentication bypass via unvalidated tagLength option](https://agentprime.io/advisories/GHSA-5cwg-6vw7-rj6p.md)
  `GHSA-5cwg-6vw7-rj6p`, `CVE-2026-119186` · npm `node-forge`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 5.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-354, CWE-1284
- [Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count](https://agentprime.io/advisories/GHSA-jc66-7q78-782g.md)
  `GHSA-jc66-7q78-782g`, `CVE-2026-118782` · npm `node-forge`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-354, CWE-1284
- [Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption](https://agentprime.io/advisories/CVE-2026-118776.md)
  `CVE-2026-118776` · CVE record: digitalbazaar forge · CVSS 3.7 Low · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-20, CWE-354
- [zip: AES Entry HMAC Authentication Bypass on Premature EOF](https://agentprime.io/advisories/GHSA-8hxf-qr8p-62x4.md)
  `GHSA-8hxf-qr8p-62x4`, `CVE-2026-115906` · crates.io `zip`: affected `>=0.6.0, <9.0.0`, fixed in `9.0.0` · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-354, CWE-1284
- [Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8…](https://agentprime.io/advisories/CVE-2026-90720.md)
  `CVE-2026-90720` · CVE record: Dell PowerProtect Data Domain · CVSS 6.7 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-354
- [DAMO Academy VideoLLaMA2 Model Loading \_\_init\_\_.py load_pretrained_model integrity check](https://agentprime.io/advisories/CVE-2026-116608.md)
  `CVE-2026-116608` · CVE record: DAMO Academy VideoLLaMA2 · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-345, CWE-354
- [Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose](https://agentprime.io/advisories/GHSA-6gxw-6f7r-cjr6.md)
  `GHSA-6gxw-6f7r-cjr6`, `CVE-2026-65625`, `EEF-CVE-2026-65625` · Hex `jose`: affected `>=1.2.0, <1.11.13`, fixed in `1.11.13` · CVSS 5.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-354
- [virtualenv: Downloaded wheel selection and caching precede verification](https://agentprime.io/advisories/GHSA-494p-63j8-28p3.md)
  `GHSA-494p-63j8-28p3`, `BIT-virtualenv-2026-113714`, `CVE-2026-113714` · PyPI `virtualenv`: affected `<21.14.9`, fixed in `21.14.9` · CVSS 2.3 Low · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-354
- [HmacShaCryptor.Hash never hashes its input — returns constant HMAC_K("") for all inputs, voiding CBC-HMAC JWE integrity](https://agentprime.io/advisories/CVE-2026-89320.md)
  `CVE-2026-89320` · CVE record: Eclipse Foundation Eclipse KeyPont - GOSE · CVSS 8.8 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-354
- [Bypass of a configured island trust anchor underneath an insecure parent from an atacker-controlled NSEC record.](https://agentprime.io/advisories/CVE-2026-35501.md)
  `CVE-2026-35501` · CVE record: NLnet Labs Unbound · CVSS 3.7 Low · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-354
- [Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure](https://agentprime.io/advisories/CVE-2026-85243.md)
  `CVE-2026-85243` · CVE record: Apache Software Foundation Apache Camel · CVSS 5.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-354
- [Distribution: Client \`manifests.Get()\` does not verify returned content against requested digest](https://agentprime.io/advisories/GHSA-685w-q87j-wqw3.md)
  `GHSA-685w-q87j-wqw3`, `BIT-distribution-2026-85747`, `CVE-2026-85747`, `GO-2026-6778` · Go `github.com/distribution/distribution/v3` and 1 more: affected `<3.1.2`, fixed in `3.1.2` · CVSS 6.8 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-354
- [Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height](https://agentprime.io/advisories/CVE-2026-109366.md)
  `CVE-2026-109366` · CVE record: ZcashFoundation zebra · CVSS 6.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-354
- [Hex writes unverified package tarballs to standard output in mix hex.package fetch](https://agentprime.io/advisories/CVE-2026-105280.md)
  `CVE-2026-105280` · CVE record: hexpm hex · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-354
- [Checksum database bypass for golang.org/toolchain in cmd/go](https://agentprime.io/advisories/GO-2026-6602.md)
  `GO-2026-6602`, `BIT-golang-2026-94447`, `CVE-2026-94447` · Go `toolchain`: affected `<1.26.9 || >=1.27.0-0, <1.27.2`, fixed in `1.26.9`, `1.27.2` · CVSS 7.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-354
- [Checksum bypass for golang.org/fips140 in cmd/go](https://agentprime.io/advisories/GO-2026-6601.md)
  `GO-2026-6601`, `BIT-golang-2026-94444`, `CVE-2026-94444` · Go `toolchain`: affected `<1.26.9 || >=1.27.0-0, <1.27.2`, fixed in `1.26.9`, `1.27.2` · CVSS 7.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-354
- [Unrecognized payload acceptance in explicit decryption in MongoDB libmongocrypt](https://agentprime.io/advisories/CVE-2026-106434.md)
  `CVE-2026-106434` · CVE record: MongoDB libmongocrypt · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-354
- [HP ThinPro 8.1 SP10 and ThinPro 9 SP3 Security Updates](https://agentprime.io/advisories/CVE-2026-84900.md)
  `CVE-2026-84900` · CVE record: HP Inc ThinPro 8.1 and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-354
- [Cache poisoning via unvalidated image layer DiffIDs](https://agentprime.io/advisories/CVE-2026-93318.md)
  `CVE-2026-93318` · CVE record: moby BuildKit · CVSS 7.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-354
- [Container blob cache can accept unverified content](https://agentprime.io/advisories/CVE-2026-93317.md)
  `CVE-2026-93317` · CVE record: moby BuildKit · CVSS 5.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-354
- [CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent](https://agentprime.io/advisories/CVE-2026-71888.md)
  `CVE-2026-71888` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Oct 2026 · Tags: CWE-354
- [OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check](https://agentprime.io/advisories/CVE-2026-85515.md)
  `CVE-2026-85515` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.2 High · Not analysed yet · Published 3 Oct 2026 · Tags: CWE-345, CWE-354
- [CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag check](https://agentprime.io/advisories/CVE-2026-103601.md)
  `CVE-2026-103601` · CVE record: Legion of the Bouncy Castle Inc. bc-csharp · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-354
- [IesEngine stream-mode MAC forgery via length-dependent KDF split](https://agentprime.io/advisories/CVE-2026-16001.md)
  `CVE-2026-16001` · CVE record: Legion of the Bouncy Castle Inc. bc-csharp · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-354
- [AES-CCM decryption accepts zero or out-of-range tag length, bypassing authentication](https://agentprime.io/advisories/CVE-2026-15999.md)
  `CVE-2026-15999` · CVE record: Legion of the Bouncy Castle Inc. bc-csharp · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-354
- [NetX Secure TLS accepts an empty application-data record without verifying its message authentication code.](https://agentprime.io/advisories/CVE-2026-102759.md)
  `CVE-2026-102759` · CVE record: Eclipse Foundation NetX Duo · CVSS 6.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-354
- [Tauri framework v2 missing updater signature version number validation can be exploited into forced downgrade](https://agentprime.io/advisories/CVE-2026-95625.md)
  `CVE-2026-95625` · CVE record: Tauri tauri-plugin-updater · CVSS 5.9 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-354
- [Cocos AI: Intra-handshake attested TLS implementation is vulnerable to session-misbinding attacks for Intel TDX verifier path](https://agentprime.io/advisories/CVE-2026-92701.md)
  `CVE-2026-92701` · CVE record: ultravioletrs cocos · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-346, CWE-354
- [mport verify can compare stale checksum data after hashing failures](https://agentprime.io/advisories/CVE-2026-54578.md)
  `CVE-2026-54578` · CVE record: MidnightBSD mport · CVSS 2.0 Low · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-354, CWE-755
- [mport index decompression can leave partial or corrupt index data after zstd failures](https://agentprime.io/advisories/CVE-2026-54580.md)
  `CVE-2026-54580` · CVE record: MidnightBSD mport · CVSS 8.3 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-354, CWE-755
- [Security Advisory 0160](https://agentprime.io/advisories/CVE-2026-73459.md)
  `CVE-2026-73459` · CVE record: Arista Networks EOS · CVSS 7.0 High · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-354
- [Netcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_write](https://agentprime.io/advisories/CVE-2026-76852.md)
  `CVE-2026-76852` · CVE record: Netcore NR268 · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-354
- [Windows Installer Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-72929.md)
  `CVE-2026-72929` · CVE record: Microsoft Windows 11 version 23H2 and 4 more · CVSS 7.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-354
- [Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty](https://agentprime.io/advisories/CVE-2026-20354.md)
  `CVE-2026-20354` · CVE record: Cisco Cisco Secure Email · CVSS 5.9 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-354
- [Linux Foundation Magma SecurityModeComplete integrity check](https://agentprime.io/advisories/CVE-2026-82549.md)
  `CVE-2026-82549` · CVE record: Linux Foundation Magma · CVSS 6.9 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: CWE-345, CWE-354
- [An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofed TCP FIN packets without validating the…](https://agentprime.io/advisories/CVE-2025-61480.md)
  `CVE-2025-61480` · CVE record · CVSS 7.5 High · Not analysed yet · Published 26 Aug 2026 · Tags: Authentication bypass, Race condition, Denial of service, CWE-354
- [AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()](https://agentprime.io/advisories/CVE-2026-75803.md)
  `CVE-2026-75803` · CVE record: OpenSSL OpenSSL · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-354
- [Kraken Agents Peer-to-Peer Download Cache Poisoning via Digest Verification Bypass](https://agentprime.io/advisories/CVE-2026-75625.md)
  `CVE-2026-75625` · CVE record: uber kraken · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-354
- [OpenPGP AEAD decryption skips final tag on chunk-aligned data](https://agentprime.io/advisories/CVE-2026-12817.md)
  `CVE-2026-12817` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-354
- [IESEngine stream-mode MAC forgery via length-dependent KDF split](https://agentprime.io/advisories/CVE-2026-12816.md)
  `CVE-2026-12816` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 1 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-354
- [KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery)](https://agentprime.io/advisories/CVE-2026-12803.md)
  `CVE-2026-12803` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 1 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-354
- [CMS AuthEnvelopedData fails to enforce tag-length on decryption](https://agentprime.io/advisories/CVE-2026-12802.md)
  `CVE-2026-12802` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-354
- [CCM-family modes write plaintext to caller buffer before tag check](https://agentprime.io/advisories/CVE-2026-58061.md)
  `CVE-2026-58061` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-354
- [CMS AuthenticatedData content not bound to MAC when authAttrs present](https://agentprime.io/advisories/CVE-2026-59642.md)
  `CVE-2026-59642` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-354
- [Possible heap buffer overflow when validator canonicalizes RDATA that contains domain name](https://agentprime.io/advisories/CVE-2026-56416.md)
  `CVE-2026-56416` · CVE record: NLnet Labs Unbound · CVSS 4.8 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-354
- [Silent Drop of TLS 1.3 Encrypted Records in s2n-tls](https://agentprime.io/advisories/CVE-2026-16317.md)
  `CVE-2026-16317` · CVE record: AWS s2n-tls · CVSS 8.3 High · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-354
- [Improper certificate validation in ASUS Router](https://agentprime.io/advisories/CVE-2026-13385.md)
  `CVE-2026-13385` · CVE record: ASUS Router · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jul 2026 · Tags: Weak cryptography or TLS, CWE-354
- [1756-EN2, 1756-EN3, and 1756-ENBT - Denial of Service via CIP Connection ID](https://agentprime.io/advisories/CVE-2026-9653.md)
  `CVE-2026-9653` · CVE record: Rockwell Automation 1756-EN2, 1756-EN3 and 1 more · CVSS 8.7 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-354
- [melange: Incomplete package integrity verification allows data section substitution](https://agentprime.io/advisories/GHSA-fpg8-7664-jc5q.md)
  `GHSA-fpg8-7664-jc5q`, `CVE-2026-54174`, `GO-2026-5968` · Go `chainguard.dev/apko` and 1 more: affected `<1.2.9`, fixed in `1.2.9` · CVSS 8.3 High · Not analysed yet · Published 10 Jul 2026 · Tags: CWE-345, CWE-354
- [pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field](https://agentprime.io/advisories/GHSA-q6j5-fjx5-2mc3.md)
  `GHSA-q6j5-fjx5-2mc3`, `CVE-2026-50021` · npm `pnpm`: affected `<10.34.1 || >=11.0.0, <11.4.0`, fixed in `10.34.1`, `11.4.0` · CVSS 6.8 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-354
- [HMAC-BLAKE2 final discards message when key length exceeds block size](https://agentprime.io/advisories/CVE-2026-8720.md)
  `CVE-2026-8720` · CVE record: wolfSSL wolfSSL · CVSS 5.9 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-354
- [Mastodon: Spoofing of attribution domains](https://agentprime.io/advisories/CVE-2026-50128.md)
  `CVE-2026-50128` · CVE record: mastodon mastodon · CVSS 5.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-354
- [Mastodon: Removal of integrity-protected JSON entries from signed activities](https://agentprime.io/advisories/CVE-2026-48028.md)
  `CVE-2026-48028` · CVE record: mastodon mastodon · CVSS 6.5 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-354
- [Apache APISIX: Authentication bypass in jwe-decrypt](https://agentprime.io/advisories/CVE-2026-49230.md)
  `CVE-2026-49230` · CVE record: Apache Software Foundation Apache APISIX · CVSS 6.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-354
- [Rockwell Automation CompactLogix 5370 Controllers – Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2025-11694.md)
  `CVE-2025-11694` · CVE record: Rockwell Automation CompactLogix 5370 · CVSS 8.7 High · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-354
- [CMS AuthEnvelopedData Processing May Accept Forged Messages](https://agentprime.io/advisories/CVE-2026-34182.md)
  `CVE-2026-34182` · CVE record: OpenSSL OpenSSL · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-354
- [PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys](https://agentprime.io/advisories/CVE-2026-34181.md)
  `CVE-2026-34181` · CVE record: OpenSSL OpenSSL · CVSS 7.4 High · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-354
- [Amazon SageMaker Python SDK is missing integrity verification in its Triton inference handler](https://agentprime.io/advisories/GHSA-rq6v-x3j8-7qgf.md)
  `GHSA-rq6v-x3j8-7qgf`, `CVE-2026-8597`, `PYSEC-2026-3060` · PyPI `sagemaker`: affected `>=2.199.0, <2.257.2 || >=3.0.0, <3.8.0`, fixed in `2.257.2`, `3.8.0` · CVSS 6.4 Medium · Not analysed yet · Published 21 May 2026 · Tags: CWE-354
- [Zebra v4.4.0 still accepts V5 SIGHASH_SINGLE without a corresponding output](https://agentprime.io/advisories/GHSA-pvmv-cwg8-v6c8.md)
  `GHSA-pvmv-cwg8-v6c8`, `CVE-2026-104435` · crates.io `zebrad` and 1 more: affected `<4.4.1`, fixed in `4.4.1` · CVSS 8.3 High · Not analysed yet · Published 8 May 2026 · Tags: Weak cryptography or TLS, CWE-354, CWE-573

Older: <https://agentprime.io/advisories/tag/cwe-354.md?cursor=WyIyMDI2LTA1LTA4VDE4OjI3OjI2LjAwMDAwMFoiLCJHSFNBLXB2bXYtY3dnOC12NmM4Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-354>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-354/>. Everything for agents: <https://agentprime.io/llms.txt>.