# CWE-460.

Every Advisory and CVE whose sources give the weakness CWE-460, newest first.

## Records, newest first

- [HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit](https://agentprime.io/advisories/GHSA-2238-pgfc-w82m.md)
  `GHSA-2238-pgfc-w82m`, `CVE-2026-111103`, `EEF-CVE-2026-111103` · Hex `bandit`: affected `>=1.9.0, <1.14.0`, fixed in `1.14.0` · CVSS 8.2 High · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-460
- [Improper Cleanup on Thrown Exception in GitLab](https://agentprime.io/advisories/CVE-2026-112326.md)
  `CVE-2026-112326` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-460
- [Ghidra before 12.1.4 Denial of Service via Unreleased Lock in OptionsDB](https://agentprime.io/advisories/CVE-2026-96273.md)
  `CVE-2026-96273` · CVE record: NationalSecurityAgency ghidra · CVSS 6.8 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-460, CWE-667
- [Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks](https://agentprime.io/advisories/CVE-2026-93710.md)
  `CVE-2026-93710` · CVE record · CVSS 7.5 High · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-460
- [Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive](https://agentprime.io/advisories/CVE-2026-86748.md)
  `CVE-2026-86748` · CVE record: grokability snipe-it · CVSS 6.9 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-460
- [Resource leak in Eclipse Foundation Eclipse Milo](https://agentprime.io/advisories/CVE-2026-61387.md)
  `CVE-2026-61387` · CVE record: Eclipse Foundation Eclipse Milo · CVSS 6.9 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Denial of service, CWE-460
- [PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)](https://agentprime.io/advisories/GHSA-fhv5-28vv-h8m8.md)
  `GHSA-fhv5-28vv-h8m8`, `CVE-2026-48524`, `PYSEC-2026-177` · PyPI `pyjwt`: affected `>=2.0.0, <2.13.0`, fixed in `2.13.0` · CVSS 3.7 Low · Not analysed yet · Published 15 Jun 2026 · Tags: CWE-460, CWE-755
- [UltraDAG: SmartOp Vote Path Triggers Fatal Supply Invariant Halt](https://agentprime.io/advisories/CVE-2026-40583.md)
  `CVE-2026-40583` · CVE record: UltraDAGcom core · CVSS 8.8 High · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-460, CWE-696
- [Syft improper temporary file cleanup](https://agentprime.io/advisories/GHSA-rjcw-vg7j-m9rc.md)
  `GHSA-rjcw-vg7j-m9rc`, `CVE-2026-33481`, `GO-2026-4809` · Go `github.com/anchore/syft`: affected `<1.42.3`, fixed in `1.42.3` · CVSS 5.3 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-460
- [Cisco IOS-XR NCS 5500 and NCS 5700 Egress Packet Network Interfaces Aligner Interrupt Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-20118.md)
  `CVE-2026-20118` · CVE record: Cisco Cisco IOS XR Software · CVSS 6.8 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-460
- [GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF binary with malformed DWARF abbrev or debug information.](https://agentprime.io/advisories/CVE-2025-69652.md)
  `CVE-2025-69652` · CVE record · CVSS 6.2 Medium · Not analysed yet · Published 6 Mar 2026 · Tags: CWE-460
- [EVerest libocpp: libocpp before 0.28.0 allows a denial of service (EVerest crash) because a secondary…](https://agentprime.io/advisories/CVE-2025-59399.md)
  `CVE-2025-59399` · CVE record: EVerest libocpp · CVSS 3.1 Low · Not analysed yet · Published 15 Sept 2025 · Tags: CWE-460
- [Apache Tomcat Denial of Service via invalid HTTP priority header](https://agentprime.io/advisories/GHSA-3p2h-wqq4-wf4h.md)
  `GHSA-3p2h-wqq4-wf4h`, `BIT-tomcat-2025-31650`, `CVE-2025-31650` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=9.0.76, <9.0.104 || >=10.1.10, <10.1.40 || >=11.0.0-M2, <11.0.6 || >=8.5.0, <=8.5.100`, fixed in `9.0.104`, `10.1.40`, `11.0.6` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.61 · Not analysed yet · Published 28 Apr 2025 · Tags: CWE-459, CWE-460
- [tRPC 11 WebSocket DoS Vulnerability](https://agentprime.io/advisories/GHSA-pj3v-9cm8-gvj8.md)
  `GHSA-pj3v-9cm8-gvj8`, `CVE-2025-43855` · npm `@trpc/server`: affected `>=11.0.0, <11.1.1`, fixed in `11.1.1` · CVSS 8.7 High · Not analysed yet · Published 24 Apr 2025 · Tags: CWE-248, CWE-460
- [Pleezer resource exhaustion through uncollected hook script processes](https://agentprime.io/advisories/GHSA-472w-7w45-g3w5.md)
  `GHSA-472w-7w45-g3w5`, `CVE-2025-32439` · crates.io `pleezer`: affected `<0.16.0`, fixed in `0.16.0` · CVSS 6.5 Medium · Not analysed yet · Published 14 Apr 2025 · Tags: Denial of service, CWE-460
- [Envoy crashes when HTTP ext_proc processes local replies](https://agentprime.io/advisories/GHSA-cf3q-gqg7-3fm9.md)
  `GHSA-cf3q-gqg7-3fm9`, `BIT-envoy-2025-30157`, `CVE-2025-30157` · Go `github.com/envoyproxy/envoy`: affected `<1.30.10 || >=1.31.0, <1.31.6 || >=1.32.0, <1.32.4 || >=1.33.0, <1.33.1`, fixed in `1.30.10`, `1.31.6`, `1.32.4`, `1.33.1` · CVSS 6.5 Medium · Not analysed yet · Published 21 Mar 2025 · Tags: CWE-460
- [Boundary Community Edition Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service in github.com/hashicorp/boundary](https://agentprime.io/advisories/GHSA-xx83-cxmq-x89m.md)
  `GHSA-xx83-cxmq-x89m`, `CVE-2024-12289`, `GO-2024-3335` · Go `github.com/hashicorp/boundary`: affected `<0.18.2`, fixed in `0.18.2` · CVSS 5.9 Medium · Not analysed yet · Published 18 Dec 2024 · Tags: CWE-460
- [A vulnerability in the handling of encrypted wireless frames of Cisco Aironet Access Point (AP) Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition…](https://agentprime.io/advisories/CVE-2024-20354.md)
  `CVE-2024-20354` · CVE record: Cisco Cisco Aironet Access Point Software and 1 more · CVSS 4.7 Medium · Not analysed yet · Published 27 Mar 2024 · Tags: CWE-460
- [Improper cleanup vulnerability in FireEye Endpoint Security](https://agentprime.io/advisories/CVE-2024-0316.md)
  `CVE-2024-0316` · CVE record: FireEye FireEye Endpoint Security · CVSS 6.8 Medium · Not analysed yet · Published 15 Jan 2024 · Tags: CWE-460
- [gougucms v4.08.18 was discovered to contain a password reset poisoning vulnerability which allows attackers to arbitrarily reset users' passwords via a crafted packet.](https://agentprime.io/advisories/CVE-2023-46393.md)
  `CVE-2023-46393` · CVE record · No CVSS score · Not analysed yet · Published 27 Oct 2023 · Tags: CWE-460
- [Kernel: A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functionality in…](https://agentprime.io/advisories/CVE-2022-4744.md)
  `CVE-2022-4744` · CVE record: Kernel · CVSS 7.8 High · Not analysed yet · Published 30 Mar 2023 · Tags: CWE-460
- [A double-free memory flaw was found in the Linux kernel.](https://agentprime.io/advisories/CVE-2022-3707.md)
  `CVE-2022-3707` · CVE record: kernel · CVSS 5.5 Medium · Not analysed yet · Published 6 Mar 2023 · Tags: CWE-460
- [Improper Cleanup on Thrown Exception in GitHub repository ikus060/rdiffweb prior to 2.4.8.](https://agentprime.io/advisories/GHSA-qq29-5vjh-vxwr.md)
  `GHSA-qq29-5vjh-vxwr`, `CVE-2022-3301`, `PYSEC-2022-295` · PyPI `rdiffweb`: affected `<2.4.8`, fixed in `2.4.8` · CVSS 4.3 Medium · Not analysed yet · Published 26 Sept 2022 · Tags: CWE-460
- [Foxit: A memory corruption vulnerability exists in the JavaScript engine of Foxit Software’s PDF…](https://agentprime.io/advisories/CVE-2022-22150.md)
  `CVE-2022-22150` · CVE record: Foxit · CVSS 8.8 High · Not analysed yet · Published 4 Feb 2022 · Tags: CWE-460
- [ordered_float:NotNan may contain NaN after panic in assignment operators](https://agentprime.io/advisories/GHSA-566x-hhrf-qf8m.md)
  `GHSA-566x-hhrf-qf8m`, `CVE-2020-35923`, `RUSTSEC-2020-0082` · crates.io `ordered-float`: affected `>=0.2.2, <1.1.1 || >=2.0.0, <2.0.1`, fixed in `1.1.1`, `2.0.1` · CVSS 5.5 Medium · Not analysed yet · Published 25 Aug 2021 · Tags: CWE-460
- [Cisco Expressway Series and TelePresence Video Communication Server Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2021-34716.md)
  `CVE-2021-34716` · CVE record: Cisco Cisco TelePresence Video Communication Server (VCS) Expressway · CVSS 6.7 Medium · Not analysed yet · Published 18 Aug 2021 · Tags: CWE-460
- [kernel: A memory disclosure flaw was found in the Linux kernel's ethernet drivers…](https://agentprime.io/advisories/CVE-2020-14304.md)
  `CVE-2020-14304` · CVE record: Linux Kernel kernel · CVSS 4.4 Medium · Not analysed yet · Published 15 Sept 2020 · Tags: CWE-460
- [cri-o: A flaw was found in cri-o, as a result of all pod-related processes being placed in the…](https://agentprime.io/advisories/CVE-2019-14891.md)
  `CVE-2019-14891` · CVE record: cri-o · CVSS 5.0 Medium · Not analysed yet · Published 25 Nov 2019 · Tags: CWE-460
- [Under specific 802.11 network conditions, a partial re-association of the Philips IntelliVue MX40 Version B.06.18 WLAN monitor to the central monitoring station is possible.](https://agentprime.io/advisories/CVE-2017-9657.md)
  `CVE-2017-9657` · CVE record: Philips IntelliVue MX40 Patient Worn Monitor · No CVSS score · Not analysed yet · Published 30 Apr 2018 · Tags: CWE-460
- [openshift: openshift before versions 3.3.1.11, 3.2.1.23…](https://agentprime.io/advisories/CVE-2016-9592.md)
  `CVE-2016-9592` · CVE record: unspecified openshift · CVSS 4.3 Medium · Not analysed yet · Published 16 Apr 2018 · Tags: CWE-460
- [Linux kernel before 4.13: A flaw was found in the hugetlb_mcopy_atomic_pte function in mm/hugetlb.c in the Linux…](https://agentprime.io/advisories/CVE-2017-15127.md)
  `CVE-2017-15127` · CVE record: Linux kernel before 4.13 · No CVSS score · Not analysed yet · Published 14 Jan 2018 · Tags: CWE-460

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-460>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-460/>. Everything for agents: <https://agentprime.io/llms.txt>.