# CWE-453.

Every Advisory and CVE whose sources give the weakness CWE-453, newest first.

## Records, newest first

- [Microsoft QUIC Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-103577.md)
  `CVE-2026-103577` · CVE record: Microsoft Windows 11 version 23H2 and 4 more · CVSS 7.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-453
- [libsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variable](https://agentprime.io/advisories/CVE-2026-109828.md)
  `CVE-2026-109828` · CVE record: libsndfile · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption, CWE-453
- [vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts](https://agentprime.io/advisories/GHSA-jxxv-8r27-vm4p.md)
  `GHSA-jxxv-8r27-vm4p`, `CVE-2026-92950` · npm `vm2`: affected `<3.11.7`, fixed in `3.11.7` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-453, CWE-829, CWE-1188
- [Duplicate Advisory: vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts](https://agentprime.io/advisories/GHSA-hc6q-4vvg-jf79.md)
  `GHSA-hc6q-4vvg-jf79` · npm `vm2`: affected `<=3.11.6`, no fixed version yet · CVSS 8.6 High · Withdrawn · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-453
- [WonderTrader TraderATP Cash Trade Conversion WTSTradeDef.hpp uninitialized variable](https://agentprime.io/advisories/CVE-2026-19212.md)
  `CVE-2026-19212` · CVE record: WonderTrader · CVSS 5.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Memory corruption, CWE-453
- [In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value.](https://agentprime.io/advisories/CVE-2026-0082.md)
  `CVE-2026-0082` · CVE record: Google Android · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jun 2026 · Tags: CWE-453
- [OpenClaw: Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls](https://agentprime.io/advisories/GHSA-9gp8-hjxr-6f34.md)
  `GHSA-9gp8-hjxr-6f34`, `CVE-2026-41330` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 2.0 Low · Not analysed yet · Published 3 Apr 2026 · Tags: Privilege escalation, CWE-453
- [Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret in github.com/ossf/allstar](https://agentprime.io/advisories/GHSA-33f4-mjch-7fpr.md)
  `GHSA-33f4-mjch-7fpr`, `CVE-2025-61926`, `GO-2025-4018` · Go `github.com/ossf/allstar`: affected `<0.0.0-20250721181116-e004ecb540d6`, fixed in `0.0.0-20250721181116-e004ecb540d6` · CVSS 4.6 Medium · Not analysed yet · Published 23 Oct 2025 · Tags: Hard-coded credentials, CWE-453
- [In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default value.](https://agentprime.io/advisories/CVE-2025-48563.md)
  `CVE-2025-48563` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 4 Sept 2025 · Tags: CWE-453
- [Donetick Has Weak Default JWT Secret](https://agentprime.io/advisories/CVE-2025-47945.md)
  `CVE-2025-47945` · CVE record: donetick donetick · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 May 2025 · Tags: CWE-453, CWE-1188
- [Dpanel's hard-coded JWT secret leads to remote code execution in github.com/donknap/dpanel](https://agentprime.io/advisories/GHSA-j752-cjcj-w847.md)
  `GHSA-j752-cjcj-w847`, `CVE-2025-30206`, `GO-2025-3612` · Go `github.com/donknap/dpanel`: affected `<1.6.1`, fixed in `1.6.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Apr 2025 · Tags: Hard-coded credentials, CWE-453, CWE-547
- [Windows Remote Desktop Services Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-49120.md)
  `CVE-2024-49120` · CVE record: Microsoft Windows Server 2012 and 4 more · CVSS 8.1 High · Not analysed yet · Published 10 Dec 2024 · Tags: CWE-453
- [Filestash configured to skip TLS certificate verification when using the FTPS protocol](https://agentprime.io/advisories/GHSA-4jmm-c6jw-g796.md)
  `GHSA-4jmm-c6jw-g796`, `CVE-2024-41255`, `GO-2024-3033` · Go `github.com/mickael-kerjean/filestash`: affected `<=0.4`, no fixed version yet · CVSS 5.9 Medium · Not analysed yet · Published 31 Jul 2024 · Tags: Weak cryptography or TLS, CWE-453
- [NFS server misconfiguration allows file access outside the exported directory](https://agentprime.io/advisories/CVE-2024-39916.md)
  `CVE-2024-39916` · CVE record: FOGProject fogproject · CVSS 6.4 Medium · Not analysed yet · Published 12 Jul 2024 · Tags: CWE-453
- [fgr Vulnerable to Insecure Default Variable Initialization](https://agentprime.io/advisories/GHSA-879p-8gw4-mcpw.md)
  `GHSA-879p-8gw4-mcpw` · PyPI `fgr`: affected `<=0.3.2`, no fixed version yet · CVSS 3.7 Low · Not analysed yet · Published 15 Mar 2024 · Tags: CWE-453
- [Skype for Consumer Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-21411.md)
  `CVE-2024-21411` · CVE record: Microsoft Skype for Consumer · CVSS 8.8 High · Not analysed yet · Published 12 Mar 2024 · Tags: CWE-453
- [SoftEther VPN: An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of…](https://agentprime.io/advisories/CVE-2023-27516.md)
  `CVE-2023-27516` · CVE record: SoftEther VPN SoftEther VPN · CVSS 7.3 High · Not analysed yet · Published 12 Oct 2023 · Tags: CWE-453
- [Ghost: An insecure default vulnerability exists in the Post Creation functionality of Ghost…](https://agentprime.io/advisories/CVE-2022-47197.md)
  `CVE-2022-47197` · CVE record: Ghost Foundation Ghost · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Jan 2023 · Tags: CWE-453
- [Ghost: An insecure default vulnerability exists in the Post Creation functionality of Ghost…](https://agentprime.io/advisories/CVE-2022-47196.md)
  `CVE-2022-47196` · CVE record: Ghost Foundation Ghost · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Jan 2023 · Tags: CWE-453
- [Ghost: An insecure default vulnerability exists in the Post Creation functionality of Ghost…](https://agentprime.io/advisories/CVE-2022-47195.md)
  `CVE-2022-47195` · CVE record: Ghost Foundation Ghost · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Jan 2023 · Tags: CWE-453
- [Ghost: An insecure default vulnerability exists in the Post Creation functionality of Ghost…](https://agentprime.io/advisories/CVE-2022-47194.md)
  `CVE-2022-47194` · CVE record: Ghost Foundation Ghost · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Jan 2023 · Tags: CWE-453
- [JetBrains TeamCity: In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default…](https://agentprime.io/advisories/CVE-2022-46831.md)
  `CVE-2022-46831` · CVE record: JetBrains TeamCity · CVSS 6.6 Medium · Not analysed yet · Published 8 Dec 2022 · Tags: CWE-453
- [A flaw was found in Openshift.](https://agentprime.io/advisories/CVE-2022-3262.md)
  `CVE-2022-3262` · CVE record: openshift · CVSS 8.1 High · Not analysed yet · Published 8 Dec 2022 · Tags: CWE-453, CWE-1188
- [DotNetNuke Default Machine Key Exposure](https://agentprime.io/advisories/GHSA-grw3-hjjm-5cjm.md)
  `GHSA-grw3-hjjm-5cjm`, `CVE-2008-6540` · NuGet `DotNetNuke.Core`: affected `<4.8.2`, fixed in `4.8.2` · No CVSS score · Not analysed yet · Published 14 May 2022 · Tags: CWE-453
- [GE UR family insecure default variable initialization](https://agentprime.io/advisories/CVE-2021-27426.md)
  `CVE-2021-27426` · CVE record: GE UR family · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Mar 2022 · Tags: CWE-453
- [CORS misconfiguration in socket.io](https://agentprime.io/advisories/GHSA-fxwf-4rqh-v8g3.md)
  `GHSA-fxwf-4rqh-v8g3`, `CVE-2020-28481` · npm `socket.io`: affected `<2.4.0`, fixed in `2.4.0` · CVSS 5.3 Medium · Not analysed yet · Published 20 Jan 2021 · Tags: CWE-346, CWE-453

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-453>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-453/>. Everything for agents: <https://agentprime.io/llms.txt>.