Advisories · Weakness
CWE-459.
Every Advisory and CVE whose sources give the weakness CWE-459, newest first.
- CVSS 6.8 Medium
Rocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close
- rocq
- CWE-459
- CVSS 6.3 Medium
Cross-Document Parser State Contamination in misp-stix
- misp-stix
- CWE-459
- CVSS 2.0 Low
FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup
- frangoteam FUXA
- Broken access control
- CWE-459
- CVSS 3.5 Low
Mattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite
- Mattermost
- CWE-459
- CVSS 7.5 High
@fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload
- @fastify/multipart
- Denial of service
- CWE-459
- CVSS 4.0 Medium
Incomplete cleanup in Intel(R) reference platforms
- Intel(R) reference platforms
- CWE-459
- CVSS 5.5 Medium
Powerpoint Information Disclosure Vulnerability
- Microsoft 365 Apps for Enterprise
- Microsoft Office 2019
- CWE-459
- CVSS 6.3 Medium
poco-ai poco-agent Claude File workspace.py WorkspaceManager._setup_session_persistence cleanup
- poco-ai poco-agent
- CWE-459
- CVSS 2.4 Low
Incomplete cleanup in Sharp Corporation Sharp MFPs and others
- Sharp Corporation Sharp MFPs
- Toshiba Tec Corporation Toshiba Tec MFPs
- CWE-459
- CVSS 7.5 High
vIRQ event channel binding may break Xenstore
- Xen
- CWE-459
- CVSS 7.8 High
arm64: tlb: Flush walk cache when unsharing PMD tables
- Linux kernel
- CWE-459
- CVSS 7.8 High
GPU DDK - Page UAF read in PMMETA_PROTECT heap memory
- Imagination Technologies Graphics DDK
- CWE-459
- CVSS 5.1 Medium
Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows
- Authentication bypass
- CWE-459
>=0.3.4, <1.6.11 · fixed in 1.6.11
GHSA-2vg6-77g8-24mp · CVE-2026-67334 - CVSS 3.4 Low
mknod: Device nodes created mislabeled on SELinux, with broken cleanup (remove_dir on a node)
- Broken access control
- CWE-281
<0.6.0 · fixed in 0.6.0
GHSA-r9hw-mj3w-phcq · CVE-2026-35361 - CVSS 6.5 Medium
zebrad has persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip
- CWE-459
- CWE-672
<4.5.0 · fixed in 4.5.0
GHSA-2gf8-q9rr-jq3h · CVE-2026-52733 - CVSS 8.7 High
Zebra has block suppression via NU5 same-header body poisoning of sent-hash cache
- CWE-459
<4.5.0 · fixed in 4.5.0
GHSA-4m69-67m6-prqp · CVE-2026-52736 - CVSS 7.5 High
Double free in Eclipse Foundation Eclipse ThreadX - NetX Duo
- Eclipse Foundation Eclipse ThreadX - NetX Duo
- Memory corruption
- CWE-459
- CVSS 5.3 Medium
Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads
- CWE-459
>=2.0.0-alpha.1, <2.2.0 || >=3.0.0-alpha.1, <3.0.0-alpha.2 · fixed in 2.2.0, 3.0.0-alpha.2
GHSA-3p4h-7m6x-2hcm · CVE-2026-5038 - CVSS 5.3 Medium
Capgo < 12.128.2 - Orphaned File Retention via Profile Image Replacement
- Capgo
- CWE-459
- CVSS 7.5 High
AutoGPT: Unauthenticated DoS via Disk Space Exhaustion
- Significant-Gravitas AutoGPT
- Denial of service
- CWE-459
- CVSS 4.6 Medium
Incomplete cleanup in AMD Instinct™ MI210 and others
- AMD Instinct™ MI210
- AMD Instinct™ MI300X
- CWE-459
- CVSS 9.6 CriticalCritical · CVSS 9+
Missing authentication check in SAP Commerce cloud configuration
- SAP_SE SAP Commerce cloud configuration
- CWE-459
- CVSS 8.0 High
Apache CloudStack: MinIO policy remains intact on bucket deletion
- Apache Software Foundation Apache CloudStack
- CWE-459
- CVSS 9.8 CriticalCritical · CVSS 9+
seg6: separate dst_cache for input and output paths in seg6 lwtunnel
- Linux kernel
- CWE-459
- CVSS 4.8 Medium
Nesquena Hermes WebUI Environment Variable Credential Leakage via Profile Switch
- nesquena hermes-webui
- Information disclosure
- CWE-459
- CVSS 8.7 High
Multer vulnerable to Denial of Service via incomplete cleanup
- CWE-459
<2.1.0 · fixed in 2.1.0
GHSA-xf7r-hgr6-v32p · CVE-2026-3304 - CVSS 9.8 CriticalCritical · CVSS 9+
Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse
- CWE-459
- CWE-640
<=0.24.6 · no fixed version yet
GHSA-rfjg-6m84-crj2 · CVE-2026-28268 - CVSS 2.3 Low
Incomplete cleanup in JetBrains TeamCity
- JetBrains TeamCity
- CWE-459
- CVSS 5.3 Medium
webtransport-go: Memory Exhaustion Attack due to Missing Cleanup of Streams Map
- Denial of service
- CWE-459
<0.10.0 · fixed in 0.10.0
GHSA-2f2x-8mwp-p2gc · CVE-2026-21438 - CVSS 4.3 Medium
Tanium addressed an uncontrolled resource consumption vulnerability in Connect.
- Tanium Connect
- CWE-459
- CVSS 8.2 High
Apache Struts has a Denial of Service vulnerability
- CWE-459
>=2.0.0, <6.8.0 || >=7.0.0, <7.1.1 · fixed in 6.8.0, 7.1.1
GHSA-rg58-xhh7-mqjw · CVE-2025-66675 - CVSS 7.5 High
Apache Struts is Vulnerable to DoS via File Leak
- CWE-459
>=6.0.0, <6.8.0 || >=7.0.0, <7.1.1 || >=2.0.0, <=2.3.37 || >=2.5.0, <=2.5.33 · fixed in 6.8.0, 7.1.1
GHSA-xx7v-hqxh-cjr9 · CVE-2025-64775 - CVSS 5.3 Medium
Incomplete cleanup in AMD EPYC™ 9004 Series Processors and others
- AMD EPYC™ 9004 Series Processors
- AMD EPYC™ 9005 Series Processors
- CWE-459
- CVSS 7.6 High
PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function
- CWE-459
- CVSS 9.2 CriticalCritical · CVSS 9+
Possible denial of service with multiple incoming connections to a Schannel based server with a TLS backend
- Qt
- CWE-459
- CVSS 8.7 High
BIG-IP DNS cache vulnerability
- F5 BIG-IP
- F5 BIG-IP Next CNF
- CWE-459
- CVSS 5.3 Medium
Incomplete cleanup in Cisco IOS XE Software
- Cisco IOS XE Software
- CWE-459
- CVSS 6.3 Medium
CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php.
- CWE-459
- CVSS 7.2 High
Incomplete cleanup in AMD EPYC™ 9005 Series Processors and others
- AMD EPYC™ 9005 Series Processors
- AMD Ryzen™ AI 300 Series Processors
- CWE-459
- CVSS 3.2 Low
Incomplete cleanup in AMD EPYC™ 7003 Series Processors and others
- AMD EPYC™ 7003 Series Processors
- AMD EPYC™ 9004 Series Processors
- CWE-459
- CVSS 8.1 High
Incomplete cleanup in Tunnelblick
- Tunnelblick
- CWE-459
- CVSS 3.1 Low
Incomplete cleanup in Fortinet FortiProxy and others
- Fortinet FortiProxy
- Fortinet FortiOS
- CWE-459
- CVSS 7.5 HighCritical · CVSS 7+ and EPSS
Apache Tomcat Denial of Service via invalid HTTP priority header
- CWE-459
- CWE-460
>=9.0.76, <9.0.104 || >=10.1.10, <10.1.40 || >=11.0.0-M2, <11.0.6 || >=8.5.0, <=8.5.100 · fixed in 9.0.104, 10.1.40, 11.0.6
GHSA-3p2h-wqq4-wf4h · CVE-2025-31650 - CVSS 7.1 High
Eclipse ThreadX NetX Duo HTTP component server denial of service
- Eclipse Foundation ThreadX
- CWE-459
- CVSS 6.5 Medium
Incomplete cleanup in STMicroelectronics X-CUBE-AZRT-H7RS and others
- STMicroelectronics X-CUBE-AZRT-H7RS
- STMicroelectronics X-CUBE-AZRTOS-F4
- CWE-459
- CVSS 6.5 Medium
Incomplete cleanup in STMicroelectronics X-CUBE-AZRT-H7RS and others
- STMicroelectronics X-CUBE-AZRT-H7RS
- STMicroelectronics X-CUBE-AZRTOS-F4
- CWE-459
- CVSS 6.5 Medium
Incomplete cleanup in AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics and others
- AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics
- AMD Ryzen™ 6000 Series Processors with Radeon™ Graphics
- CWE-459
- CVSS 7.1 High
Eclipse ThreadX NetX Duo HTTP server denial of service
- Eclipse Foundation ThreadX
- CWE-459
- CVSS 5.5 Medium
Incomplete cleanup in NVIDIA vGPU software
- NVIDIA vGPU software
- CWE-459
- CVSS 5.5 Medium
Incomplete cleanup in NVIDIA GPU Display Driver, vGPU software
- NVIDIA GPU Display Driver, vGPU software
- CWE-459
- CVSS 6.5 Medium
Incomplete Cleanup vulnerability in PMB platform
- PMB Services PMB platform
- CWE-459
- CVSS 8.7 High
SiYuan has an arbitrary file deletion vulnerability in github.com/siyuan-note/siyuan/kernel
- Information disclosure
- CWE-459
* · no fixed version yet
GHSA-8fx8-pffw-w498 · CVE-2025-21609 - CVSS 9.1 CriticalCritical · CVSS 9+
IBOS v4.5.5 has an arbitrary file deletion vulnerability via \system\modules\dashboard\controllers\LoginController.php.
- CWE-459
- CVSS 4.0 Medium
Incomplete cleanup in Huawei HarmonyOS and others
- Huawei HarmonyOS
- Huawei EMUI
- CWE-459
- CVSS 4.4 Medium
Incomplete cleanup in AMD EPYC™ 7003 Processors and others
- AMD EPYC™ 7003 Processors
- AMD EPYC™ 9004 Processors
- CWE-459
- CVSS 1.9 Low
Incomplete cleanup in AMD EPYC™ 9004 Series Processors and others
- AMD EPYC™ 9004 Series Processors
- AMD Ryzen™ 3000 Series Desktop Processors
- CWE-459
- CVSS 3.7 Low
Incomplete Cleanup in Conduit
- Conduit
- CWE-459
- CVSS 7.5 High
Moodle HTTP authorization header is preserved between "emulated redirects"
- CWE-226
- CWE-459
<4.1.11 || >=4.2.0-beta, <4.2.8 || >=4.3.0-beta, <4.3.5 || >=4.4.0-beta, <4.4.1 · fixed in 4.1.11, 4.2.8, 4.3.5, 4.4.1
GHSA-p2cj-86v4-7782 · CVE-2024-38275 - CVSS 5.5 Medium
Incomplete cleanup in Intel(R) Power Gadget software for macOS
- Intel(R) Power Gadget software for macOS
- CWE-459
- CVSS 7.4 High
Incomplete cleanup in Cisco IOS XE Software
- Cisco IOS XE Software
- CWE-459