# CWE-474.

Every Advisory and CVE whose sources give the weakness CWE-474, newest first.

## Records, newest first

- [The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking sig…](https://agentprime.io/advisories/CVE-2026-50719.md)
  `CVE-2026-50719` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: Broken access control, Weak cryptography or TLS, CWE-474
- [Cacti: RRDtool metric shift via LC_NUMERIC locale comma decimal formatting](https://agentprime.io/advisories/CVE-2026-39894.md)
  `CVE-2026-39894` · CVE record: Cacti cacti · CVSS 2.9 Low · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-474
- [Google Chrome: Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 149.0.7827.53…](https://agentprime.io/advisories/CVE-2026-11102.md)
  `CVE-2026-11102` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-474
- [Google Chrome: Inappropriate implementation in WebView in Google Chrome on Android prior to…](https://agentprime.io/advisories/CVE-2026-11097.md)
  `CVE-2026-11097` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-474
- [vLLM has SSRF Protection Bypass](https://agentprime.io/advisories/GHSA-v359-jj2v-j536.md)
  `GHSA-v359-jj2v-j536`, `CVE-2026-25960`, `PYSEC-2026-3411` · PyPI `vllm`: affected `>=0.15.1, <0.17.0`, fixed in `0.17.0` · CVSS 7.1 High · Not analysed yet · Published 9 Mar 2026 · Tags: Server-side request forgery (SSRF), CWE-474
- [Horilla has HTML Injection Issue that, with Phishing, Leads to Account Takeover](https://agentprime.io/advisories/CVE-2026-24010.md)
  `CVE-2026-24010` · CVE record: horilla-opensource horilla · CVSS 8.8 High · Not analysed yet · Published 22 Jan 2026 · Tags: Other injection, CWE-474
- [Google Chrome: Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a…](https://agentprime.io/advisories/CVE-2026-0902.md)
  `CVE-2026-0902` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Jan 2026 · Tags: CWE-474
- [Google Chrome: Inappropriate implementation in HTML in Google Chrome prior to 127.0.6533.72 allowed a…](https://agentprime.io/advisories/CVE-2024-7001.md)
  `CVE-2024-7001` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 6 Aug 2024 · Tags: CWE-474
- [Google Chrome: Inappropriate Implementation in Memory Allocator in Google Chrome prior to 126.0.6478.54…](https://agentprime.io/advisories/CVE-2024-5839.md)
  `CVE-2024-5839` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 11 Jun 2024 · Tags: CWE-474
- [Google Chrome: Inappropriate Implementation in DevTools in Google Chrome prior to 126.0.6478.54 allowed…](https://agentprime.io/advisories/CVE-2024-5836.md)
  `CVE-2024-5836` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 11 Jun 2024 · Tags: CWE-474
- [Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to bypass discretionary access control via a malicious file.](https://agentprime.io/advisories/CVE-2024-1694.md)
  `CVE-2024-1694` · CVE record: Google Omaha · CVSS 7.8 High · Not analysed yet · Published 7 Jun 2024 · Tags: CWE-474
- [Google Chrome: Inappropriate implementation in Downloads in Google Chrome prior to 123.0.6312.58 allowed…](https://agentprime.io/advisories/CVE-2024-2628.md)
  `CVE-2024-2628` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 20 Mar 2024 · Tags: CWE-474
- [Google Chrome: Inappropriate implementation in Content Security Policy in Google Chrome prior to…](https://agentprime.io/advisories/CVE-2024-1672.md)
  `CVE-2024-1672` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 21 Feb 2024 · Tags: CWE-474
- [Junos OS: QFX5000 Series and EX4600 Series: Enhanced storm control might not work leading to partial Denial of Service](https://agentprime.io/advisories/CVE-2021-0294.md)
  `CVE-2021-0294` · CVE record: Juniper Networks Junos OS · CVSS 5.3 Medium · Not analysed yet · Published 15 Jul 2021 · Tags: CWE-474

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-474>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-474/>. Everything for agents: <https://agentprime.io/llms.txt>.