Advisories · Weakness
CWE-454.
Every Advisory and CVE whose sources give the weakness CWE-454, newest first.
- CVSS 6.3 Medium
pam_usb: getenv() used in PAM context allows environment variable injection into local-check logic
- mcdope pam_usb
- CWE-454
- CWE-807
- CVSS 9.1 CriticalCritical · CVSS 9+
Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
- CWE-454
<4.9.4 || >=5.0.0-alpha.1, <5.4.4 · fixed in 4.9.4, 5.4.4
GHSA-whxw-24jc-cwmv · CVE-2026-54003 - CVSS 5.4 Medium
OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config
- CWE-427
- CWE-454
<2026.4.20 · fixed in 2026.4.20
GHSA-mj59-h3q9-ghfh · CVE-2026-44995 - CVSS 8.1 High
Microsoft Azure AD SSH Login extension for Linux Elevation of Privilege Vulnerability
- Microsoft Azure AD SSH Login extension for Linux
- CWE-454
- CVSS 7.4 High
IBM AIX privilege escalation
- IBM AIX
- IBM VIOS
- CWE-454