Advisories · Weakness
CWE-440.
Every Advisory and CVE whose sources give the weakness CWE-440, newest first.
- CVSS 6.3 Medium
vLLM before 0.31.0 Stale allowed_token_ids Mask via InputBatch.condense
- vllm
- CWE-440
- CVSS 8.8 High
Langflow OSS is affected by multiple vulnerabilities
- IBM Langflow OSS
- CWE-440
- CVSS 7.6 High
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
- Weak cryptography or TLS
- CWE-440
>=1.26.0, <2.8.0 · fixed in 2.8.0
GHSA-8988-9cw3-xx77 · CVE-2026-97687 - CVSS 3.7 Low
QUIC Unvalidated Amplification Credit may be Over Accounted
- OpenSSL
- CWE-440
- CVSS 7.1 High
RS9116W/SiWx917 plaintext pause encryption request causes DOS
- silabs.com WiseCnnect
- CWE-440
- CVSS 7.1 High
BT122 plaintext pause encryption request causes DOS
- silabs.com BT122
- CWE-440
- CVSS 5.3 Medium
BT122 stops advertising
- silabs.com BT122
- CWE-440
- CVSS 4.0, no score published
uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)
- CWE-440
- CWE-693
<0.6.0 · fixed in 0.6.0
GHSA-fqf6-gxhh-2xhw - CVSS 8.7 High
Denial-of-service (DoS) vulnerability in MELSEC iQ-F Series FX5-ENET/IP Ethernet module
- Mitsubishi Electric Corporation Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP
- CWE-440
- CVSS 6.5 Medium
WordPress Stripe Payments plugin <= 2.0.98 - Bypass Vulnerability vulnerability
- mra13 / Team Tips and Tricks HQ Stripe Payments
- CWE-440
- CVSS 4.1 Medium
Indian Scout Bobber 2025 WCM CAN bus-off attack silently bypasses anti-theft shutdown
- Indian Motorcycle Scout Bobber + Tech
- CWE-440
- CWE-693
- CVSS 6.9 Medium
Jostle logic bypass degrades resolution performance
- NLnet Labs Unbound
- CWE-440
- CWE-911
- CVSS 5.5 Medium
free5GC AMF: Missing default case in Content-Type switch in HTTPUEContextTransfer
- CWE-440
<=1.4.3 · no fixed version yet
GHSA-r99v-75p9-xqm5 · CVE-2026-41136 - CVSS 5.3 Medium
fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)
- CWE-440
- CWE-697
<6.2.1 · fixed in 6.2.1
GHSA-3j8v-cgw4-2g6q · CVE-2026-35040 - CVSS 6.3 Medium
OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders
- CWE-349
- CWE-440
<2026.4.2 · fixed in 2026.4.2
GHSA-rxmx-g7hr-8mx4 · CVE-2026-41354 - CVSS 6.9 Medium
WatchGuard Firebox System Integrity Check Bypass
- WatchGuard Fireware OS
- CWE-440
- CVSS 6.7 Medium
WatchGuard Firebox Boot Time System Integrity Check Bypass
- WatchGuard Fireware OS
- CWE-440
- CVSS 3.1 Low
Insecure API Design in danny-avila/librechat
- danny-avila/librechat
- CWE-440
- CVSS 7.1 High
Junos OS and Junos OS Evolved: An unauthenticated adjacent attacker sending a valid BGP UPDATE packet forces a BGP session reset
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- CWE-440
- CVSS 6.5 Medium
LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class
- CWE-440
<0.12.41 · fixed in 0.12.41
GHSA-5hq9-5r78-2gjh · CVE-2025-6211 - CVSS 5.3 Medium
LlamaIndex vulnerability in ArxivReader class can cause MD5 hash collisions
- CWE-440
<0.3.1 · fixed in 0.3.1
GHSA-p7j4-jwjf-5x9w · CVE-2025-3044 - CVSS 5.3 Medium
A vulnerability has been identified in APOGEE PXC+TALON TC Series (BACnet) (All versions).
- Siemens APOGEE PXC+TALON TC Series (BACnet)
- CWE-440
- CVSS 3.7 Low
Erlang/OTP SSH Has Strict KEX Violations
- erlang otp
- CWE-440
- CVSS 2.9 Low
cJSON: cJSON 1.7.15 might allow a denial of service via a crafted JSON document such as {"a"…
- cJSON
- CWE-440
- CVSS 4.3 Medium
OpenBSD OpenSSH: In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the…
- OpenBSD OpenSSH
- CWE-440
- CVSS 5.9 Medium
SageMaker Workflow component allows possibility of MD5 hash collisions
- Weak cryptography or TLS
- CWE-440
<2.237.3 · fixed in 2.237.3
GHSA-32g6-mg92-ghm2 · CVE-2025-0508 - CVSS 4.3 Medium
Apache Traffic Server: Expect header field can unreasonably retain resource
- Apache Software Foundation Apache Traffic Server
- CWE-440
- CVSS 4.6 Medium
In Tuleap, deleting a report can delete criteria filters in other reports
- Enalean tuleap
- CWE-440
- CVSS 5.4 Medium
Tuleap allows default values to be cleared from field configuration
- Enalean tuleap
- CWE-440
- CVSS 5.8 Medium
Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend
- CWE-440
<0.3.75 · fixed in 0.3.75
GHSA-qc4v-xq2m-65wc · CVE-2024-47762 - CVSS 5.6 Medium
Cortex XDR Agent: Local Windows Administrator Can Disable the Agent
- Palo Alto Networks Cortex XDR Agent
- CWE-440
- CVSS 6.3 Medium
HPACK table poisoning in gRPC C++, Python & Ruby
- Google gRPC
- CWE-440
- CVSS 7.3 High
LoLLMS vulnerable to Expected Behavior Violation
- Path traversal
- CWE-440
<9.5.1 · fixed in 9.5.1
GHSA-8mrm-r7h3-c3hj · CVE-2024-6281 - CVSS 3.9 Low
UAA Failure to Remove Shadow User’s Access
- UAA
- CWE-440
- CVSS 9.1 CriticalCritical · CVSS 9+
Apollo Router vulnerable to Critical Regression In Query Plan Cache
- CWE-440
- CWE-670
>=1.44.0, <1.45.1 · fixed in 1.45.1
GHSA-q9p4-hw9m-fj2v · CVE-2024-32971 - CVSS 7.6 High
Tuleap deleting or moving an artifact can delete values from unrelated artifacts
- Enalean tuleap
- CWE-440
- CWE-670
- CVSS 6.5 Medium
POLY1305 MAC implementation corrupts vector registers on PowerPC
- OpenSSL
- CWE-440
- CVSS 7.8 High
POLY1305 MAC implementation corrupts XMM registers on Windows
- OpenSSL
- CWE-440
-
sweetalert2 contains potentially undesirable behavior
- CWE-440
>=11.6.14, <11.22.4 · fixed in 11.22.4
GHSA-mrr8-v49w-3333 - CVSS 5.3 Medium
gRPC connection termination issue
- CWE-440
>=1.53.0, <1.53.1 || >=1.54.0, <1.54.2 · fixed in 1.53.1, 1.54.2
GHSA-9hxf-ppjv-w6rq · CVE-2023-32732 - CVSS 7.4 High
Connection confusion in gRPC
- CWE-440
>=1.53.0, <1.53.1 || >=1.54.0, <1.54.2 · fixed in 1.53.1, 1.54.2
GHSA-cfgp-2977-2fmm · CVE-2023-32731 - CVSS 6.5 Medium
A flaw was found in OpenStack due to an inconsistency between Cinder and Nova.
- OpenStack
- CWE-440
- CVSS 5.5 Medium
A flaw was found in the KVM's AMD nested virtualization (SVM).
- Linux kernel
- CWE-440
- CVSS 7.5 High
WAGO: multiple products - Loss of MAC-Address-Filtering after reboot
- WAGO 750-81xx/xxx-xxx Series PFC100/PFC200
- WAGO 750-8217/xxx-xxx Series PFC100/PFC200
- CWE-440
- CVSS 9.8 CriticalCritical · CVSS 9+
Expected Behavior Violation in Apache Tomcat
- CWE-440
>=9.0.0.M1, <9.0.0.M19 || >=8.5.0, <8.5.13 · fixed in 9.0.0.M19, 8.5.13
GHSA-9hg2-395j-83rm · CVE-2017-5651 -
Execution with unnecessary privileges in The Eclipse Foundation Eclipse OMR
- The Eclipse Foundation Eclipse OMR
- Privilege escalation
- CWE-440
- CVSS 5.5 Medium
kernel: A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function…
- kernel
- CWE-440
- CVSS 5.5 Medium
kernel: A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced…
- kernel
- CWE-440
- CVSS 5.5 Medium
A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD.
- kernel
- CWE-440
- CVSS 7.4 HighCritical · CVSS 7+ and EPSS
An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3.
- Linux kernel
- CWE-440
- CVSS 7.4 High
An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions.
- W1.f1
- CWE-440
- CVSS 7.4 High
An exploitable denial-of-service vulnerability exists in the hostapd 2.6, where an attacker could trigger AP to send IAPP location updates for stations, before the required authentication process has…
- W1.f1
- CWE-440
-
The Eclipse Foundation Eclipse Mosquitto: When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file…
- The Eclipse Foundation Eclipse Mosquitto
- CWE-440
-
The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network.
- Siemens SCALANCE X204-2
- Siemens SCALANCE X204-2FM
- CWE-440