# CWE-354.

Every Advisory and CVE whose sources give the weakness CWE-354, newest first.

## Records, newest first (an older page)

- [Bouncy Castle LTS native GCM chunking can cause bad-tag exception on decryption](https://agentprime.io/advisories/GHSA-mx76-r943-rf8g.md)
  `GHSA-mx76-r943-rf8g`, `CVE-2026-8149` · Maven `org.bouncycastle:bcprov-lts8on`: affected `>=2.73.0, <2.73.11`, fixed in `2.73.11` · CVSS 5.1 Medium · Not analysed yet · Published 8 May 2026 · Tags: CWE-354, CWE-1068
- [Zebra's Transparent SIGHASH_SINGLE Handling Diverges from zcashd for Corresponding Outputs](https://agentprime.io/advisories/GHSA-cwfq-rfcr-8hmp.md)
  `GHSA-cwfq-rfcr-8hmp`, `CVE-2026-104437` · crates.io `zebrad`: affected `<4.4.0`, fixed in `4.4.0` · CVSS 8.3 High · Not analysed yet · Published 7 May 2026 · Tags: Weak cryptography or TLS, CWE-354, CWE-573
- [crypto: krb5enc - fix async decrypt skipping hash verification](https://agentprime.io/advisories/CVE-2026-31719.md)
  `CVE-2026-31719` · CVE record: Linux Linux · CVSS 7.5 High · Not analysed yet · Published 1 May 2026 · Tags: CWE-354
- [Lockfile checksums not verified in Hex allows dependency integrity bypass](https://agentprime.io/advisories/CVE-2026-32148.md)
  `CVE-2026-32148` · CVE record: hexpm hex · CVSS 8.9 High · Not analysed yet · Published 30 Apr 2026 · Tags: CWE-354, CWE-494
- [xrdp: RDP MAC signature (dataSignature) never verified on receive — integrity bypass in non-TLS mode](https://agentprime.io/advisories/CVE-2026-32105.md)
  `CVE-2026-32105` · CVE record: neutrinolabs xrdp · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Apr 2026 · Tags: CWE-354
- [SP1 V6 Recursion Circuit Row-Count Binding Gap](https://agentprime.io/advisories/GHSA-63x8-x938-vx33.md)
  `GHSA-63x8-x938-vx33`, `CVE-2026-40323` · crates.io `sp1_prover` and 2 more: affected `>=6.0.0, <6.1.0`, fixed in `6.1.0` · CVSS 8.9 High · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-345, CWE-354
- [wolfSSL EVP ChaCha20-Poly1305 AEAD authentication tag](https://agentprime.io/advisories/CVE-2026-5479.md)
  `CVE-2026-5479` · CVE record: wolfSSL wolfSSL · CVSS 7.6 High · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-354
- [PKCS7 CBC Padding Oracle — Plaintext Recovery](https://agentprime.io/advisories/CVE-2026-5504.md)
  `CVE-2026-5504` · CVE record: wolfSSL wolfSSL · CVSS 6.3 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-354
- [Lack of Dynamic Library Validation in SzafirHost](https://agentprime.io/advisories/CVE-2026-26928.md)
  `CVE-2026-26928` · CVE record: Krajowa Izba Rozliczeniowa SzafirHost · CVSS 8.7 High · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-354
- [nginx-ui Backup Restore Allows Tampering with Encrypted Backups](https://agentprime.io/advisories/GHSA-fhh2-gg7w-gwpq.md)
  `GHSA-fhh2-gg7w-gwpq`, `CVE-2026-33026`, `GO-2026-4903` · Go `github.com/0xJacky/Nginx-UI`: affected `<1.9.10-0.20260315015203-f61bcec547c0`, fixed in `1.9.10-0.20260315015203-f61bcec547c0` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Mar 2026 · Tags: Information disclosure, Weak cryptography or TLS, CWE-354
- [Incus does not verify combined fingerprint when downloading images from simplestreams servers](https://agentprime.io/advisories/GHSA-p8mm-23gg-jc9r.md)
  `GHSA-p8mm-23gg-jc9r`, `CVE-2026-33542`, `GO-2026-4882` · Go `github.com/lxc/incus/v6/client`: affected `<6.23.0`, fixed in `6.23.0` · CVSS 5.7 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: Weak cryptography or TLS, CWE-354
- [Cryptomator for Android: Tampered vault configuration allows MITM attack on Hub API](https://agentprime.io/advisories/CVE-2026-32317.md)
  `CVE-2026-32317` · CVE record: cryptomator android · CVSS 7.6 High · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-346, CWE-354, CWE-451, CWE-923
- [Cryptomator for IOS: Tampered vault configuration allows MITM attack on Hub API](https://agentprime.io/advisories/CVE-2026-32318.md)
  `CVE-2026-32318` · CVE record: cryptomator ios · CVSS 7.6 High · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-346, CWE-354, CWE-451, CWE-923
- [Cryptomator: Tampered vault configuration allows MITM attack on Hub API](https://agentprime.io/advisories/CVE-2026-32303.md)
  `CVE-2026-32303` · CVE record: cryptomator cryptomator · CVSS 7.6 High · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-346, CWE-354, CWE-451, CWE-923
- [Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding](https://agentprime.io/advisories/GHSA-m344-f55w-2m6j.md)
  `GHSA-m344-f55w-2m6j`, `CVE-2026-28498`, `PYSEC-2026-2117` · PyPI `authlib`: affected `<1.6.9`, fixed in `1.6.9` · CVSS 8.2 High · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-325, CWE-354, CWE-573
- [simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption](https://agentprime.io/advisories/GHSA-r353-4845-pr5p.md)
  `GHSA-r353-4845-pr5p`, `CVE-2026-32600`, `PKSA-sxbn-dpg6-6ng9` · Packagist `simplesamlphp/xml-security`: affected `<1.13.9 || >=2.0.0, <2.3.1`, fixed in `1.13.9`, `2.3.1` · CVSS 8.2 High · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-354
- [xmlseclibs: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption](https://agentprime.io/advisories/GHSA-4v26-v6cg-g6f9.md)
  `GHSA-4v26-v6cg-g6f9`, `CVE-2026-32313`, `PKSA-pr5h-1dpm-9x4k` · Packagist `robrichards/xmlseclibs`: affected `<3.1.5`, fixed in `3.1.5` · CVSS 8.2 High · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-354
- [Striae has a hash validation utility vulnerability](https://agentprime.io/advisories/GHSA-mmf8-487q-p45m.md)
  `GHSA-mmf8-487q-p45m`, `CVE-2026-31839` · npm `@striae-org/striae`: affected `>=0.9.22-0, <3.0.0`, fixed in `3.0.0` · CVSS 8.2 High · Not analysed yet · Published 11 Mar 2026 · Tags: Weak cryptography or TLS, CWE-353, CWE-354
- [nimiq/core-rs-albatross's nimiq-blockchain missing proposal body root verification](https://agentprime.io/advisories/CVE-2026-28402.md)
  `CVE-2026-28402` · CVE record: nimiq core-rs-albatross · CVSS 7.1 High · Not analysed yet · Published 27 Feb 2026 · Tags: CWE-354
- [Improper Digest Verification in httpsig-hyper May Allow Message Integrity Bypass](https://agentprime.io/advisories/GHSA-7v42-g35v-xrch.md)
  `GHSA-7v42-g35v-xrch`, `CVE-2026-26275` · crates.io `httpsig-hyper`: affected `<0.0.23`, fixed in `0.0.23` · CVSS 7.5 High · Not analysed yet · Published 17 Feb 2026 · Tags: CWE-354, CWE-697
- [rPGP's integrity protection of encrypted data was not always checked](https://agentprime.io/advisories/GHSA-c7ph-f7jm-xv4w.md)
  `GHSA-c7ph-f7jm-xv4w` · crates.io `pgp`: affected `>=0.16.0-alpha.0, <0.19.0`, fixed in `0.19.0` · CVSS 4.0, no score published · Not analysed yet · Published 13 Feb 2026 · Tags: CWE-354
- [cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves](https://agentprime.io/advisories/GHSA-r6ph-v2qm-q3c2.md)
  `GHSA-r6ph-v2qm-q3c2`, `CVE-2026-26007`, `PYSEC-2026-2141` · PyPI `cryptography`: affected `<46.0.5`, fixed in `46.0.5` · CVSS 8.2 High · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-345, CWE-354
- [go-git improperly verifies data integrity values for .idx and .pack files](https://agentprime.io/advisories/GHSA-37cx-329c-33x3.md)
  `GHSA-37cx-329c-33x3`, `CVE-2026-25934`, `GO-2026-4473` · Go `github.com/go-git/go-git/v5`: affected `<5.16.5`, fixed in `5.16.5` · CVSS 4.3 Medium · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-354
- [Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauthorized firmware.](https://agentprime.io/advisories/CVE-2025-11543.md)
  `CVE-2025-11543` · CVE record: Sharp Display Solutions, Ltd. NP-P502HL-2, NP-P502WL-2, NP-P502HLG-2, NP-P502WLG, NP-P502H, NP-P502W, NP-P452H, NP-P452W, NP-P502HG, NP-P502WG, NP-P452HG, NP-P452WG, NP-P502H+, NP-P502W+, NP-CR5450H, NP-CR5450W, NP-P502HL, NP-P502WL, NP-P502HLG, NP-P502WLG, NP-P502HL+, NP-P502WL+, NP-CR5450HL, NP-CR5450WL, NP-UM352W, NP-UM352WG, NP-UM352W+ · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Dec 2025 · Tags: CWE-354
- [NVIDIA DGX Spark: NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware…](https://agentprime.io/advisories/CVE-2025-33193.md)
  `CVE-2025-33193` · CVE record: NVIDIA DGX Spark · CVSS 5.7 Medium · Not analysed yet · Published 25 Nov 2025 · Tags: CWE-354
- [Prisma Browser: Insufficient Validation of Untrusted Input Vulnerability in Prisma Browser](https://agentprime.io/advisories/CVE-2025-4616.md)
  `CVE-2025-4616` · CVE record: Palo Alto Networks Prisma Browser · CVSS 1.1 Low · Not analysed yet · Published 14 Nov 2025 · Tags: CWE-354
- [Protobuf Maven Plugin protocDigest is ignored when using protoc from PATH](https://agentprime.io/advisories/GHSA-j2pc-v64r-mv4f.md)
  `GHSA-j2pc-v64r-mv4f` · Maven `io.github.ascopes:protobuf-maven-plugin`: affected `>=4.0.0, <4.0.2 || <3.10.2`, fixed in `4.0.2`, `3.10.2` · CVSS 4.0, no score published · Not analysed yet · Published 4 Nov 2025 · Tags: CWE-354, CWE-693
- [MantisBT lacks verification when changing a user's email address](https://agentprime.io/advisories/GHSA-q747-c74m-69pr.md)
  `GHSA-q747-c74m-69pr`, `CVE-2025-55155`, `PKSA-983m-gpx4-ywx3` · Packagist `mantisbt/mantisbt`: affected `<2.27.2`, fixed in `2.27.2` · CVSS 5.4 Medium · Not analysed yet · Published 3 Nov 2025 · Tags: Information disclosure, CWE-345, CWE-354
- [Netskope Client Configuration Tampering with Local MITM](https://agentprime.io/advisories/CVE-2024-7402.md)
  `CVE-2024-7402` · CVE record: Netskope Netskope Client · CVSS 7.0 High · Not analysed yet · Published 14 Aug 2025 · Tags: CWE-354
- [JWE is missing AES-GCM authentication tag validation in encrypted JWE](https://agentprime.io/advisories/GHSA-c7p4-hx26-pr73.md)
  `GHSA-c7p4-hx26-pr73`, `CVE-2025-54887` · RubyGems `jwe`: affected `<1.1.1`, fixed in `1.1.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Aug 2025 · Tags: CWE-354
- [Comodo Internet Security Premium Manifest File cis_update_x64.xml integrity check](https://agentprime.io/advisories/CVE-2025-7096.md)
  `CVE-2025-7096` · CVE record: Comodo Internet Security Premium · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2025 · Tags: CWE-345, CWE-354
- [electron ASAR Integrity bypass by just modifying the content](https://agentprime.io/advisories/GHSA-xw5q-g62x-2qjc.md)
  `GHSA-xw5q-g62x-2qjc`, `CVE-2024-46992` · npm `electron`: affected `>=30.0.0-alpha.1, <30.0.5 || >=31.0.0-alpha.1, <31.0.0-beta.1`, fixed in `30.0.5`, `31.0.0-beta.1` · CVSS 7.8 High · Not analysed yet · Published 30 Jun 2025 · Tags: CWE-354
- [A vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product.](https://agentprime.io/advisories/CVE-2025-39203.md)
  `CVE-2025-39203` · CVE record: Hitachi Energy MicroSCADA X SYS600 · CVSS 7.1 High · Not analysed yet · Published 24 Jun 2025 · Tags: CWE-354
- [AVEVA PI Connector for CygNet Improper Validation of Integrity Check Value](https://agentprime.io/advisories/CVE-2025-4418.md)
  `CVE-2025-4418` · CVE record: AVEVA PI Connector for CygNet · CVSS 6.7 Medium · Not analysed yet · Published 12 Jun 2025 · Tags: CWE-354
- [Forminator <= 1.42.0 - Order Replay Vulnerability](https://agentprime.io/advisories/CVE-2025-3479.md)
  `CVE-2025-3479` · CVE record: wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder · CVSS 5.3 Medium · Not analysed yet · Published 17 Apr 2025 · Tags: CWE-354
- [Contact Form 7 <= 6.0.5 - Order Replay Vulnerability](https://agentprime.io/advisories/CVE-2025-3247.md)
  `CVE-2025-3247` · CVE record: rocklobsterinc Contact Form 7 · CVSS 5.3 Medium · Not analysed yet · Published 16 Apr 2025 · Tags: CWE-354
- [This issue was addressed with improved handling of executable types.](https://agentprime.io/advisories/CVE-2025-24148.md)
  `CVE-2025-24148` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 31 Mar 2025 · Tags: CWE-354
- [Fortinet FortiNDR: An improper validation of integrity check value vulnerability \[CWE-354\] in FortiNDR…](https://agentprime.io/advisories/CVE-2024-47573.md)
  `CVE-2024-47573` · CVE record: Fortinet FortiNDR · CVSS 6.0 Medium · Not analysed yet · Published 14 Mar 2025 · Tags: CWE-354
- [TXOne Networks StellarProtect (Legacy Mode), StellarEnforce, and Safe Lock Improper Validation of Integrity Check Value Vulnerability](https://agentprime.io/advisories/CVE-2024-47935.md)
  `CVE-2024-47935` · CVE record: TXOne Networks StellarProtect (Legacy Mode) and 2 more · CVSS 5.4 Medium · Not analysed yet · Published 17 Feb 2025 · Tags: CWE-354
- [vLLM uses Python 3.12 built-in hash() which leads to predictable hash collisions in prefix cache](https://agentprime.io/advisories/GHSA-rm76-4mrf-v9r8.md)
  `GHSA-rm76-4mrf-v9r8`, `CVE-2025-25183`, `PYSEC-2025-62` · PyPI `vllm`: affected `<0.7.2`, fixed in `0.7.2` · CVSS 2.6 Low · Not analysed yet · Published 6 Feb 2025 · Tags: CWE-354
- [A firmware downgrade prevention vulnerability has been identified in newer Lexmark devices.](https://agentprime.io/advisories/CVE-2023-50738.md)
  `CVE-2023-50738` · CVE record: Lexmark Printer Firmware · CVSS 4.3 Medium · Not analysed yet · Published 17 Jan 2025 · Tags: CWE-354, CWE-1328
- [Lodestar snappy checksum issue](https://agentprime.io/advisories/GHSA-m9c9-mc2h-9wjw.md)
  `GHSA-m9c9-mc2h-9wjw` · npm `@lodestar/reqresp`: affected `<1.25.0`, fixed in `1.25.0` · No CVSS score · Not analysed yet · Published 14 Jan 2025 · Tags: CWE-354
- [There is an insufficient integrity vulnerability in Huawei products.](https://agentprime.io/advisories/CVE-2020-9210.md)
  `CVE-2020-9210` · CVE record: Huawei Myna · CVSS 6.8 Medium · Not analysed yet · Published 27 Dec 2024 · Tags: CWE-354
- [A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0.](https://agentprime.io/advisories/CVE-2024-56169.md)
  `CVE-2024-56169` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 18 Dec 2024 · Tags: CWE-354
- [An issue in TOTOLINK Bluetooth Wireless Adapter A600UB allows a local attacker to execute arbitrary code via the WifiAutoInstallDriver.exe and MSASN1.dll components.](https://agentprime.io/advisories/CVE-2024-51141.md)
  `CVE-2024-51141` · CVE record · CVSS 7.8 High · Not analysed yet · Published 15 Nov 2024 · Tags: CWE-354
- [Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin](https://agentprime.io/advisories/GHSA-mrpr-vr82-x88r.md)
  `GHSA-mrpr-vr82-x88r`, `CVE-2024-52550` · Maven `org.jenkins-ci.plugins.workflow:workflow-cps`: affected `<3993.v3e20a`, fixed in `3993.v3e20a` · CVSS 8.0 High · Not analysed yet · Published 13 Nov 2024 · Tags: Broken access control, CWE-354
- [2N Access Commander: In 2N Access Commander versions 3.1.1.2 and prior…](https://agentprime.io/advisories/CVE-2024-47255.md)
  `CVE-2024-47255` · CVE record: 2N 2N Access Commander · CVSS 4.7 Medium · Not analysed yet · Published 5 Nov 2024 · Tags: CWE-354
- [secp256k1-node allows private key extraction over ECDH](https://agentprime.io/advisories/GHSA-584q-6j8j-r5pm.md)
  `GHSA-584q-6j8j-r5pm`, `CVE-2024-48930` · npm `secp256k1`: affected `<3.8.1 || >=4.0.0, <4.0.4 || >=5.0.0, <5.0.1`, fixed in `3.8.1`, `4.0.4`, `5.0.1` · CVSS 8.7 High · Not analysed yet · Published 21 Oct 2024 · Tags: Information disclosure, CWE-354
- [OpenStack Ironic fails to verify checksums of supplied image_source URLs](https://agentprime.io/advisories/GHSA-8h22-6qwx-q4w9.md)
  `GHSA-8h22-6qwx-q4w9`, `CVE-2024-47211`, `PYSEC-2026-1468` · PyPI `ironic`: affected `<=21.4.3 || >=22.0.0, <23.0.3 || >=23.1.0, <24.1.3 || >=25.0.0, <26.1.1`, fixed in `23.0.3`, `24.1.3`, `26.1.1` · CVSS 5.3 Medium · Not analysed yet · Published 4 Oct 2024 · Tags: CWE-354
- [Unauthorized Transaction Manipulation Vulnerability](https://agentprime.io/advisories/CVE-2024-47089.md)
  `CVE-2024-47089` · CVE record: Apex Softcell LD Geo · CVSS 8.7 High · Not analysed yet · Published 19 Sept 2024 · Tags: CWE-354
- [Parameter Tampering Vulnerability](https://agentprime.io/advisories/CVE-2024-45789.md)
  `CVE-2024-45789` · CVE record: Reedos Software Solutions Mutual Fund Distribution Product (aiM-Star) · CVSS 6.9 Medium · Not analysed yet · Published 11 Sept 2024 · Tags: CWE-354
- [Apache MINA SSHD: integrity check bypass](https://agentprime.io/advisories/GHSA-2326-hx7g-3m9r.md)
  `GHSA-2326-hx7g-3m9r`, `CVE-2024-41909` · Maven `org.apache.sshd:sshd-common`: affected `<2.12.0`, fixed in `2.12.0` · CVSS 5.9 Medium · Not analysed yet · Published 12 Aug 2024 · Tags: CWE-354
- [Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR10 fails to validate /etc/mtab during the Pre-Boot Authorization (PBA) process.](https://agentprime.io/advisories/CVE-2023-24063.md)
  `CVE-2023-24063` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 8 Aug 2024 · Tags: CWE-354
- [An issue was discovered in Samsung Mobile Processor EExynos 2200, Exynos 1480, Exynos 2400.](https://agentprime.io/advisories/CVE-2024-31958.md)
  `CVE-2024-31958` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 7 Jun 2024 · Tags: CWE-354
- [MCUboot Injection attack of unprotected TLV values in github.com/mcu-tools/mcuboot](https://agentprime.io/advisories/GO-2024-2799.md)
  `GO-2024-2799`, `CVE-2024-32883` · Go `github.com/mcu-tools/mcuboot`: affected `*`, no fixed version yet · CVSS 7.7 High · Not analysed yet · Published 5 Jun 2024 · Tags: CWE-354
- [github.com/containers/image allows unexpected authenticated registry accesses](https://agentprime.io/advisories/GHSA-6wvf-f2vw-3425.md)
  `GHSA-6wvf-f2vw-3425`, `CVE-2024-3727`, `GO-2024-2842` · Go `github.com/containers/image` and 1 more: affected `<5.30.1`, fixed in `5.30.1` · CVSS 8.3 High · Not analysed yet · Published 14 May 2024 · Tags: CWE-354
- [Hoppscotch Extension responds to calls made by origins not in the domain list](https://agentprime.io/advisories/CVE-2024-34714.md)
  `CVE-2024-34714` · CVE record: hoppscotch hoppscotch-extension · CVSS 7.6 High · Not analysed yet · Published 14 May 2024 · Tags: CWE-354
- [ZCC Mac validinstaller file integrity check missing](https://agentprime.io/advisories/CVE-2024-23462.md)
  `CVE-2024-23462` · CVE record: Zscaler Client Connector · CVSS 3.3 Low · Not analysed yet · Published 2 May 2024 · Tags: CWE-354
- [ZCC macOS Upgrade ZIP Bomb DoS](https://agentprime.io/advisories/CVE-2024-23461.md)
  `CVE-2024-23461` · CVE record: Zscaler Client Connector · CVSS 4.2 Medium · Not analysed yet · Published 2 May 2024 · Tags: CWE-354
- [Repair App local code execution with arbitrary privileges](https://agentprime.io/advisories/CVE-2023-41970.md)
  `CVE-2023-41970` · CVE record: Zscaler Client Connector · CVSS 6.0 Medium · Not analysed yet · Published 2 May 2024 · Tags: CWE-354

Newest: <https://agentprime.io/advisories/tag/cwe-354.md>
Older: <https://agentprime.io/advisories/tag/cwe-354.md?cursor=WyIyMDI0LTA1LTAyVDEzOjEwOjUxLjA0MjAwMFoiLCJDVkUtMjAyMy00MTk3MCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-354&cursor=WyIyMDI2LTA1LTA4VDE4OjI3OjI2LjAwMDAwMFoiLCJHSFNBLXB2bXYtY3dnOC12NmM4Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-354/?cursor=WyIyMDI2LTA1LTA4VDE4OjI3OjI2LjAwMDAwMFoiLCJHSFNBLXB2bXYtY3dnOC12NmM4Il0>. Everything for agents: <https://agentprime.io/llms.txt>.