# CWE-441.

Every Advisory and CVE whose sources give the weakness CWE-441, newest first.

## Records, newest first

- [Multiple Vulnerabilities in IBM API Connect](https://agentprime.io/advisories/CVE-2026-16920.md)
  `CVE-2026-16920` · CVE record: IBM API Connect · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Nov 2026 · Tags: CWE-441
- [Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation](https://agentprime.io/advisories/CVE-2026-88983.md)
  `CVE-2026-88983` · CVE record: kubeflow pipelines · CVSS 5.0 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Server-side request forgery (SSRF), CWE-441
- [Google Chrome: Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote…](https://agentprime.io/advisories/CVE-2026-121198.md)
  `CVE-2026-121198` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-441
- [Google Chrome: Confused deputy in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote…](https://agentprime.io/advisories/CVE-2026-121171.md)
  `CVE-2026-121171` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-441
- [Google Chrome: Confused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a…](https://agentprime.io/advisories/CVE-2026-121108.md)
  `CVE-2026-121108` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-441
- [Google Android: An unprivileged application can bypass the…](https://agentprime.io/advisories/CVE-2026-49906.md)
  `CVE-2026-49906` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [Google Android: The \`ClusterRenderingService.dump()\` method…](https://agentprime.io/advisories/CVE-2026-49903.md)
  `CVE-2026-49903` · CVE record: Google Android · CVSS 5.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy.](https://agentprime.io/advisories/CVE-2026-59028.md)
  `CVE-2026-59028` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [In multiple locations, there is a possible permission bypass due to a confused deputy.](https://agentprime.io/advisories/CVE-2026-59015.md)
  `CVE-2026-59015` · CVE record: Google Android · CVSS 4.0 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [In multiple locations, there is a possible permission bypass due to a confused deputy.](https://agentprime.io/advisories/CVE-2026-59000.md)
  `CVE-2026-59000` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy.](https://agentprime.io/advisories/CVE-2026-58970.md)
  `CVE-2026-58970` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy.](https://agentprime.io/advisories/CVE-2026-58965.md)
  `CVE-2026-58965` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launch due to a confused deputy.](https://agentprime.io/advisories/CVE-2026-58957.md)
  `CVE-2026-58957` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background application launch (bal) issue due to a confused deputy.](https://agentprime.io/advisories/CVE-2026-58944.md)
  `CVE-2026-58944` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [In run of AddAccountSettings.java, there is a possible background activity launch due to a confused deputy.](https://agentprime.io/advisories/CVE-2026-58943.md)
  `CVE-2026-58943` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [In multiple locations, there is a possible permission bypass due to a confused deputy.](https://agentprime.io/advisories/CVE-2026-58885.md)
  `CVE-2026-58885` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [In startTetheredHotspotRequest of WifiServiceImpl.java, there is a possible permission bypass due to a confused deputy.](https://agentprime.io/advisories/CVE-2026-58884.md)
  `CVE-2026-58884` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [In checkNearbyDevicesPermission of WifiP2pServiceImpl.java, there is a possible permission bypass due to a confused deputy.](https://agentprime.io/advisories/CVE-2026-58877.md)
  `CVE-2026-58877` · CVE record: Google Android · CVSS 4.0 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused deputy.](https://agentprime.io/advisories/CVE-2026-55289.md)
  `CVE-2026-55289` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused deputy.](https://agentprime.io/advisories/CVE-2026-55271.md)
  `CVE-2026-55271` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible information leak due to a confused deputy.](https://agentprime.io/advisories/CVE-2026-55264.md)
  `CVE-2026-55264` · CVE record: Google Android · CVSS 4.0 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused deputy.](https://agentprime.io/advisories/CVE-2026-49931.md)
  `CVE-2026-49931` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confused deputy.](https://agentprime.io/advisories/CVE-2026-49922.md)
  `CVE-2026-49922` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication](https://agentprime.io/advisories/CVE-2026-118687.md)
  `CVE-2026-118687` · CVE record: coder coder · CVSS 8.3 High · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-441
- [HCL BigFix AEX is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-67077.md)
  `CVE-2026-67077` · CVE record: HCL Software BigFix AEX · CVSS 4.2 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Server-side request forgery (SSRF), CWE-441, CWE-610
- [LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key](https://agentprime.io/advisories/GHSA-7hp6-4w63-5g45.md)
  `GHSA-7hp6-4w63-5g45`, `CVE-2026-114612` · PyPI `litellm`: affected `>=1.91.0, <1.100.4 || >=1.101.0, <1.101.3 || >=1.102.0, <1.102.2 || >=1.103.0, <1.103.1 || >=1.104.0rc1, <1.104.0rc2`, fixed in `1.100.4`, `1.101.3`, `1.102.2`, `1.103.1`, `1.104.0rc2` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Privilege escalation, CWE-345, CWE-441
- [Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites](https://agentprime.io/advisories/GHSA-f2ph-cmg5-wxc8.md)
  `GHSA-f2ph-cmg5-wxc8`, `CVE-2026-114125` · npm `storybook` and 5 more: affected `>=8.0.0, <8.6.19 || >=9.0.0, <9.1.21 || >=10.0.0, <10.6.2 || >=11.0.0-alpha.0, <11.0.0-alpha.6`, fixed in `8.6.19`, `9.1.21`, `10.6.2`, `11.0.0-alpha.6` · CVSS 8.6 High · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal, Code injection, Broken access control, CWE-346
- [Unintended Proxy or Intermediary ('Confused Deputy') in hMailServer](https://agentprime.io/advisories/CVE-2026-114478.md)
  `CVE-2026-114478` · CVE record: Progressive Robot Ltd hMailServer · CVSS 5.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-441
- [Google Chrome: Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a…](https://agentprime.io/advisories/CVE-2026-113024.md)
  `CVE-2026-113024` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-441
- [Google Chrome: Confused deputy in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote…](https://agentprime.io/advisories/CVE-2026-113152.md)
  `CVE-2026-113152` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-441
- [Google Chrome: Confused deputy in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote…](https://agentprime.io/advisories/CVE-2026-113247.md)
  `CVE-2026-113247` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-441
- [Google Chrome: Confused deputy in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed…](https://agentprime.io/advisories/CVE-2026-113099.md)
  `CVE-2026-113099` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-441
- [Google Chrome: Confused deputy in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote…](https://agentprime.io/advisories/CVE-2026-113202.md)
  `CVE-2026-113202` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-441
- [Google Chrome: Confused deputy in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote…](https://agentprime.io/advisories/CVE-2026-113190.md)
  `CVE-2026-113190` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-441
- [Google Chrome: Confused deputy in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote…](https://agentprime.io/advisories/CVE-2026-113118.md)
  `CVE-2026-113118` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-441
- [Google Chrome: Confused deputy in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote…](https://agentprime.io/advisories/CVE-2026-113127.md)
  `CVE-2026-113127` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-441
- [Google Chrome: Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a…](https://agentprime.io/advisories/CVE-2026-113301.md)
  `CVE-2026-113301` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-441
- [Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy](https://agentprime.io/advisories/CVE-2026-105311.md)
  `CVE-2026-105311` · CVE record: Red Hat StreamsHub Console for Apache Kafka® and 2 more · CVSS 7.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-441
- [Angular DevTools (Local DoS)](https://agentprime.io/advisories/CVE-2026-101897.md)
  `CVE-2026-101897` · CVE record: angular angular and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-346, CWE-441, CWE-940
- [Windows Broadcast DVR User Service Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-70148.md)
  `CVE-2026-70148` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-441
- [Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83837.md)
  `CVE-2026-83837` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-441
- [Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs](https://agentprime.io/advisories/CVE-2026-93294.md)
  `CVE-2026-93294` · CVE record: Grafana Grafana Enterprise and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control, CWE-441, CWE-1220
- [ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie](https://agentprime.io/advisories/CVE-2026-109373.md)
  `CVE-2026-109373` · CVE record: zitadel zitadel · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-441
- [TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment](https://agentprime.io/advisories/GHSA-x34j-47hf-4xg7.md)
  `GHSA-x34j-47hf-4xg7`, `CVE-2026-108261` · npm `tinacms` and 1 more: affected `<3.14.0`, fixed in `3.14.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Open redirect, CWE-346, CWE-441
- [Authentication Bypass by Spoofing in Malcolm](https://agentprime.io/advisories/CVE-2026-107336.md)
  `CVE-2026-107336` · CVE record: CISA Malcolm · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass, Broken access control, CWE-441
- [AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host](https://agentprime.io/advisories/GHSA-jmqq-x5g9-9p2w.md)
  `GHSA-jmqq-x5g9-9p2w`, `CVE-2026-107282` · Maven `org.asynchttpclient:async-http-client`: affected `>=3.0.0, <3.0.13 || >=2.0.0, <2.16.1`, fixed in `3.0.13`, `2.16.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Weak cryptography or TLS, Hard-coded credentials, CWE-441
- [AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT](https://agentprime.io/advisories/CVE-2026-107232.md)
  `CVE-2026-107232` · CVE record: AsyncHttpClient async-http-client · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Weak cryptography or TLS, Hard-coded credentials, CWE-441
- [Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback](https://agentprime.io/advisories/GHSA-29gx-h2m3-xw44.md)
  `GHSA-29gx-h2m3-xw44`, `CVE-2026-106462` · npm `@backstage/plugin-scaffolder-backend` and 5 more: affected `<4.1.0`, fixed in `4.1.0` · CVSS 6.4 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control, CWE-441
- [Backstage: Unsupported catalog cluster authentication mode in kubernetes backend](https://agentprime.io/advisories/GHSA-h53x-hjx6-25gr.md)
  `GHSA-h53x-hjx6-25gr`, `CVE-2026-106487` · npm `@backstage/plugin-kubernetes-backend`: affected `<0.21.10`, fixed in `0.21.10` · CVSS 3.5 Low · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-441
- [Server-side request forgery in SonicWall SMA1000](https://agentprime.io/advisories/CVE-2026-102255.md)
  `CVE-2026-102255` · CVE record: SonicWall SMA1000 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Server-side request forgery (SSRF), CWE-441
- [Gitea fork workflow approval bypass through maintainer-triggered events](https://agentprime.io/advisories/CVE-2026-94205.md)
  `CVE-2026-94205` · CVE record: Gitea Gitea · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control, CWE-441
- [Google Chrome: Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed…](https://agentprime.io/advisories/CVE-2026-106221.md)
  `CVE-2026-106221` · CVE record: Google Chrome · CVSS 8.3 High · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-441
- [Google Chrome: Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a…](https://agentprime.io/advisories/CVE-2026-106427.md)
  `CVE-2026-106427` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-441
- [Google Chrome: Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39…](https://agentprime.io/advisories/CVE-2026-106359.md)
  `CVE-2026-106359` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-441
- [Google Chrome: Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a…](https://agentprime.io/advisories/CVE-2026-106301.md)
  `CVE-2026-106301` · CVE record: Google Chrome · CVSS 8.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-441
- [Google Chrome: Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote…](https://agentprime.io/advisories/CVE-2026-106228.md)
  `CVE-2026-106228` · CVE record: Google Chrome · CVSS 8.3 High · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-441
- [Google Chrome: Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a…](https://agentprime.io/advisories/CVE-2026-106188.md)
  `CVE-2026-106188` · CVE record: Google Chrome · CVSS 6.1 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-441
- [Google Chrome: Confused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a…](https://agentprime.io/advisories/CVE-2026-106326.md)
  `CVE-2026-106326` · CVE record: Google Chrome · CVSS 4.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-441
- [Google Chrome: Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a…](https://agentprime.io/advisories/CVE-2026-106266.md)
  `CVE-2026-106266` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-441
- [Google Chrome: Confused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote…](https://agentprime.io/advisories/CVE-2026-106286.md)
  `CVE-2026-106286` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-441

Older: <https://agentprime.io/advisories/tag/cwe-441.md?cursor=WyIyMDI2LTEwLTA2VDE4OjQxOjE1Ljg0NjAwMFoiLCJDVkUtMjAyNi0xMDYyODYiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-441>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-441/>. Everything for agents: <https://agentprime.io/llms.txt>.