# CWE-358.

Every Advisory and CVE whose sources give the weakness CWE-358, newest first.

## Records, newest first

- [Authlib: empty signatures validation in JWS JSON deserialization](https://agentprime.io/advisories/GHSA-6v38-4h7w-rj9h.md)
  `GHSA-6v38-4h7w-rj9h`, `CVE-2026-96760` · PyPI `authlib`: affected `<1.9.0`, fixed in `1.9.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Weak cryptography or TLS, CWE-20, CWE-358, CWE-670
- [Microsoft Security Advisory CVE-2026-70174 - .NET and Visual Studio Remote Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-f749-vhgx-39h6.md)
  `GHSA-f749-vhgx-39h6`, `CVE-2026-70174` · NuGet `Microsoft.WindowsDesktop.App.Runtime.win-arm64` and 2 more: affected `>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2`, fixed in `8.0.32`, `9.0.21`, `10.0.13`, `11.0.0-rc.2` · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-358
- [Microsoft PowerShell Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-96303.md)
  `CVE-2026-96303` · CVE record: Microsoft PowerShell 7.4 and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-358
- [Microsoft PowerShell Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-85805.md)
  `CVE-2026-85805` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-358
- [A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path](https://agentprime.io/advisories/CVE-2026-46582.md)
  `CVE-2026-46582` · CVE record: NLnet Labs Unbound · CVSS 3.7 Low · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-358
- [Trezor Safe improper security check in on-device display](https://agentprime.io/advisories/CVE-2026-65058.md)
  `CVE-2026-65058` · CVE record: Trezor Safe 3 and 2 more · CVSS 5.9 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-358
- [Secure Boot Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-49783.md)
  `CVE-2026-49783` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-358
- [Improper Data Validation in liboauth2](https://agentprime.io/advisories/CVE-2026-54431.md)
  `CVE-2026-54431` · CVE record: OpenIDC liboauth2 · CVSS 5.1 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: CWE-358
- [DVP80ES3 Improperly Implemented Security Check for Standard vulnerability](https://agentprime.io/advisories/CVE-2026-12577.md)
  `CVE-2026-12577` · CVE record: deltaww DVP80ES3 · CVSS 8.7 High · Not analysed yet · Published 1 Jul 2026 · Tags: CWE-358
- [Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication](https://agentprime.io/advisories/GHSA-f65r-h4g3-3h9h.md)
  `GHSA-f65r-h4g3-3h9h`, `CVE-2026-48797`, `PYSEC-2026-291` · npm `@mcptoolshop/backpropagate` and 1 more: affected `>=1.1.0, <1.2.0`, fixed in `1.2.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Broken access control, CWE-358, CWE-1295
- [Apache Kerby has a bypass the Kerberos pre-authentication check](https://agentprime.io/advisories/GHSA-262p-fj3f-xh7v.md)
  `GHSA-262p-fj3f-xh7v`, `CVE-2026-57915` · Maven `org.apache.kerby:kerb-server`: affected `<2.1.2`, fixed in `2.1.2` · CVSS 7.3 High · Not analysed yet · Published 26 Jun 2026 · Tags: Authentication bypass, CWE-358
- [Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control](https://agentprime.io/advisories/GHSA-g5v7-jchf-7jrr.md)
  `GHSA-g5v7-jchf-7jrr`, `CVE-2026-50628` · Maven `org.apache.cxf:cxf-rt-rs-security-oauth2`: affected `>=4.2.0, <4.2.2 || <4.1.7`, fixed in `4.2.2`, `4.1.7` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jun 2026 · Tags: CWE-20, CWE-358
- [Google Chrome: Inappropriate implementation in WebAPKs in Google Chrome on Android prior to…](https://agentprime.io/advisories/CVE-2026-11127.md)
  `CVE-2026-11127` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-358
- [Google Chrome: Inappropriate implementation in Keyboard in Google Chrome prior to 149.0.7827.53 allowed…](https://agentprime.io/advisories/CVE-2026-11122.md)
  `CVE-2026-11122` · CVE record: Google Chrome · CVSS 6.1 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-358
- [Protection mechanism failure in Apple macOS](https://agentprime.io/advisories/CVE-2026-28914.md)
  `CVE-2026-28914` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 11 May 2026 · Tags: CWE-358, CWE-693
- [MantisBT has a Content Security Policy bypass via attachments](https://agentprime.io/advisories/GHSA-9c3j-xm6v-j7j3.md)
  `GHSA-9c3j-xm6v-j7j3`, `CVE-2026-40597`, `PKSA-vmj5-ycv9-cm2v` · Packagist `mantisbt/mantisbt`: affected `<2.28.2`, fixed in `2.28.2` · CVSS 7.6 High · Not analysed yet · Published 11 May 2026 · Tags: Cross-site scripting (XSS), CWE-358
- [Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up](https://agentprime.io/advisories/GHSA-26hh-7cqf-hhc6.md)
  `GHSA-26hh-7cqf-hhc6`, `CVE-2026-45109` · npm `next`: affected `>=15.2.0, <15.5.18 || >=16.0.0, <16.2.6`, fixed in `15.5.18`, `16.2.6` · CVSS 7.5 High · Not analysed yet · Published 11 May 2026 · Tags: Authentication bypass, CWE-358
- [Ella Core has handover failures during concurrent Security Mode Command](https://agentprime.io/advisories/GHSA-mc29-hmx6-856q.md)
  `GHSA-mc29-hmx6-856q`, `CVE-2026-44474`, `GO-2026-5502` · Go `github.com/ellanetworks/core`: affected `<1.10.0`, fixed in `1.10.0` · CVSS 3.7 Low · Not analysed yet · Published 11 May 2026 · Tags: CWE-358
- [Ella Core has a UE Security Capability bypass on NGAP PathSwitchRequest](https://agentprime.io/advisories/GHSA-pwfh-mqp3-pqwj.md)
  `GHSA-pwfh-mqp3-pqwj`, `CVE-2026-44475`, `GO-2026-5554` · Go `github.com/ellanetworks/core`: affected `<1.10.0`, fixed in `1.10.0` · CVSS 6.1 Medium · Not analysed yet · Published 11 May 2026 · Tags: CWE-358
- [Ella Core Vulnerable to UE Downlink Redirection via Forged PDUSessionResourceSetupResponse](https://agentprime.io/advisories/GHSA-qfxw-v8qx-vj3v.md)
  `GHSA-qfxw-v8qx-vj3v`, `CVE-2026-44473`, `GO-2026-5581` · Go `github.com/ellanetworks/core`: affected `<1.10.0`, fixed in `1.10.0` · CVSS 7.1 High · Not analysed yet · Published 11 May 2026 · Tags: Broken access control, CWE-358
- [Diffusers has a \`trust_remote_code\` bypass via \`custom_pipeline\` and local custom components](https://agentprime.io/advisories/GHSA-98h9-4798-4q5v.md)
  `GHSA-98h9-4798-4q5v`, `CVE-2026-44513`, `PYSEC-2026-40` · PyPI `diffusers`: affected `<0.38.0`, fixed in `0.38.0` · CVSS 8.8 High · Not analysed yet · Published 7 May 2026 · Tags: Code injection, CWE-358
- [Free5GC AMF has Missing Concurrent NAS SMC Validation During NGAP Handover](https://agentprime.io/advisories/GHSA-vrrx-58h3-prmh.md)
  `GHSA-vrrx-58h3-prmh`, `CVE-2026-42082`, `GO-2026-5673` · Go `github.com/free5gc/amf`: affected `<=1.4.3`, no fixed version yet · CVSS 3.7 Low · Not analysed yet · Published 7 May 2026 · Tags: CWE-358
- [Free5GC AMF Bypasses UE Security Capabilities on NGAP PathSwitchRequest](https://agentprime.io/advisories/GHSA-77x9-rf64-92gv.md)
  `GHSA-77x9-rf64-92gv`, `CVE-2026-42081`, `GO-2026-5209` · Go `github.com/free5gc/amf`: affected `<=1.4.3`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 7 May 2026 · Tags: CWE-358
- [HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header](https://agentprime.io/advisories/CVE-2025-31983.md)
  `CVE-2025-31983` · CVE record: HCL BigFix Service Management (SM) · CVSS 3.7 Low · Not analysed yet · Published 6 May 2026 · Tags: CWE-358
- [HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability](https://agentprime.io/advisories/CVE-2025-31970.md)
  `CVE-2025-31970` · CVE record: HCL DFXAnalytics · CVSS 5.3 Medium · Not analysed yet · Published 6 May 2026 · Tags: CWE-358
- [Eaton IPP software: A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP)…](https://agentprime.io/advisories/CVE-2026-22618.md)
  `CVE-2026-22618` · CVE record: Eaton IPP software · CVSS 5.9 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: CWE-358
- [Google Chrome: Inappropriate implementation in PDF in Google Chrome prior to 147.0.7727.55 allowed a…](https://agentprime.io/advisories/CVE-2026-5894.md)
  `CVE-2026-5894` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-358
- [zcashd: Zcash zcashd before 6.12.0 allows invalid transactions to be accepted under certain…](https://agentprime.io/advisories/CVE-2026-35679.md)
  `CVE-2026-35679` · CVE record: Zcash zcashd · CVSS 3.5 Low · Not analysed yet · Published 5 Apr 2026 · Tags: CWE-358
- [SuiteCRM Vulnerable to Remote Code Execution via Module Loader Package Scanner Bypass](https://agentprime.io/advisories/CVE-2026-29103.md)
  `CVE-2026-29103` · CVE record: SuiteCRM SuiteCRM · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Mar 2026 · Tags: Code injection, CWE-358
- [Acceptance of CertificateVerify Message before ClientKeyExchange in TLS 1.2](https://agentprime.io/advisories/CVE-2026-2645.md)
  `CVE-2026-2645` · CVE record: wolfSSL wolfSSL · CVSS 5.5 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: CWE-358
- [IBM WebSphere Application Server could provide weaker than expected security](https://agentprime.io/advisories/CVE-2025-13333.md)
  `CVE-2025-13333` · CVE record: IBM WebSphere Application Server · CVSS 4.4 Medium · Not analysed yet · Published 17 Feb 2026 · Tags: CWE-358
- [Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens](https://agentprime.io/advisories/GHSA-37gf-gmxv-74wv.md)
  `GHSA-37gf-gmxv-74wv`, `CVE-2026-1486` · Maven `org.keycloak:keycloak-services`: affected `>=26.5.0, <26.5.3 || <26.4.9`, fixed in `26.5.3`, `26.4.9` · CVSS 8.8 High · Not analysed yet · Published 9 Feb 2026 · Tags: CWE-358
- [A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.](https://agentprime.io/advisories/CVE-2025-66600.md)
  `CVE-2025-66600` · CVE record: Yokogawa Electric Corporation FAST/TOOLS · CVSS 8.8 High · Not analysed yet · Published 9 Feb 2026 · Tags: CWE-358
- [A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.](https://agentprime.io/advisories/CVE-2025-66601.md)
  `CVE-2025-66601` · CVE record: Yokogawa Electric Corporation FAST/TOOLS · CVSS 6.3 Medium · Not analysed yet · Published 9 Feb 2026 · Tags: CWE-358
- [A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.](https://agentprime.io/advisories/CVE-2025-66603.md)
  `CVE-2025-66603` · CVE record: Yokogawa Electric Corporation FAST/TOOLS · CVSS 2.1 Low · Not analysed yet · Published 9 Feb 2026 · Tags: CWE-358
- [A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.](https://agentprime.io/advisories/CVE-2025-66607.md)
  `CVE-2025-66607` · CVE record: Yokogawa Electric Corporation FAST/TOOLS · CVSS 6.3 Medium · Not analysed yet · Published 9 Feb 2026 · Tags: CWE-358
- [Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.](https://agentprime.io/advisories/CVE-2025-69234.md)
  `CVE-2025-69234` · CVE record: NAVER NAVER Whale browser · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Dec 2025 · Tags: CWE-358
- [BullWall Ransomware Containment file count detection bypass](https://agentprime.io/advisories/CVE-2025-62002.md)
  `CVE-2025-62002` · CVE record: BullWall Ransomware Containment · CVSS 5.3 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: CWE-358
- [Vulnerability of improper criterion security check in the card module.](https://agentprime.io/advisories/CVE-2025-66323.md)
  `CVE-2025-66323` · CVE record: Huawei HarmonyOS · CVSS 5.3 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-358
- [Vulnerability of improper criterion security check in the call module.](https://agentprime.io/advisories/CVE-2025-58308.md)
  `CVE-2025-58308` · CVE record: Huawei HarmonyOS · CVSS 7.3 High · Not analysed yet · Published 28 Nov 2025 · Tags: CWE-358
- [Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.](https://agentprime.io/advisories/CVE-2025-62585.md)
  `CVE-2025-62585` · CVE record: NAVER NAVER Whale browser · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2025 · Tags: CWE-358
- [Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.](https://agentprime.io/advisories/CVE-2025-62583.md)
  `CVE-2025-62583` · CVE record: NAVER NAVER Whale browser · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2025 · Tags: CWE-358
- [Fortinet FortiOS: An Improperly Implemented Security Check for Standard vulnerability \[CWE-358\]…](https://agentprime.io/advisories/CVE-2025-25255.md)
  `CVE-2025-25255` · CVE record: Fortinet FortiOS and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: CWE-358
- [HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP)](https://agentprime.io/advisories/CVE-2025-31969.md)
  `CVE-2025-31969` · CVE record: HCL Software Unica Platform · CVSS 4.0 Medium · Not analysed yet · Published 12 Oct 2025 · Tags: CWE-358
- [Suricata is Vulnerable to Detection Bypass via Crafted Multiple SYN Packets](https://agentprime.io/advisories/CVE-2025-59147.md)
  `CVE-2025-59147` · CVE record: OISF suricata · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2025 · Tags: CWE-358
- [Bluetooth: Out-Of-Context le_conn_rsp Handling](https://agentprime.io/advisories/CVE-2025-10457.md)
  `CVE-2025-10457` · CVE record: zephyrproject-rtos Zephyr · CVSS 4.3 Medium · Not analysed yet · Published 19 Sept 2025 · Tags: CWE-358
- [A permissions issue was addressed with additional restrictions.](https://agentprime.io/advisories/CVE-2025-43262.md)
  `CVE-2025-43262` · CVE record: Apple macOS · CVSS 5.1 Medium · Not analysed yet · Published 15 Sept 2025 · Tags: CWE-358
- [Intel(R) Xeon(R) 6 Processors when using Intel(R) SGX or…: Improperly implemented security check for standard in the DDRIO configuration for some…](https://agentprime.io/advisories/CVE-2025-32086.md)
  `CVE-2025-32086` · CVE record: Intel(R) Xeon(R) 6 Processors when using Intel(R) SGX or Intel(R) TDX · CVSS 4.5 Medium · Not analysed yet · Published 12 Aug 2025 · Tags: CWE-358
- [Comodo Dragon HSTS security check](https://agentprime.io/advisories/CVE-2025-8204.md)
  `CVE-2025-8204` · CVE record: Comodo Dragon · CVSS 2.3 Low · Not analysed yet · Published 26 Jul 2025 · Tags: CWE-358
- [Fortinet FortiOS: An Improperly Implemented Security Check for Standard vulnerability \[CWE-358\] in FortiOS…](https://agentprime.io/advisories/CVE-2024-55599.md)
  `CVE-2024-55599` · CVE record: Fortinet FortiOS and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: CWE-358
- [SpiceDB checks involving relations with caveats can result in no permission when permission is expected in github.com/authzed/spicedb](https://agentprime.io/advisories/GHSA-cwwm-hr97-qfxm.md)
  `GHSA-cwwm-hr97-qfxm`, `CVE-2025-49011`, `GO-2025-3744` · Go `github.com/authzed/spicedb`: affected `<1.44.2`, fixed in `1.44.2` · CVSS 3.7 Low · Not analysed yet · Published 10 Jun 2025 · Tags: CWE-358
- [Google Chrome: Inappropriate implementation in Extensions in Google Chrome prior to 135.0.7049.52…](https://agentprime.io/advisories/CVE-2025-3069.md)
  `CVE-2025-3069` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 2 Apr 2025 · Tags: CWE-358
- [Fortinet FortiSandbox: A stack-based buffer overflow vulnerability (CWE-121) in the profile parser of…](https://agentprime.io/advisories/CVE-2021-26105.md)
  `CVE-2021-26105` · CVE record: Fortinet FortiSandbox · CVSS 6.4 Medium · Not analysed yet · Published 24 Mar 2025 · Tags: CWE-358
- [FortiOS 6.2 running AV engine version 6.00142 and below, FortiOS 6.4 running AV engine version 6.00144 and below and FortiClient 6.2 running AV engine version 6.00137 and below may not immediately de…](https://agentprime.io/advisories/CVE-2020-9295.md)
  `CVE-2020-9295` · CVE record: Fortinet FortiClientWindows · CVSS 4.7 Medium · Not analysed yet · Published 17 Mar 2025 · Tags: CWE-358
- [Microsoft Edge (Chromium-based) Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2025-21267.md)
  `CVE-2025-21267` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 4.4 Medium · Not analysed yet · Published 6 Feb 2025 · Tags: CWE-358
- [Client Secret not checked with OAuth Password grant type](https://agentprime.io/advisories/CVE-2024-12056.md)
  `CVE-2024-12056` · CVE record: arcinfo PcVue · CVSS 2.3 Low · Not analysed yet · Published 4 Dec 2024 · Tags: CWE-358
- [Fortinet FortiOS: An improper neutralization of special elements in output used by a downstream component…](https://agentprime.io/advisories/CVE-2024-33510.md)
  `CVE-2024-33510` · CVE record: Fortinet FortiOS and 1 more · CVSS 3.6 Low · Not analysed yet · Published 12 Nov 2024 · Tags: CWE-358
- [In wifi_item_edit_content of styles.xml , there is a possible FRP bypass due to Missing check for FRP state.](https://agentprime.io/advisories/CVE-2024-40650.md)
  `CVE-2024-40650` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 11 Sept 2024 · Tags: CWE-358
- [Fortinet FortiADC: An improperly implemented security check for standard vulnerability \[CWE-358\] in FortiADC…](https://agentprime.io/advisories/CVE-2024-36511.md)
  `CVE-2024-36511` · CVE record: Fortinet FortiADC · CVSS 3.4 Low · Not analysed yet · Published 10 Sept 2024 · Tags: CWE-358
- [Google Chrome: Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a…](https://agentprime.io/advisories/CVE-2024-7965.md)
  `CVE-2024-7965` · CVE record: Google Chrome · CVSS 8.8 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.19 · Not analysed yet · Published 21 Aug 2024 · Tags: CWE-358

Older: <https://agentprime.io/advisories/tag/cwe-358.md?cursor=WyIyMDI0LTA4LTIxVDIwOjIwOjIzLjM2ODAwMFoiLCJDVkUtMjAyNC03OTY1Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-358>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-358/>. Everything for agents: <https://agentprime.io/llms.txt>.