Advisories · Weakness
CWE-459.
Every Advisory and CVE whose sources give the weakness CWE-459, newest first.
- CVSS 2.1 Low
nvm install --offline installs a cached tarball that previously failed checksum verification
- nvm
- CWE-459
- CWE-494
- CVSS 8.8 High
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
-
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
-
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 4.6 Medium
Bluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peer
- zephyr
- CWE-459
- CVSS 7.1 High
HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk
- CWE-459
- CVSS 7.5 High
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
- CWE-248
- CWE-459
>=6.23.0, <6.29.1 || >=7.18.0, <7.30.1 || >=8.0.0, <8.12.2 · fixed in 6.29.1, 7.30.1, 8.12.2
GHSA-xjj6-f33q-929c · CVE-2026-109869 - CVSS 7.1 High
obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
- Broken access control
- CWE-459
>=1.0.1, <1.31.4 · fixed in 1.31.4
GHSA-r3g7-r4hr-m258 · CVE-2026-115478 - CVSS 8.8 High
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 6.5 Medium
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 8.8 High
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 6.5 Medium
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 8.8 High
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 7.5 High
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
- Denial of service
- CWE-459
<4.33.0 · fixed in 4.33.0
GHSA-qhcq-9pm2-c9w9 · CVE-2026-113658 - CVSS 7.5 High
Apache Tomcat: Possible TLS 1.3 connection failures
- Apache Software Foundation Apache Tomcat
- CWE-459
- CVSS 7.5 High
Apache Tomcat: HTTP/2 trailer header cross-contamination
- Apache Software Foundation Apache Tomcat
- CWE-459
- CVSS 4.2 Medium
@fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback
- @fastify/oauth2
- Cross-site request forgery (CSRF)
- Authentication bypass
- CVSS 5.1 Medium
MISP Incomplete Event Deletion Leaves Orphaned Sensitive Records
- MISP
- CWE-459
- CVSS 5.1 Medium
My Control System 26.5 – Disk space exhaustion due to incorrect temporary file cleanup after XML conversion
- ABB My Control System
- CWE-459
- CVSS 8.7 High
Junos OS and Junos OS Evolved: An attacker causes routing-daemon denial of service when BGP MVPN inter-region tunneling is used
- Juniper Networks Junos OS
- Juniper Networks Junos OS Evolved
- CWE-459
- CVSS 8.7 High
Misskey: Denial of service resulting from insufficient cleanup processing during file uploads
- misskey
- CWE-459
- CVSS 5.1 Medium
Code for IBM i: Temporary files are visible to all users
- codefori vscode-ibmi
- CWE-377
- CWE-459
- CVSS 6.9 Medium
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Temporary File Leak in JNG Decoder
- ImageMagick
- CWE-459
- CVSS 7.2 High
Incomplete cleanup in IDRIX VeraCrypt
- IDRIX VeraCrypt
- CWE-459
- CVSS 6.5 Medium
Bluetooth LE Controller: retained RX node leak and reachable assertion in the PHY Update procedure
- zephyr
- Denial of service
- CWE-459
- CVSS 6.5 Medium
Bluetooth LE controller leaks a retained RX node when an unexpected LL Control PDU arrives during a Connection Update
- zephyr
- Denial of service
- CWE-459
- CVSS 7.8 High
Incomplete cleanup in Backdrop
- Backdrop
- CWE-459
- CVSS 6.8 Medium
Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code
- aws-toolkit-vscode
- Broken access control
- CWE-459
- CVSS 9.1 CriticalCritical · CVSS 9+
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 4.3 Medium
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 9.6 CriticalCritical · CVSS 9+
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 4.2 Medium
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 8.8 High
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 5.3 Medium
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 5.4 Medium
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 7.5 High
compression vulnerable to Denial of Service via memory leak on premature response close
- Denial of service
- CWE-459
<1.8.2 · fixed in 1.8.2
GHSA-vc2v-76pw-4v95 · CVE-2026-87776 - CVSS 8.2 High
Zebra before 6.1.0 Chain Stall via Stale parent_error_map Entry
- ZcashFoundation zebra
- CWE-459
- CVSS 6.9 Medium
Zebra before 6.2.1 Block Download Denial of Service via KnownBlock SentHashes Lockout
- ZcashFoundation zebra
- CWE-459
- CVSS 8.4 High
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 6.5 Medium
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 9.0 CriticalCritical · CVSS 9+
Out-of-bounds write in Das U-Boot
- DENX Software Engineering Das U-Boot
- Memory corruption
- CWE-459
- CVSS 5.3 Medium
multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
- Denial of service
- CWE-459
>=2.2.0, <2.4.0 · fixed in 2.4.0
GHSA-3pph-fpjx-jg34 · CVE-2026-88932 - CVSS 5.3 Medium
ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup
- ag-ui
- CWE-459
- CVSS 4.2 Medium
podman quadlet install --replace does not fully replace the old file
- CWE-20
- CWE-459
>=5.7.0, <5.8.6 · fixed in 5.8.6
GHSA-fx76-2j3w-2mx6 · CVE-2026-19730 - CVSS 7.3 High
Apache Tomcat: HTTP/2 DoS via malformed request
- Apache Software Foundation Apache Tomcat
- CWE-459
- CVSS 3.1 Low
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 2.1 Low
A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.
- Arista Networks EOS
- CWE-459
- CVSS 5.6 Medium
A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants…
- Arista Networks EOS
- CWE-459
- CVSS 2.1 Low
A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this windo…
- Arista Networks EOS
- CWE-459
- CVSS 6.5 Medium
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 6.5 Medium
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 6.5 Medium
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 7.5 High
multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
- Denial of service
- CWE-459
>=2.2.0, <2.3.0 · fixed in 2.3.0
GHSA-qfvm-cv95-jqjf · CVE-2026-77037 - CVSS 9.1 CriticalCritical · CVSS 9+
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 3.5 Low
Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention
- Elastic Eck Operator
- CWE-459
- CVSS 2.3 Low
filebrowser through 2.63.23 Stale Share Link via File Rename
- filebrowser
- CWE-459
- CVSS 2.3 Low
File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion
- filebrowser
- CWE-459
- CVSS 6.5 Medium
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 5.3 Medium
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459
- CVSS 3.1 Low
Incomplete cleanup in Google Chrome
- Google Chrome
- CWE-459