# CWE-488.

Every Advisory and CVE whose sources give the weakness CWE-488, newest first.

## Records, newest first

- [FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode](https://agentprime.io/advisories/CVE-2026-122233.md)
  `CVE-2026-122233` · CVE record: php frankenphp · CVSS 6.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-488
- [Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak](https://agentprime.io/advisories/CVE-2026-121966.md)
  `CVE-2026-121966` · CVE record: traefik traefik · CVSS 7.0 High · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-488
- [CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer](https://agentprime.io/advisories/CVE-2026-120634.md)
  `CVE-2026-120634` · CVE record · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-488
- [Strands Agents SDK: Exposure of data element to wrong session in the A2A Server](https://agentprime.io/advisories/GHSA-4v6f-7vjh-6x4m.md)
  `GHSA-4v6f-7vjh-6x4m`, `CVE-2026-115419` · npm `@strands-agents/sdk` and 1 more: affected `<1.5.0`, fixed in `1.5.0` · CVSS 8.6 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-488
- [Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak](https://agentprime.io/advisories/CVE-2026-114637.md)
  `CVE-2026-114637` · CVE record: traefik traefik · CVSS 7.0 High · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-488
- [Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request](https://agentprime.io/advisories/CVE-2026-112921.md)
  `CVE-2026-112921` · CVE record · CVSS 7.3 High · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-488
- [local interface connection reuse mixup](https://agentprime.io/advisories/CVE-2026-107929.md)
  `CVE-2026-107929` · CVE record: curl curl · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-488
- [FTP connection reuse inherits client-certificate](https://agentprime.io/advisories/CVE-2026-86411.md)
  `CVE-2026-86411` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-488
- [Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State](https://agentprime.io/advisories/CVE-2026-85296.md)
  `CVE-2026-85296` · CVE record: Apache Software Foundation Apache Camel · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-488
- [Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target](https://agentprime.io/advisories/CVE-2026-85245.md)
  `CVE-2026-85245` · CVE record: Apache Software Foundation Apache Camel · CVSS 5.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-488
- [FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module](https://agentprime.io/advisories/GHSA-v3ph-cgqh-r8p5.md)
  `GHSA-v3ph-cgqh-r8p5`, `CVE-2026-82416`, `GO-2026-6797` · Go `github.com/dunglas/frankenphp`: affected `<1.12.5`, fixed in `1.12.5` · CVSS 7.7 High · Not analysed yet · Published 15 Oct 2026 · Tags: Race condition, CWE-488
- [Pulp-ansible: bearer tokens are reused across remotes in a worker](https://agentprime.io/advisories/CVE-2026-103869.md)
  `CVE-2026-103869` · CVE record: Red Hat Red Hat Ansible Automation Platform 2 and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-488
- [Pulp-container: registry credentials are reused across remotes in a worker](https://agentprime.io/advisories/CVE-2026-103868.md)
  `CVE-2026-103868` · CVE record: Red Hat Red Hat Ansible Automation Platform 2 and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-488
- [Apache APISIX: cross-request permission pollution via static permission list mutation](https://agentprime.io/advisories/CVE-2026-82806.md)
  `CVE-2026-82806` · CVE record: Apache Software Foundation Apache APISIX · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-488
- [datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_client.py wrong session](https://agentprime.io/advisories/CVE-2026-103544.md)
  `CVE-2026-103544` · CVE record: datadrivenconstruction OpenConstructionERP · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-488
- [rclone: FTP cross-session auth-proxy backend confusion](https://agentprime.io/advisories/GHSA-c476-6w5q-jw77.md)
  `GHSA-c476-6w5q-jw77`, `BIT-rclone-2026-88017`, `CVE-2026-88017`, `GO-2026-6458` · Go `github.com/rclone/rclone`: affected `>=1.64.0, <1.75.1`, fixed in `1.75.1` · CVSS 7.3 High · Not analysed yet · Published 10 Sept 2026 · Tags: CWE-488
- [Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management](https://agentprime.io/advisories/CVE-2026-84685.md)
  `CVE-2026-84685` · CVE record: Auth0 react-native-auth0 · CVSS 6.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-488
- [JetBrains YouTrack: In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft…](https://agentprime.io/advisories/CVE-2026-86492.md)
  `CVE-2026-86492` · CVE record: JetBrains YouTrack · CVSS 8.5 High · Not analysed yet · Published 7 Sept 2026 · Tags: CWE-488
- [native CA store conn reuse](https://agentprime.io/advisories/CVE-2026-80231.md)
  `CVE-2026-80231` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 6 Sept 2026 · Tags: CWE-488
- [Negotiate ambient user conn reuse](https://agentprime.io/advisories/CVE-2026-19931.md)
  `CVE-2026-19931` · CVE record: curl curl · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Sept 2026 · Tags: CWE-488
- [IBM ContextForge Translate is affected by cross-client credential context confusion](https://agentprime.io/advisories/CVE-2026-18489.md)
  `CVE-2026-18489` · CVE record: IBM ContextForge MCP Gateway - Translate utility · CVSS 7.4 High · Not analysed yet · Published 4 Sept 2026 · Tags: CWE-488
- [Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic](https://agentprime.io/advisories/GHSA-wm4m-cjmc-5v8c.md)
  `GHSA-wm4m-cjmc-5v8c`, `CVE-2026-82367`, `EEF-CVE-2026-82367` · Hex `ash_graphql`: affected `>=1.4.0, <1.11.0`, fixed in `1.11.0` · CVSS 2.3 Low · Not analysed yet · Published 30 Aug 2026 · Tags: CWE-488
- [Hono: \`memo()\` retains SSR output across requests, leading to cross-user data disclosure](https://agentprime.io/advisories/GHSA-f23p-vx2j-j53r.md)
  `GHSA-f23p-vx2j-j53r`, `CVE-2026-71850` · npm `hono`: affected `>=3.8.0, <4.12.34`, fixed in `4.12.34` · CVSS 4.8 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: CWE-488
- [consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode](https://agentprime.io/advisories/CVE-2026-16326.md)
  `CVE-2026-16326` · CVE record: HashiCorp Tooling · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jul 2026 · Tags: CWE-488
- [terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode](https://agentprime.io/advisories/CVE-2026-16498.md)
  `CVE-2026-16498` · CVE record: HashiCorp Tooling · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jul 2026 · Tags: CWE-488
- [ViewComponent: Reused Component Instances Retain Stale Render Context](https://agentprime.io/advisories/GHSA-9h85-g7w3-rh49.md)
  `GHSA-9h85-g7w3-rh49`, `CVE-2026-54497` · RubyGems `view_component`: affected `>=4.0.0, <4.12.0`, fixed in `4.12.0` · CVSS 6.8 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Race condition, Information disclosure, CWE-488
- [FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong session](https://agentprime.io/advisories/CVE-2026-14621.md)
  `CVE-2026-14621` · CVE record: FederatedAI FATE · CVSS 2.3 Low · Not analysed yet · Published 4 Jul 2026 · Tags: CWE-488
- [wrong reuse for different services](https://agentprime.io/advisories/CVE-2026-8458.md)
  `CVE-2026-8458` · CVE record: curl curl · CVSS 6.5 Medium · Not analysed yet · Published 3 Jul 2026 · Tags: CWE-488
- [n8n: Merge Node SQL Mode Prototype Pollution](https://agentprime.io/advisories/GHSA-9c38-2mcm-q7f7.md)
  `GHSA-9c38-2mcm-q7f7`, `CVE-2026-54311` · npm `n8n`: affected `<2.25.7 || >=2.26.0, <2.26.2`, fixed in `2.25.7`, `2.26.2` · CVSS 6.0 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-488
- [ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race Condition](https://agentprime.io/advisories/CVE-2026-9831.md)
  `CVE-2026-9831` · CVE record: Extreme Networks Extreme Platform ONE · CVSS 6.3 Medium · Not analysed yet · Published 29 May 2026 · Tags: Race condition, CWE-488
- [Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest](https://agentprime.io/advisories/GHSA-mfvp-7p3v-x9mh.md)
  `GHSA-mfvp-7p3v-x9mh`, `CVE-2026-9098`, `GO-2026-5898` · Go `github.com/casdoor/casdoor`: affected `<=1.1000.1-0.20260321120606-239e8bd69487`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2026 · Tags: CWE-488
- [Microsoft UFO shared WebSocket handler state causes cross-client response hijacking](https://agentprime.io/advisories/CVE-2026-46416.md)
  `CVE-2026-46416` · CVE record: microsoft UFO · CVSS 6.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: Broken access control, CWE-488
- [wrong reuse of SMB connection](https://agentprime.io/advisories/CVE-2026-5773.md)
  `CVE-2026-5773` · CVE record: curl curl · CVSS 7.5 High · Not analysed yet · Published 13 May 2026 · Tags: CWE-488
- [Fleet Vulnerable to Windows MDM cross-device command disclosure](https://agentprime.io/advisories/CVE-2026-34391.md)
  `CVE-2026-34391` · CVE record: fleetdm fleet · CVSS 6.6 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: CWE-488
- [NATS is vulnerable to MQTT hijacking via Client ID](https://agentprime.io/advisories/GHSA-fcjp-h8cc-6879.md)
  `GHSA-fcjp-h8cc-6879`, `BIT-nats-2026-33215`, `CVE-2026-33215`, `GO-2026-4833` · Go `github.com/nats-io/nats-server/v2`: affected `<2.11.15 || >=2.12.0-RC.1, <2.12.6`, fixed in `2.11.15`, `2.12.6` · CVSS 6.5 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Authentication bypass, CWE-488
- [Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server](https://agentprime.io/advisories/CVE-2026-23919.md)
  `CVE-2026-23919` · CVE record: Zabbix Zabbix · CVSS 7.1 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-488
- [Jail chroot escape via fd exchange with a different jail](https://agentprime.io/advisories/CVE-2025-15576.md)
  `CVE-2025-15576` · CVE record: FreeBSD FreeBSD · CVSS 7.5 High · Not analysed yet · Published 9 Mar 2026 · Tags: Privilege escalation, CWE-488, CWE-790
- [Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused](https://agentprime.io/advisories/GHSA-49pc-8936-wvfp.md)
  `GHSA-49pc-8936-wvfp`, `CVE-2026-27492` · npm `lettermint`: affected `<1.5.1`, fixed in `1.5.1` · CVSS 4.7 Medium · Not analysed yet · Published 20 Feb 2026 · Tags: CWE-488
- [Whisper Money has IDOR Vulnerability on sync/balances endpoint](https://agentprime.io/advisories/CVE-2026-23844.md)
  `CVE-2026-23844` · CVE record: whisper-money whisper-money · CVSS 4.9 Medium · Not analysed yet · Published 19 Jan 2026 · Tags: CWE-488
- [OpenProject users can delete other user's session, causing them to be logged out](https://agentprime.io/advisories/CVE-2026-23646.md)
  `CVE-2026-23646` · CVE record: opf openproject · CVSS 6.5 Medium · Not analysed yet · Published 19 Jan 2026 · Tags: CWE-488
- [SO_REUSEPORT_LB breaks connect(2) for UDP sockets](https://agentprime.io/advisories/CVE-2025-24934.md)
  `CVE-2025-24934` · CVE record: FreeBSD FreeBSD · CVSS 5.4 Medium · Not analysed yet · Published 22 Oct 2025 · Tags: CWE-488
- [Spotipy repo vulnerable to secrets exfiltration via \`pull_request_target\`](https://agentprime.io/advisories/CVE-2025-47928.md)
  `CVE-2025-47928` · CVE record: spotipy-dev spotipy · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 May 2025 · Tags: CWE-488
- [An issue was discovered in OPC cardsystems Webapp Aufwertung 2.1.0.](https://agentprime.io/advisories/CVE-2025-30073.md)
  `CVE-2025-30073` · CVE record · CVSS 7.5 High · Not analysed yet · Published 26 Mar 2025 · Tags: CWE-488
- [cifs.upcall makes an upcall to the wrong namespace in containerized environments](https://agentprime.io/advisories/CVE-2025-2312.md)
  `CVE-2025-2312` · CVE record: cifs-utils cifs-utils · CVSS 5.9 Medium · Not analysed yet · Published 25 Mar 2025 · Tags: CWE-488
- [Improper session handling in B&R APROL](https://agentprime.io/advisories/CVE-2024-8314.md)
  `CVE-2024-8314` · CVE record: B&R Industrial Automation GmbH APROL · CVSS 5.5 Medium · Not analysed yet · Published 25 Mar 2025 · Tags: Authentication bypass, CWE-488
- [Element Android PIN autologout bypass](https://agentprime.io/advisories/CVE-2025-27606.md)
  `CVE-2025-27606` · CVE record: element-hq element-android · CVSS 5.1 Medium · Not analysed yet · Published 14 Mar 2025 · Tags: CWE-488
- [Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance](https://agentprime.io/advisories/GHSA-phg3-gv66-q38x.md)
  `GHSA-phg3-gv66-q38x`, `CVE-2025-1247` · Maven `io.quarkus:quarkus-rest` and 1 more: affected `>=3.16.0.CR1, <3.18.2 || >=3.9.0.CR1, <3.15.3.1 || <3.8.6.1`, fixed in `3.18.2`, `3.15.3.1`, `3.8.6.1` · CVSS 8.3 High · Not analysed yet · Published 13 Feb 2025 · Tags: CWE-488
- [pgAdmin has Incorrect Default Permissions](https://agentprime.io/advisories/GHSA-7w6r-748w-mh52.md)
  `GHSA-7w6r-748w-mh52`, `CVE-2023-1907`, `PYSEC-2026-1770` · PyPI `pgadmin4`: affected `<7.0`, fixed in `7.0` · CVSS 8.0 High · Not analysed yet · Published 9 Jan 2025 · Tags: Broken access control, CWE-488
- [404 Solution <= 2.35.17 - Missing Authentication to Sensitive Information Exposure](https://agentprime.io/advisories/CVE-2024-11094.md)
  `CVE-2024-11094` · CVE record: aaron13100 404 Solution · CVSS 5.3 Medium · Not analysed yet · Published 16 Nov 2024 · Tags: CWE-488
- [Gnome-remote-desktop: inadequate validation of session agents using d-bus methods may expose rdp tls certificate](https://agentprime.io/advisories/CVE-2024-5148.md)
  `CVE-2024-5148` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 2 more · CVSS 7.5 High · Not analysed yet · Published 2 Sept 2024 · Tags: CWE-488
- [Siemens RUGGEDCOM RM1224 LTE(4G) EU: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2)…](https://agentprime.io/advisories/CVE-2024-41977.md)
  `CVE-2024-41977` · CVE record: Siemens RUGGEDCOM RM1224 LTE(4G) EU and 4 more · CVSS 7.3 High · Not analysed yet · Published 13 Aug 2024 · Tags: CWE-488
- [CoacoaPods trunk sessions verification step could be manipulated for owner session hijacking](https://agentprime.io/advisories/CVE-2024-38367.md)
  `CVE-2024-38367` · CVE record: CocoaPods CocoaPods · CVSS 8.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.11 · Not analysed yet · Published 1 Jul 2024 · Tags: CWE-488
- [Undertow's url-encoded request path information can be broken on ajp-listener](https://agentprime.io/advisories/GHSA-9442-gm4v-r222.md)
  `GHSA-9442-gm4v-r222`, `CVE-2024-6162` · Maven `io.undertow:undertow-core`: affected `>=2.3.0.Alpha1, <2.3.14.Final || <2.2.33.Final`, fixed in `2.3.14.Final`, `2.2.33.Final` · CVSS 7.5 High · Not analysed yet · Published 20 Jun 2024 · Tags: Denial of service, CWE-488
- [TYPO3 Security Misconfiguration in Frontend Session Handling](https://agentprime.io/advisories/GHSA-82vp-jr39-4j2j.md)
  `GHSA-82vp-jr39-4j2j`, `PKSA-kgft-67y3-84tv` · Packagist `typo3/cms-core`: affected `>=8.0.0, <8.7.27 || >=9.0.0, <9.5.8`, fixed in `8.7.27`, `9.5.8` · CVSS 8.2 High · Not analysed yet · Published 30 May 2024 · Tags: CWE-488
- [Improper authorization controls in PaperCut NG/MF](https://agentprime.io/advisories/CVE-2024-1223.md)
  `CVE-2024-1223` · CVE record: PaperCut PaperCut NG, PaperCut MF · CVSS 4.8 Medium · Not analysed yet · Published 14 Mar 2024 · Tags: CWE-488
- [Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination](https://agentprime.io/advisories/GHSA-wrqv-pf6j-mqjp.md)
  `GHSA-wrqv-pf6j-mqjp`, `CVE-2024-27935` · crates.io `deno`: affected `>=1.35.1, <1.36.3`, fixed in `1.36.3` · CVSS 7.2 High · Not analysed yet · Published 5 Mar 2024 · Tags: CWE-488
- [In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attempts to download files.](https://agentprime.io/advisories/CVE-2024-27455.md)
  `CVE-2024-27455` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Feb 2024 · Tags: Authentication bypass, CWE-488
- [Seeing admin password hash value in Mia Technology's Mia-Med](https://agentprime.io/advisories/CVE-2023-6519.md)
  `CVE-2023-6519` · CVE record: Mia Technology Inc. MİA-MED · CVSS 7.5 High · Not analysed yet · Published 8 Feb 2024 · Tags: CWE-488
- [Intel DCM software: Exposure of data element to wrong session in the Intel DCM software before version 5.0.1…](https://agentprime.io/advisories/CVE-2022-40210.md)
  `CVE-2022-40210` · CVE record: Intel DCM software · CVSS 6.8 Medium · Not analysed yet · Published 10 May 2023 · Tags: CWE-488
- [Keycloak vulnerable to session takeover with OIDC offline refreshtokens](https://agentprime.io/advisories/GHSA-97g8-xfvw-q4hg.md)
  `GHSA-97g8-xfvw-q4hg`, `CVE-2022-3916` · Maven `org.keycloak:keycloak-parent`: affected `<20.0.2`, fixed in `20.0.2` · CVSS 6.8 Medium · Not analysed yet · Published 13 Dec 2022 · Tags: Authentication bypass, CWE-488

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-488>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-488/>. Everything for agents: <https://agentprime.io/llms.txt>.