# CWE-454.

Every Advisory and CVE whose sources give the weakness CWE-454, newest first.

## Records, newest first

- [pam_usb: getenv() used in PAM context allows environment variable injection into local-check logic](https://agentprime.io/advisories/CVE-2026-48980.md)
  `CVE-2026-48980` · CVE record: mcdope pam_usb · CVSS 6.3 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-454, CWE-807
- [Kirby: External Initialization of the Panel on reverse proxy setups with the \`Forwarded\` header](https://agentprime.io/advisories/GHSA-whxw-24jc-cwmv.md)
  `GHSA-whxw-24jc-cwmv`, `CVE-2026-54003`, `PKSA-h8zr-vfb5-1d5r` · Packagist `getkirby/cms`: affected `<4.9.4 || >=5.0.0-alpha.1, <5.4.4`, fixed in `4.9.4`, `5.4.4` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-454
- [OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config](https://agentprime.io/advisories/GHSA-mj59-h3q9-ghfh.md)
  `GHSA-mj59-h3q9-ghfh`, `CVE-2026-44995` · npm `openclaw`: affected `<2026.4.20`, fixed in `2026.4.20` · CVSS 5.4 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: CWE-427, CWE-454, CWE-829
- [Microsoft Azure AD SSH Login extension for Linux Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-26148.md)
  `CVE-2026-26148` · CVE record: Microsoft Microsoft Azure AD SSH Login extension for Linux · CVSS 8.1 High · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-454
- [IBM AIX privilege escalation](https://agentprime.io/advisories/CVE-2025-36244.md)
  `CVE-2025-36244` · CVE record: IBM AIX and 1 more · CVSS 7.4 High · Not analysed yet · Published 16 Sept 2025 · Tags: CWE-454

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-454>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-454/>. Everything for agents: <https://agentprime.io/llms.txt>.