# CWE-459.

Every Advisory and CVE whose sources give the weakness CWE-459, newest first.

## Records, newest first

- [nvm install --offline installs a cached tarball that previously failed checksum verification](https://agentprime.io/advisories/CVE-2026-121750.md)
  `CVE-2026-121750` · CVE record: nvm-sh nvm · CVSS 2.1 Low · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-459, CWE-494
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-121204.md)
  `CVE-2026-121204` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-121055.md)
  `CVE-2026-121055` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-121096.md)
  `CVE-2026-121096` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-459
- [Bluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peer](https://agentprime.io/advisories/CVE-2026-85033.md)
  `CVE-2026-85033` · CVE record: zephyrproject zephyr · CVSS 4.6 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-459
- [HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk](https://agentprime.io/advisories/CVE-2026-116132.md)
  `CVE-2026-116132` · CVE record · CVSS 7.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-459
- [undici vulnerable to Denial of Service via unhandled error on excessive content-encodings](https://agentprime.io/advisories/GHSA-xjj6-f33q-929c.md)
  `GHSA-xjj6-f33q-929c`, `CVE-2026-109869` · npm `undici`: affected `>=6.23.0, <6.29.1 || >=7.18.0, <7.30.1 || >=8.0.0, <8.12.2`, fixed in `6.29.1`, `7.30.1`, `8.12.2` · CVSS 7.5 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-248, CWE-459
- [obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes](https://agentprime.io/advisories/GHSA-r3g7-r4hr-m258.md)
  `GHSA-r3g7-r4hr-m258`, `CVE-2026-115478` · npm `obsidian-tc`: affected `>=1.0.1, <1.31.4`, fixed in `1.31.4` · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control, CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-113168.md)
  `CVE-2026-113168` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-113050.md)
  `CVE-2026-113050` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-113073.md)
  `CVE-2026-113073` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-113010.md)
  `CVE-2026-113010` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-113012.md)
  `CVE-2026-113012` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-459
- [ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory](https://agentprime.io/advisories/GHSA-qhcq-9pm2-c9w9.md)
  `GHSA-qhcq-9pm2-c9w9`, `CVE-2026-113658` · npm `apostrophe`: affected `<4.33.0`, fixed in `4.33.0` · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Denial of service, CWE-459
- [Apache Tomcat: Possible TLS 1.3 connection failures](https://agentprime.io/advisories/CVE-2026-93446.md)
  `CVE-2026-93446` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-459
- [Apache Tomcat: HTTP/2 trailer header cross-contamination](https://agentprime.io/advisories/CVE-2026-88041.md)
  `CVE-2026-88041` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-459
- [@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback](https://agentprime.io/advisories/CVE-2026-110008.md)
  `CVE-2026-110008` · CVE record: @fastify/oauth2 @fastify/oauth2 · CVSS 4.2 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site request forgery (CSRF), Authentication bypass, CWE-459
- [MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records](https://agentprime.io/advisories/CVE-2026-112180.md)
  `CVE-2026-112180` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-459
- [My Control System 26.5 – Disk space exhaustion due to incorrect temporary file cleanup after XML conversion](https://agentprime.io/advisories/CVE-2026-17525.md)
  `CVE-2026-17525` · CVE record: ABB My Control System · CVSS 5.1 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-459
- [Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when BGP MVPN inter-region tunneling is used](https://agentprime.io/advisories/CVE-2026-102030.md)
  `CVE-2026-102030` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-459
- [Misskey: Denial of service resulting from insufficient cleanup processing during file uploads](https://agentprime.io/advisories/CVE-2026-103937.md)
  `CVE-2026-103937` · CVE record: misskey-dev misskey · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-459
- [Code for IBM i: Temporary files are visible to all users](https://agentprime.io/advisories/CVE-2026-49484.md)
  `CVE-2026-49484` · CVE record: codefori vscode-ibmi · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-377, CWE-459
- [ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG Decoder](https://agentprime.io/advisories/CVE-2026-109276.md)
  `CVE-2026-109276` · CVE record: ImageMagick ImageMagick · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-459
- [Incomplete cleanup in IDRIX VeraCrypt](https://agentprime.io/advisories/CVE-2026-108982.md)
  `CVE-2026-108982` · CVE record: IDRIX VeraCrypt · CVSS 7.2 High · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-459
- [Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure](https://agentprime.io/advisories/CVE-2026-19740.md)
  `CVE-2026-19740` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Denial of service, CWE-459
- [Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update](https://agentprime.io/advisories/CVE-2026-19739.md)
  `CVE-2026-19739` · CVE record: zephyrproject zephyr · CVSS 6.5 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Denial of service, CWE-459
- [Incomplete cleanup in Backdrop](https://agentprime.io/advisories/CVE-2026-107914.md)
  `CVE-2026-107914` · CVE record: backdropcms Backdrop · CVSS 7.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-459
- [Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code](https://agentprime.io/advisories/CVE-2026-107332.md)
  `CVE-2026-107332` · CVE record: aws aws-toolkit-vscode · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control, CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-106294.md)
  `CVE-2026-106294` · CVE record: Google Chrome · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-106394.md)
  `CVE-2026-106394` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-106375.md)
  `CVE-2026-106375` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-106262.md)
  `CVE-2026-106262` · CVE record: Google Chrome · CVSS 4.2 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-106203.md)
  `CVE-2026-106203` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-106243.md)
  `CVE-2026-106243` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-106366.md)
  `CVE-2026-106366` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-459
- [compression vulnerable to Denial of Service via memory leak on premature response close](https://agentprime.io/advisories/GHSA-vc2v-76pw-4v95.md)
  `GHSA-vc2v-76pw-4v95`, `CVE-2026-87776` · npm `compression`: affected `<1.8.2`, fixed in `1.8.2` · CVSS 7.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Denial of service, CWE-459
- [Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry](https://agentprime.io/advisories/CVE-2026-104427.md)
  `CVE-2026-104427` · CVE record: ZcashFoundation zebra · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-459
- [Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout](https://agentprime.io/advisories/CVE-2026-104421.md)
  `CVE-2026-104421` · CVE record: ZcashFoundation zebra · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-95326.md)
  `CVE-2026-95326` · CVE record: Google Chrome · CVSS 8.4 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-95303.md)
  `CVE-2026-95303` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-459
- [Out-of-bounds write in Das U-Boot](https://agentprime.io/advisories/CVE-2026-15390.md)
  `CVE-2026-15390` · CVE record: DENX Software Engineering Das U-Boot · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption, CWE-459
- [multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads](https://agentprime.io/advisories/GHSA-3pph-fpjx-jg34.md)
  `GHSA-3pph-fpjx-jg34`, `CVE-2026-88932` · npm `multer`: affected `>=2.2.0, <2.4.0`, fixed in `2.4.0` · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Denial of service, CWE-459
- [ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup](https://agentprime.io/advisories/CVE-2026-101100.md)
  `CVE-2026-101100` · CVE record: ag-ui-protocol ag-ui · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: CWE-459
- [podman quadlet install --replace does not fully replace the old file](https://agentprime.io/advisories/GHSA-fx76-2j3w-2mx6.md)
  `GHSA-fx76-2j3w-2mx6`, `CVE-2026-19730`, `GO-2026-6588` · Go `github.com/containers/podman/v5`: affected `>=5.7.0, <5.8.6`, fixed in `5.8.6` · CVSS 4.2 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-20, CWE-459
- [Apache Tomcat: HTTP/2 DoS via malformed request](https://agentprime.io/advisories/CVE-2026-78437.md)
  `CVE-2026-78437` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 7.3 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-91730.md)
  `CVE-2026-91730` · CVE record: Google Chrome · CVSS 3.1 Low · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-459
- [A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.](https://agentprime.io/advisories/CVE-2026-75945.md)
  `CVE-2026-75945` · CVE record: Arista Networks EOS · CVSS 2.1 Low · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-459
- [A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants…](https://agentprime.io/advisories/CVE-2026-75944.md)
  `CVE-2026-75944` · CVE record: Arista Networks EOS · CVSS 5.6 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-459
- [A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this windo…](https://agentprime.io/advisories/CVE-2026-75943.md)
  `CVE-2026-75943` · CVE record: Arista Networks EOS · CVSS 2.1 Low · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-87549.md)
  `CVE-2026-87549` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-87436.md)
  `CVE-2026-87436` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-87446.md)
  `CVE-2026-87446` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-459
- [multer vulnerable to Denial of Service via file descriptor leak on aborted uploads](https://agentprime.io/advisories/GHSA-qfvm-cv95-jqjf.md)
  `GHSA-qfvm-cv95-jqjf`, `CVE-2026-77037` · npm `multer`: affected `>=2.2.0, <2.3.0`, fixed in `2.3.0` · CVSS 7.5 High · Not analysed yet · Published 8 Sept 2026 · Tags: Denial of service, CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-85043.md)
  `CVE-2026-85043` · CVE record: Google Chrome · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-459
- [Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention](https://agentprime.io/advisories/CVE-2026-78600.md)
  `CVE-2026-78600` · CVE record: Elastic Eck Operator · CVSS 3.5 Low · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-459
- [filebrowser through 2.63.23 Stale Share Link via File Rename](https://agentprime.io/advisories/CVE-2026-82237.md)
  `CVE-2026-82237` · CVE record: filebrowser filebrowser · CVSS 2.3 Low · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-459
- [File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion](https://agentprime.io/advisories/CVE-2026-82236.md)
  `CVE-2026-82236` · CVE record: filebrowser filebrowser · CVSS 2.3 Low · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-78947.md)
  `CVE-2026-78947` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-79265.md)
  `CVE-2026-79265` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-459
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-78903.md)
  `CVE-2026-78903` · CVE record: Google Chrome · CVSS 3.1 Low · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-459

Older: <https://agentprime.io/advisories/tag/cwe-459.md?cursor=WyIyMDI2LTA4LTI1VDIwOjEwOjM3LjU2NDAwMFoiLCJDVkUtMjAyNi03ODkwMyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-459>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-459/>. Everything for agents: <https://agentprime.io/llms.txt>.