# CWE-372.

Every Advisory and CVE whose sources give the weakness CWE-372, newest first.

## Records, newest first

- [Yielding in a component start function can lead to a host panic](https://agentprime.io/advisories/GHSA-5hhx-4wrr-3j9g.md)
  `GHSA-5hhx-4wrr-3j9g`, `CVE-2026-119140`, `RUSTSEC-2026-0358` · crates.io `wasmtime`: affected `>=46.0.0, <48.0.6 || >=49.0.0, <49.0.3`, fixed in `48.0.6`, `49.0.3` · CVSS 5.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-372
- [Frappe before 14.59.0 Safe Execution Flag Bypass in Server Scripts](https://agentprime.io/advisories/CVE-2023-54406.md)
  `CVE-2023-54406` · CVE record: frappe frappe · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-372
- [wolfSSH server accepts server-to-client DH group exchange messages from an unauthenticated client, causing pre-authentication primality-test CPU exhaustion and key exchange role confusion](https://agentprime.io/advisories/CVE-2026-84897.md)
  `CVE-2026-84897` · CVE record: wolfSSL Inc. wolfSSH · CVSS 6.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Denial of service, CWE-372, CWE-405
- [OpenClaw: Endpoint persists after trust decline, leaking gateway credentials](https://agentprime.io/advisories/GHSA-9f4w-67g7-mqwv.md)
  `GHSA-9f4w-67g7-mqwv`, `CVE-2026-41300` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 6.9 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-372, CWE-670
- [OpenClaw: Telegram legacy allowFrom migration fans default-account trust into all named accounts](https://agentprime.io/advisories/GHSA-f693-58pc-2gfr.md)
  `GHSA-f693-58pc-2gfr`, `CVE-2026-41340` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 6.3 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Broken access control, CWE-372
- [OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config](https://agentprime.io/advisories/GHSA-3pm9-5j7m-59vc.md)
  `GHSA-3pm9-5j7m-59vc`, `CVE-2026-41388` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 6.3 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-372, CWE-436
- [The TLS engine in Kwik commit 745fd4e2 does not track the current state of the connection.](https://agentprime.io/advisories/CVE-2024-22590.md)
  `CVE-2024-22590` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2024 · Tags: CWE-372
- [Incomplete Internal State Distinction in ntpsec](https://agentprime.io/advisories/CVE-2023-4012.md)
  `CVE-2023-4012` · CVE record: NTPsec ntpsec · CVSS 7.5 High · Not analysed yet · Published 7 Aug 2023 · Tags: CWE-372
- [Junos OS: SRX 4600 and SRX 5000 Series: The receipt of specific genuine packets by SRXes configured for L2 transparency will cause a DoS](https://agentprime.io/advisories/CVE-2023-36834.md)
  `CVE-2023-36834` · CVE record: Juniper Networks Junos OS · CVSS 6.5 Medium · Not analysed yet · Published 14 Jul 2023 · Tags: CWE-372
- [DMTF-2023-0001: SPDM mutual authentication bypass](https://agentprime.io/advisories/CVE-2023-31127.md)
  `CVE-2023-31127` · CVE record: DMTF libspdm · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 May 2023 · Tags: Authentication bypass, CWE-372
- [Access Restriction Bypass in kube-apiserver](https://agentprime.io/advisories/GHSA-g42g-737j-qx6j.md)
  `GHSA-g42g-737j-qx6j`, `CVE-2021-25735`, `GO-2022-0907` · Go `k8s.io/kubernetes`: affected `<1.18.18 || >=1.19.0, <1.19.10 || >=1.20.0, <1.20.6`, fixed in `1.18.18`, `1.19.10`, `1.20.6` · CVSS 6.5 Medium · Not analysed yet · Published 28 May 2021 · Tags: Broken access control, CWE-372
- [The Eclipse Foundation Eclipse Californium: In Eclipse Californium version 2.3.0 to 2.6.0…](https://agentprime.io/advisories/CVE-2020-27222.md)
  `CVE-2020-27222` · CVE record: The Eclipse Foundation Eclipse Californium · No CVSS score · Not analysed yet · Published 3 Feb 2021 · Tags: CWE-372

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-372>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-372/>. Everything for agents: <https://agentprime.io/llms.txt>.