# CWE-440.

Every Advisory and CVE whose sources give the weakness CWE-440, newest first.

## Records, newest first

- [vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense](https://agentprime.io/advisories/CVE-2026-114049.md)
  `CVE-2026-114049` · CVE record: vllm-project vllm · CVSS 6.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-440
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-93675.md)
  `CVE-2026-93675` · CVE record: IBM Langflow OSS · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-440
- [urllib3: HTTPS proxy TLS configuration may be ignored or overridden](https://agentprime.io/advisories/GHSA-8988-9cw3-xx77.md)
  `GHSA-8988-9cw3-xx77`, `CVE-2026-97687`, `PYSEC-2026-4175` · PyPI `urllib3`: affected `>=1.26.0, <2.8.0`, fixed in `2.8.0` · CVSS 7.6 High · Not analysed yet · Published 30 Sept 2026 · Tags: Weak cryptography or TLS, CWE-440
- [QUIC Unvalidated Amplification Credit may be Over Accounted](https://agentprime.io/advisories/CVE-2026-35191.md)
  `CVE-2026-35191` · CVE record: OpenSSL OpenSSL · CVSS 3.7 Low · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-440
- [RS9116W/SiWx917 plaintext pause encryption request causes DOS](https://agentprime.io/advisories/CVE-2026-16769.md)
  `CVE-2026-16769` · CVE record: silabs.com WiseCnnect · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-440
- [BT122 plaintext pause encryption request causes DOS](https://agentprime.io/advisories/CVE-2026-65934.md)
  `CVE-2026-65934` · CVE record: silabs.com BT122 · CVSS 7.1 High · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-440
- [BT122 stops advertising](https://agentprime.io/advisories/CVE-2026-65932.md)
  `CVE-2026-65932` · CVE record: silabs.com BT122 · CVSS 5.3 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-440
- [uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)](https://agentprime.io/advisories/GHSA-fqf6-gxhh-2xhw.md)
  `GHSA-fqf6-gxhh-2xhw` · crates.io `uucore`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 4.0, no score published · Not analysed yet · Published 7 Jul 2026 · Tags: CWE-440, CWE-693
- [Denial-of-service (DoS) vulnerability in MELSEC iQ-F Series FX5-ENET/IP Ethernet module](https://agentprime.io/advisories/CVE-2026-8806.md)
  `CVE-2026-8806` · CVE record: Mitsubishi Electric Corporation Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP · CVSS 8.7 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-440
- [WordPress Stripe Payments plugin <= 2.0.98 - Bypass Vulnerability vulnerability](https://agentprime.io/advisories/CVE-2026-42752.md)
  `CVE-2026-42752` · CVE record: mra13 / Team Tips and Tricks HQ Stripe Payments · CVSS 6.5 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: CWE-440
- [Indian Scout Bobber 2025 WCM CAN bus-off attack silently bypasses anti-theft shutdown](https://agentprime.io/advisories/CVE-2026-49316.md)
  `CVE-2026-49316` · CVE record: Indian Motorcycle Scout Bobber + Tech · CVSS 4.1 Medium · Not analysed yet · Published 29 May 2026 · Tags: CWE-440, CWE-693, CWE-754
- [Jostle logic bypass degrades resolution performance](https://agentprime.io/advisories/CVE-2026-42534.md)
  `CVE-2026-42534` · CVE record: NLnet Labs Unbound · CVSS 6.9 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-440, CWE-911
- [free5GC AMF: Missing default case in Content-Type switch in HTTPUEContextTransfer](https://agentprime.io/advisories/GHSA-r99v-75p9-xqm5.md)
  `GHSA-r99v-75p9-xqm5`, `CVE-2026-41136`, `GO-2026-5613` · Go `github.com/free5gc/amf`: affected `<=1.4.3`, no fixed version yet · CVSS 5.5 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-440
- [fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)](https://agentprime.io/advisories/GHSA-3j8v-cgw4-2g6q.md)
  `GHSA-3j8v-cgw4-2g6q`, `CVE-2026-35040` · npm `fast-jwt`: affected `<6.2.1`, fixed in `6.2.1` · CVSS 5.3 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-440, CWE-697
- [OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders](https://agentprime.io/advisories/GHSA-rxmx-g7hr-8mx4.md)
  `GHSA-rxmx-g7hr-8mx4`, `CVE-2026-41354` · npm `openclaw`: affected `<2026.4.2`, fixed in `2026.4.2` · CVSS 6.3 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-349, CWE-440, CWE-706
- [WatchGuard Firebox System Integrity Check Bypass](https://agentprime.io/advisories/CVE-2026-3344.md)
  `CVE-2026-3344` · CVE record: WatchGuard Fireware OS · CVSS 6.9 Medium · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-440
- [WatchGuard Firebox Boot Time System Integrity Check Bypass](https://agentprime.io/advisories/CVE-2025-13940.md)
  `CVE-2025-13940` · CVE record: WatchGuard Fireware OS · CVSS 6.7 Medium · Not analysed yet · Published 4 Dec 2025 · Tags: CWE-440
- [Insecure API Design in danny-avila/librechat](https://agentprime.io/advisories/CVE-2025-8850.md)
  `CVE-2025-8850` · CVE record: danny-avila danny-avila/librechat · CVSS 3.1 Low · Not analysed yet · Published 30 Oct 2025 · Tags: CWE-440
- [Junos OS and Junos OS Evolved: An unauthenticated adjacent attacker sending a valid BGP UPDATE packet forces a BGP session reset](https://agentprime.io/advisories/CVE-2025-52953.md)
  `CVE-2025-52953` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 7.1 High · Not analysed yet · Published 11 Jul 2025 · Tags: CWE-440
- [LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class](https://agentprime.io/advisories/GHSA-5hq9-5r78-2gjh.md)
  `GHSA-5hq9-5r78-2gjh`, `CVE-2025-6211`, `PYSEC-2026-1566`, `PYSEC-2026-2606` · PyPI `llama-index` and 1 more: affected `<0.12.41`, fixed in `0.12.41` · CVSS 6.5 Medium · Not analysed yet · Published 10 Jul 2025 · Tags: CWE-440
- [LlamaIndex vulnerability in ArxivReader class can cause MD5 hash collisions](https://agentprime.io/advisories/GHSA-p7j4-jwjf-5x9w.md)
  `GHSA-p7j4-jwjf-5x9w`, `CVE-2025-3044`, `PYSEC-2025-247`, `PYSEC-2026-1569` · PyPI `llama-index-readers-papers`: affected `<0.3.1`, fixed in `0.3.1` · CVSS 5.3 Medium · Not analysed yet · Published 7 Jul 2025 · Tags: CWE-440
- [A vulnerability has been identified in APOGEE PXC+TALON TC Series (BACnet) (All versions).](https://agentprime.io/advisories/CVE-2025-40555.md)
  `CVE-2025-40555` · CVE record: Siemens APOGEE PXC+TALON TC Series (BACnet) · CVSS 5.3 Medium · Not analysed yet · Published 13 May 2025 · Tags: CWE-440
- [Erlang/OTP SSH Has Strict KEX Violations](https://agentprime.io/advisories/CVE-2025-46712.md)
  `CVE-2025-46712` · CVE record: erlang otp · CVSS 3.7 Low · Not analysed yet · Published 8 May 2025 · Tags: CWE-440
- [cJSON: cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a"…](https://agentprime.io/advisories/CVE-2023-26819.md)
  `CVE-2023-26819` · CVE record: cJSON Project cJSON · CVSS 2.9 Low · Not analysed yet · Published 19 Apr 2025 · Tags: CWE-440
- [OpenBSD OpenSSH: In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the…](https://agentprime.io/advisories/CVE-2025-32728.md)
  `CVE-2025-32728` · CVE record: OpenBSD OpenSSH · CVSS 4.3 Medium · Not analysed yet · Published 10 Apr 2025 · Tags: CWE-440
- [SageMaker Workflow component allows possibility of MD5 hash collisions](https://agentprime.io/advisories/GHSA-32g6-mg92-ghm2.md)
  `GHSA-32g6-mg92-ghm2`, `CVE-2025-0508`, `PYSEC-2026-1885` · PyPI `sagemaker`: affected `<2.237.3`, fixed in `2.237.3` · CVSS 5.9 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: Weak cryptography or TLS, CWE-440
- [Apache Traffic Server: Expect header field can unreasonably retain resource](https://agentprime.io/advisories/CVE-2024-56202.md)
  `CVE-2024-56202` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 4.3 Medium · Not analysed yet · Published 6 Mar 2025 · Tags: CWE-440
- [In Tuleap, deleting a report can delete criteria filters in other reports](https://agentprime.io/advisories/CVE-2025-27401.md)
  `CVE-2025-27401` · CVE record: Enalean tuleap · CVSS 4.6 Medium · Not analysed yet · Published 4 Mar 2025 · Tags: CWE-440
- [Tuleap allows default values to be cleared from field configuration](https://agentprime.io/advisories/CVE-2025-27094.md)
  `CVE-2025-27094` · CVE record: Enalean tuleap · CVSS 5.4 Medium · Not analysed yet · Published 3 Mar 2025 · Tags: CWE-440
- [Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend](https://agentprime.io/advisories/GHSA-qc4v-xq2m-65wc.md)
  `GHSA-qc4v-xq2m-65wc`, `CVE-2024-47762` · npm `@backstage/plugin-app-backend`: affected `<0.3.75`, fixed in `0.3.75` · CVSS 5.8 Medium · Not analysed yet · Published 3 Oct 2024 · Tags: CWE-440
- [Cortex XDR Agent: Local Windows Administrator Can Disable the Agent](https://agentprime.io/advisories/CVE-2024-8690.md)
  `CVE-2024-8690` · CVE record: Palo Alto Networks Cortex XDR Agent · CVSS 5.6 Medium · Not analysed yet · Published 11 Sept 2024 · Tags: CWE-440
- [HPACK table poisoning in gRPC C++, Python & Ruby](https://agentprime.io/advisories/CVE-2024-7246.md)
  `CVE-2024-7246` · CVE record: Google gRPC · CVSS 6.3 Medium · Not analysed yet · Published 6 Aug 2024 · Tags: CWE-440
- [LoLLMS vulnerable to Expected Behavior Violation](https://agentprime.io/advisories/GHSA-8mrm-r7h3-c3hj.md)
  `GHSA-8mrm-r7h3-c3hj`, `CVE-2024-6281`, `PYSEC-2026-1587` · PyPI `lollms`: affected `<9.5.1`, fixed in `9.5.1` · CVSS 7.3 High · Not analysed yet · Published 20 Jul 2024 · Tags: Path traversal, CWE-440
- [UAA Failure to Remove Shadow User’s Access](https://agentprime.io/advisories/CVE-2024-38806.md)
  `CVE-2024-38806` · CVE record: UAA · CVSS 3.9 Low · Not analysed yet · Published 18 Jul 2024 · Tags: CWE-440
- [Apollo Router vulnerable to Critical Regression In Query Plan Cache](https://agentprime.io/advisories/GHSA-q9p4-hw9m-fj2v.md)
  `GHSA-q9p4-hw9m-fj2v`, `CVE-2024-32971` · crates.io `apollo-router`: affected `>=1.44.0, <1.45.1`, fixed in `1.45.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 May 2024 · Tags: CWE-440, CWE-670
- [Tuleap deleting or moving an artifact can delete values from unrelated artifacts](https://agentprime.io/advisories/CVE-2024-30246.md)
  `CVE-2024-30246` · CVE record: Enalean tuleap · CVSS 7.6 High · Not analysed yet · Published 29 Mar 2024 · Tags: CWE-440, CWE-670
- [POLY1305 MAC implementation corrupts vector registers on PowerPC](https://agentprime.io/advisories/CVE-2023-6129.md)
  `CVE-2023-6129` · CVE record: OpenSSL OpenSSL · CVSS 6.5 Medium · Not analysed yet · Published 9 Jan 2024 · Tags: CWE-440
- [POLY1305 MAC implementation corrupts XMM registers on Windows](https://agentprime.io/advisories/CVE-2023-4807.md)
  `CVE-2023-4807` · CVE record: OpenSSL OpenSSL · CVSS 7.8 High · Not analysed yet · Published 8 Sept 2023 · Tags: CWE-440
- [sweetalert2 contains potentially undesirable behavior](https://agentprime.io/advisories/GHSA-mrr8-v49w-3333.md)
  `GHSA-mrr8-v49w-3333` · npm `sweetalert2`: affected `>=11.6.14, <11.22.4`, fixed in `11.22.4` · No CVSS score · Not analysed yet · Published 10 Jul 2023 · Tags: CWE-440
- [gRPC connection termination issue](https://agentprime.io/advisories/GHSA-9hxf-ppjv-w6rq.md)
  `GHSA-9hxf-ppjv-w6rq`, `CVE-2023-32732`, `PYSEC-2026-1426` · Maven `io.grpc:grpc-protobuf` and 2 more: affected `>=1.53.0, <1.53.1 || >=1.54.0, <1.54.2`, fixed in `1.53.1`, `1.54.2` · CVSS 5.3 Medium · Not analysed yet · Published 6 Jul 2023 · Tags: CWE-440
- [Connection confusion in gRPC](https://agentprime.io/advisories/GHSA-cfgp-2977-2fmm.md)
  `GHSA-cfgp-2977-2fmm`, `CVE-2023-32731`, `PYSEC-2026-1427` · Maven `io.grpc:grpc-protobuf` and 2 more: affected `>=1.53.0, <1.53.1 || >=1.54.0, <1.54.2`, fixed in `1.53.1`, `1.54.2` · CVSS 7.4 High · Not analysed yet · Published 5 Jul 2023 · Tags: CWE-440
- [A flaw was found in OpenStack due to an inconsistency between Cinder and Nova.](https://agentprime.io/advisories/CVE-2023-2088.md)
  `CVE-2023-2088` · CVE record: OpenStack · CVSS 6.5 Medium · Not analysed yet · Published 12 May 2023 · Tags: CWE-440
- [A flaw was found in the KVM's AMD nested virtualization (SVM).](https://agentprime.io/advisories/CVE-2022-3344.md)
  `CVE-2022-3344` · CVE record: Linux kernel · CVSS 5.5 Medium · Not analysed yet · Published 24 Oct 2022 · Tags: CWE-440
- [WAGO: multiple products - Loss of MAC-Address-Filtering after reboot](https://agentprime.io/advisories/CVE-2022-3281.md)
  `CVE-2022-3281` · CVE record: WAGO 750-81xx/xxx-xxx Series PFC100/PFC200 and 4 more · CVSS 7.5 High · Not analysed yet · Published 17 Oct 2022 · Tags: CWE-440
- [Expected Behavior Violation in Apache Tomcat](https://agentprime.io/advisories/GHSA-9hg2-395j-83rm.md)
  `GHSA-9hg2-395j-83rm`, `CVE-2017-5651` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=9.0.0.M1, <9.0.0.M19 || >=8.5.0, <8.5.13`, fixed in `9.0.0.M19`, `8.5.13` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2022 · Tags: CWE-440
- [Execution with unnecessary privileges in The Eclipse Foundation Eclipse OMR](https://agentprime.io/advisories/CVE-2021-41035.md)
  `CVE-2021-41035` · CVE record: The Eclipse Foundation Eclipse OMR · No CVSS score · Not analysed yet · Published 25 Oct 2021 · Tags: Privilege escalation, CWE-440
- [kernel: A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function…](https://agentprime.io/advisories/CVE-2020-10768.md)
  `CVE-2020-10768` · CVE record: Linux Kernel kernel · CVSS 5.5 Medium · Not analysed yet · Published 15 Sept 2020 · Tags: CWE-440
- [kernel: A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced…](https://agentprime.io/advisories/CVE-2020-10767.md)
  `CVE-2020-10767` · CVE record: Linux Kernel kernel · CVSS 5.5 Medium · Not analysed yet · Published 15 Sept 2020 · Tags: CWE-440
- [A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD.](https://agentprime.io/advisories/CVE-2020-10766.md)
  `CVE-2020-10766` · CVE record: Linux Kernel kernel · CVSS 5.5 Medium · Not analysed yet · Published 15 Sept 2020 · Tags: CWE-440
- [An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3.](https://agentprime.io/advisories/CVE-2019-5108.md)
  `CVE-2019-5108` · CVE record: Linux kernel · CVSS 7.4 High · Critical (CVSS 7+ and EPSS) · EPSS 0.10 · Not analysed yet · Published 23 Dec 2019 · Tags: CWE-440
- [An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions.](https://agentprime.io/advisories/CVE-2019-5062.md)
  `CVE-2019-5062` · CVE record: W1.f1 · CVSS 7.4 High · Not analysed yet · Published 12 Dec 2019 · Tags: CWE-440
- [An exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates for stations, before the required authentication process has…](https://agentprime.io/advisories/CVE-2019-5061.md)
  `CVE-2019-5061` · CVE record: W1.f1 · CVSS 7.4 High · Not analysed yet · Published 12 Dec 2019 · Tags: CWE-440
- [The Eclipse Foundation Eclipse Mosquitto: When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file…](https://agentprime.io/advisories/CVE-2018-12550.md)
  `CVE-2018-12550` · CVE record: The Eclipse Foundation Eclipse Mosquitto · No CVSS score · Not analysed yet · Published 27 Mar 2019 · Tags: CWE-440
- [The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network.](https://agentprime.io/advisories/CVE-2019-6569.md)
  `CVE-2019-6569` · CVE record: Siemens SCALANCE X204-2 and 4 more · No CVSS score · Not analysed yet · Published 26 Mar 2019 · Tags: CWE-440

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-440>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-440/>. Everything for agents: <https://agentprime.io/llms.txt>.