# CWE-459.

Every Advisory and CVE whose sources give the weakness CWE-459, newest first.

## Records, newest first (an older page)

- [Rocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close](https://agentprime.io/advisories/CVE-2026-72714.md)
  `CVE-2026-72714` · CVE record: rocq-prover rocq · CVSS 6.8 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-459
- [Cross-Document Parser State Contamination in misp-stix](https://agentprime.io/advisories/CVE-2026-77761.md)
  `CVE-2026-77761` · CVE record: misp misp-stix · CVSS 6.3 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: CWE-459
- [FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup](https://agentprime.io/advisories/CVE-2026-67442.md)
  `CVE-2026-67442` · CVE record: frangoteam FUXA · CVSS 2.0 Low · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control, CWE-459
- [Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite](https://agentprime.io/advisories/CVE-2026-9693.md)
  `CVE-2026-9693` · CVE record: Mattermost Mattermost · CVSS 3.5 Low · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-459
- [@fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload](https://agentprime.io/advisories/CVE-2026-19474.md)
  `CVE-2026-19474` · CVE record: @fastify/multipart @fastify/multipart · CVSS 7.5 High · Not analysed yet · Published 15 Aug 2026 · Tags: Denial of service, CWE-459
- [Incomplete cleanup in Intel(R) reference platforms](https://agentprime.io/advisories/CVE-2026-20712.md)
  `CVE-2026-20712` · CVE record: Intel(R) reference platforms · CVSS 4.0 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-459
- [Powerpoint Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-68809.md)
  `CVE-2026-68809` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-459
- [poco-ai poco-agent Claude File workspace.py WorkspaceManager.\_setup_session_persistence cleanup](https://agentprime.io/advisories/CVE-2026-19019.md)
  `CVE-2026-19019` · CVE record: poco-ai poco-agent · CVSS 6.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-459
- [Incomplete cleanup in Sharp Corporation Sharp MFPs and others](https://agentprime.io/advisories/CVE-2026-63545.md)
  `CVE-2026-63545` · CVE record: Sharp Corporation Sharp MFPs and 1 more · CVSS 2.4 Low · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-459
- [vIRQ event channel binding may break Xenstore](https://agentprime.io/advisories/CVE-2026-42492.md)
  `CVE-2026-42492` · CVE record: Xen Xen · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: CWE-459
- [arm64: tlb: Flush walk cache when unsharing PMD tables](https://agentprime.io/advisories/CVE-2026-63875.md)
  `CVE-2026-63875` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 19 Jul 2026 · Tags: CWE-459
- [GPU DDK - Page UAF read in PMMETA_PROTECT heap memory](https://agentprime.io/advisories/CVE-2026-7639.md)
  `CVE-2026-7639` · CVE record: Imagination Technologies Graphics DDK · CVSS 7.8 High · Not analysed yet · Published 10 Jul 2026 · Tags: CWE-459
- [Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows](https://agentprime.io/advisories/GHSA-2vg6-77g8-24mp.md)
  `GHSA-2vg6-77g8-24mp`, `CVE-2026-67334` · npm `better-auth` and 1 more: affected `>=0.3.4, <1.6.11`, fixed in `1.6.11` · CVSS 5.1 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: Authentication bypass, CWE-459, CWE-672
- [mknod: Device nodes created mislabeled on SELinux, with broken cleanup (remove_dir on a node)](https://agentprime.io/advisories/GHSA-r9hw-mj3w-phcq.md)
  `GHSA-r9hw-mj3w-phcq`, `CVE-2026-35361` · crates.io `uu_mknod`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 3.4 Low · Not analysed yet · Published 6 Jul 2026 · Tags: Broken access control, CWE-281, CWE-459
- [zebrad has persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip](https://agentprime.io/advisories/GHSA-2gf8-q9rr-jq3h.md)
  `GHSA-2gf8-q9rr-jq3h`, `CVE-2026-52733` · crates.io `zebrad` and 1 more: affected `<4.5.0`, fixed in `4.5.0` · CVSS 6.5 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: CWE-459, CWE-672
- [Zebra has block suppression via NU5 same-header body poisoning of sent-hash cache](https://agentprime.io/advisories/GHSA-4m69-67m6-prqp.md)
  `GHSA-4m69-67m6-prqp`, `CVE-2026-52736` · crates.io `zebrad` and 1 more: affected `<4.5.0`, fixed in `4.5.0` · CVSS 8.7 High · Not analysed yet · Published 2 Jul 2026 · Tags: CWE-459
- [Double free in Eclipse Foundation Eclipse ThreadX - NetX Duo](https://agentprime.io/advisories/CVE-2026-11576.md)
  `CVE-2026-11576` · CVE record: Eclipse Foundation Eclipse ThreadX - NetX Duo · CVSS 7.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: Memory corruption, CWE-459
- [Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads](https://agentprime.io/advisories/GHSA-3p4h-7m6x-2hcm.md)
  `GHSA-3p4h-7m6x-2hcm`, `CVE-2026-5038` · npm `multer`: affected `>=2.0.0-alpha.1, <2.2.0 || >=3.0.0-alpha.1, <3.0.0-alpha.2`, fixed in `2.2.0`, `3.0.0-alpha.2` · CVSS 5.3 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: CWE-459
- [Capgo < 12.128.2 - Orphaned File Retention via Profile Image Replacement](https://agentprime.io/advisories/CVE-2026-53867.md)
  `CVE-2026-53867` · CVE record: Capgo Capgo · CVSS 5.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: CWE-459
- [AutoGPT: Unauthenticated DoS via Disk Space Exhaustion](https://agentprime.io/advisories/CVE-2026-33232.md)
  `CVE-2026-33232` · CVE record: Significant-Gravitas AutoGPT · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: Denial of service, CWE-459
- [Incomplete cleanup in AMD Instinct™ MI210 and others](https://agentprime.io/advisories/CVE-2026-0427.md)
  `CVE-2026-0427` · CVE record: AMD AMD Instinct™ MI210 and 3 more · CVSS 4.6 Medium · Not analysed yet · Published 15 May 2026 · Tags: CWE-459
- [Missing authentication check in SAP Commerce cloud configuration](https://agentprime.io/advisories/CVE-2026-34263.md)
  `CVE-2026-34263` · CVE record: SAP_SE SAP Commerce cloud configuration · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: CWE-459
- [Apache CloudStack: MinIO policy remains intact on bucket deletion](https://agentprime.io/advisories/CVE-2025-66467.md)
  `CVE-2025-66467` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 8.0 High · Not analysed yet · Published 8 May 2026 · Tags: CWE-459
- [seg6: separate dst_cache for input and output paths in seg6 lwtunnel](https://agentprime.io/advisories/CVE-2026-31668.md)
  `CVE-2026-31668` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Apr 2026 · Tags: CWE-459
- [Nesquena Hermes WebUI Environment Variable Credential Leakage via Profile Switch](https://agentprime.io/advisories/CVE-2026-6830.md)
  `CVE-2026-6830` · CVE record: nesquena hermes-webui · CVSS 4.8 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Information disclosure, CWE-459
- [Multer vulnerable to Denial of Service via incomplete cleanup](https://agentprime.io/advisories/GHSA-xf7r-hgr6-v32p.md)
  `GHSA-xf7r-hgr6-v32p`, `CVE-2026-3304` · npm `multer`: affected `<2.1.0`, fixed in `2.1.0` · CVSS 8.7 High · Not analysed yet · Published 1 Mar 2026 · Tags: CWE-459
- [Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse](https://agentprime.io/advisories/GHSA-rfjg-6m84-crj2.md)
  `GHSA-rfjg-6m84-crj2`, `CVE-2026-28268`, `GO-2026-4575` · Go `code.vikunja.io/api`: affected `<=0.24.6`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Feb 2026 · Tags: CWE-459, CWE-640
- [Incomplete cleanup in JetBrains TeamCity](https://agentprime.io/advisories/CVE-2026-28196.md)
  `CVE-2026-28196` · CVE record: JetBrains TeamCity · CVSS 2.3 Low · Not analysed yet · Published 25 Feb 2026 · Tags: CWE-459
- [webtransport-go: Memory Exhaustion Attack due to Missing Cleanup of Streams Map](https://agentprime.io/advisories/GHSA-2f2x-8mwp-p2gc.md)
  `GHSA-2f2x-8mwp-p2gc`, `CVE-2026-21438`, `GO-2026-4483` · Go `github.com/quic-go/webtransport-go`: affected `<0.10.0`, fixed in `0.10.0` · CVSS 5.3 Medium · Not analysed yet · Published 12 Feb 2026 · Tags: Denial of service, CWE-459
- [Tanium addressed an uncontrolled resource consumption vulnerability in Connect.](https://agentprime.io/advisories/CVE-2025-15331.md)
  `CVE-2025-15331` · CVE record: Tanium Connect · CVSS 4.3 Medium · Not analysed yet · Published 5 Feb 2026 · Tags: CWE-459
- [Apache Struts has a Denial of Service vulnerability](https://agentprime.io/advisories/GHSA-rg58-xhh7-mqjw.md)
  `GHSA-rg58-xhh7-mqjw`, `CVE-2025-66675` · Maven `org.apache.struts:struts2-core`: affected `>=2.0.0, <6.8.0 || >=7.0.0, <7.1.1`, fixed in `6.8.0`, `7.1.1` · CVSS 8.2 High · Not analysed yet · Published 10 Dec 2025 · Tags: CWE-459
- [Apache Struts is Vulnerable to DoS via File Leak](https://agentprime.io/advisories/GHSA-xx7v-hqxh-cjr9.md)
  `GHSA-xx7v-hqxh-cjr9`, `CVE-2025-64775` · Maven `org.apache.struts:struts2-core`: affected `>=6.0.0, <6.8.0 || >=7.0.0, <7.1.1 || >=2.0.0, <=2.3.37 || >=2.5.0, <=2.5.33`, fixed in `6.8.0`, `7.1.1` · CVSS 7.5 High · Not analysed yet · Published 1 Dec 2025 · Tags: CWE-459
- [Incomplete cleanup in AMD EPYC™ 9004 Series Processors and others](https://agentprime.io/advisories/CVE-2025-29934.md)
  `CVE-2025-29934` · CVE record: AMD AMD EPYC™ 9004 Series Processors and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 21 Nov 2025 · Tags: CWE-459
- [PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function](https://agentprime.io/advisories/CVE-2025-60730.md)
  `CVE-2025-60730` · CVE record · CVSS 7.6 High · Not analysed yet · Published 24 Oct 2025 · Tags: CWE-459
- [Possible denial of service with multiple incoming connections to a Schannel based server with a TLS backend](https://agentprime.io/advisories/CVE-2025-6338.md)
  `CVE-2025-6338` · CVE record: Qt Qt · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2025 · Tags: CWE-459
- [BIG-IP DNS cache vulnerability](https://agentprime.io/advisories/CVE-2025-59781.md)
  `CVE-2025-59781` · CVE record: F5 BIG-IP and 1 more · CVSS 8.7 High · Not analysed yet · Published 15 Oct 2025 · Tags: CWE-459
- [Incomplete cleanup in Cisco IOS XE Software](https://agentprime.io/advisories/CVE-2025-20293.md)
  `CVE-2025-20293` · CVE record: Cisco Cisco IOS XE Software · CVSS 5.3 Medium · Not analysed yet · Published 24 Sept 2025 · Tags: CWE-459
- [CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php.](https://agentprime.io/advisories/CVE-2025-55910.md)
  `CVE-2025-55910` · CVE record · CVSS 6.3 Medium · Not analysed yet · Published 19 Sept 2025 · Tags: CWE-459
- [Incomplete cleanup in AMD EPYC™ 9005 Series Processors and others](https://agentprime.io/advisories/CVE-2025-0032.md)
  `CVE-2025-0032` · CVE record: AMD AMD EPYC™ 9005 Series Processors and 4 more · CVSS 7.2 High · Not analysed yet · Published 6 Sept 2025 · Tags: CWE-459
- [Incomplete cleanup in AMD EPYC™ 7003 Series Processors and others](https://agentprime.io/advisories/CVE-2024-21977.md)
  `CVE-2024-21977` · CVE record: AMD AMD EPYC™ 7003 Series Processors and 4 more · CVSS 3.2 Low · Not analysed yet · Published 5 Sept 2025 · Tags: CWE-459
- [Incomplete cleanup in Tunnelblick](https://agentprime.io/advisories/CVE-2025-43711.md)
  `CVE-2025-43711` · CVE record: Tunnelblick Project Tunnelblick · CVSS 8.1 High · Not analysed yet · Published 4 Jul 2025 · Tags: CWE-459
- [Incomplete cleanup in Fortinet FortiProxy and others](https://agentprime.io/advisories/CVE-2023-29184.md)
  `CVE-2023-29184` · CVE record: Fortinet FortiProxy and 1 more · CVSS 3.1 Low · Not analysed yet · Published 10 Jun 2025 · Tags: CWE-459
- [Apache Tomcat Denial of Service via invalid HTTP priority header](https://agentprime.io/advisories/GHSA-3p2h-wqq4-wf4h.md)
  `GHSA-3p2h-wqq4-wf4h`, `BIT-tomcat-2025-31650`, `CVE-2025-31650` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=9.0.76, <9.0.104 || >=10.1.10, <10.1.40 || >=11.0.0-M2, <11.0.6 || >=8.5.0, <=8.5.100`, fixed in `9.0.104`, `10.1.40`, `11.0.6` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.61 · Not analysed yet · Published 28 Apr 2025 · Tags: CWE-459, CWE-460
- [Eclipse ThreadX NetX Duo HTTP component server denial of service](https://agentprime.io/advisories/CVE-2025-2260.md)
  `CVE-2025-2260` · CVE record: Eclipse Foundation ThreadX · CVSS 7.1 High · Not analysed yet · Published 6 Apr 2025 · Tags: CWE-459
- [Incomplete cleanup in STMicroelectronics X-CUBE-AZRT-H7RS and others](https://agentprime.io/advisories/CVE-2024-50385.md)
  `CVE-2024-50385` · CVE record: STMicroelectronics X-CUBE-AZRT-H7RS and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 2 Apr 2025 · Tags: CWE-459
- [Incomplete cleanup in STMicroelectronics X-CUBE-AZRT-H7RS and others](https://agentprime.io/advisories/CVE-2024-50384.md)
  `CVE-2024-50384` · CVE record: STMicroelectronics X-CUBE-AZRT-H7RS and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 2 Apr 2025 · Tags: CWE-459
- [Incomplete cleanup in AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics and others](https://agentprime.io/advisories/CVE-2024-36353.md)
  `CVE-2024-36353` · CVE record: AMD AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 2 Mar 2025 · Tags: CWE-459
- [Eclipse ThreadX NetX Duo HTTP server denial of service](https://agentprime.io/advisories/CVE-2025-0726.md)
  `CVE-2025-0726` · CVE record: Eclipse Foundation ThreadX · CVSS 7.1 High · Not analysed yet · Published 21 Feb 2025 · Tags: CWE-459
- [Incomplete cleanup in NVIDIA vGPU software](https://agentprime.io/advisories/CVE-2024-53881.md)
  `CVE-2024-53881` · CVE record: NVIDIA NVIDIA vGPU software · CVSS 5.5 Medium · Not analysed yet · Published 28 Jan 2025 · Tags: CWE-459
- [Incomplete cleanup in NVIDIA GPU Display Driver, vGPU software](https://agentprime.io/advisories/CVE-2024-53869.md)
  `CVE-2024-53869` · CVE record: NVIDIA NVIDIA GPU Display Driver, vGPU software · CVSS 5.5 Medium · Not analysed yet · Published 28 Jan 2025 · Tags: CWE-459
- [Incomplete Cleanup vulnerability in PMB platform](https://agentprime.io/advisories/CVE-2025-0473.md)
  `CVE-2025-0473` · CVE record: PMB Services PMB platform · CVSS 6.5 Medium · Not analysed yet · Published 16 Jan 2025 · Tags: CWE-459
- [SiYuan has an arbitrary file deletion vulnerability in github.com/siyuan-note/siyuan/kernel](https://agentprime.io/advisories/GHSA-8fx8-pffw-w498.md)
  `GHSA-8fx8-pffw-w498`, `CVE-2025-21609`, `GO-2025-3362` · Go `github.com/siyuan-note/siyuan/kernel`: affected `*`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 7 Jan 2025 · Tags: Information disclosure, CWE-459
- [IBOS v4.5.5 has an arbitrary file deletion vulnerability via \system\modules\dashboard\controllers\LoginController.php.](https://agentprime.io/advisories/CVE-2024-28265.md)
  `CVE-2024-28265` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2024 · Tags: CWE-459
- [Incomplete cleanup in Huawei HarmonyOS and others](https://agentprime.io/advisories/CVE-2024-45445.md)
  `CVE-2024-45445` · CVE record: Huawei HarmonyOS and 1 more · CVSS 4.0 Medium · Not analysed yet · Published 4 Sept 2024 · Tags: CWE-459
- [Incomplete cleanup in AMD EPYC™ 7003 Processors and others](https://agentprime.io/advisories/CVE-2023-31356.md)
  `CVE-2023-31356` · CVE record: AMD AMD EPYC™ 7003 Processors and 3 more · CVSS 4.4 Medium · Not analysed yet · Published 13 Aug 2024 · Tags: CWE-459
- [Incomplete cleanup in AMD EPYC™ 9004 Series Processors and others](https://agentprime.io/advisories/CVE-2023-20518.md)
  `CVE-2023-20518` · CVE record: AMD AMD EPYC™ 9004 Series Processors and 4 more · CVSS 1.9 Low · Not analysed yet · Published 13 Aug 2024 · Tags: CWE-459
- [Incomplete Cleanup in Conduit](https://agentprime.io/advisories/CVE-2024-6300.md)
  `CVE-2024-6300` · CVE record: The Conduit Contributors Conduit · CVSS 3.7 Low · Not analysed yet · Published 25 Jun 2024 · Tags: CWE-459
- [Moodle HTTP authorization header is preserved between "emulated redirects"](https://agentprime.io/advisories/GHSA-p2cj-86v4-7782.md)
  `GHSA-p2cj-86v4-7782`, `BIT-moodle-2024-38275`, `CVE-2024-38275`, `PKSA-g3r1-2nj3-qn37` · Packagist `moodle/moodle`: affected `<4.1.11 || >=4.2.0-beta, <4.2.8 || >=4.3.0-beta, <4.3.5 || >=4.4.0-beta, <4.4.1`, fixed in `4.1.11`, `4.2.8`, `4.3.5`, `4.4.1` · CVSS 7.5 High · Not analysed yet · Published 18 Jun 2024 · Tags: CWE-226, CWE-459
- [Incomplete cleanup in Intel(R) Power Gadget software for macOS](https://agentprime.io/advisories/CVE-2023-45846.md)
  `CVE-2023-45846` · CVE record: Intel(R) Power Gadget software for macOS · CVSS 5.5 Medium · Not analysed yet · Published 16 May 2024 · Tags: CWE-459
- [Incomplete cleanup in Cisco IOS XE Software](https://agentprime.io/advisories/CVE-2024-20303.md)
  `CVE-2024-20303` · CVE record: Cisco Cisco IOS XE Software · CVSS 7.4 High · Not analysed yet · Published 27 Mar 2024 · Tags: CWE-459

Newest: <https://agentprime.io/advisories/tag/cwe-459.md>
Older: <https://agentprime.io/advisories/tag/cwe-459.md?cursor=WyIyMDI0LTAzLTI3VDE3OjAwOjM3LjA3NTAwMFoiLCJDVkUtMjAyNC0yMDMwMyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-459&cursor=WyIyMDI2LTA4LTI1VDIwOjEwOjM3LjU2NDAwMFoiLCJDVkUtMjAyNi03ODkwMyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-459/?cursor=WyIyMDI2LTA4LTI1VDIwOjEwOjM3LjU2NDAwMFoiLCJDVkUtMjAyNi03ODkwMyJd>. Everything for agents: <https://agentprime.io/llms.txt>.