# CWE-489. Every Advisory and CVE whose sources give the weakness CWE-489, newest first. ## Records, newest first - [CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD](https://agentprime.io/advisories/CVE-2026-120637.md) `CVE-2026-120637` · CVE record · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-489 - [AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server](https://agentprime.io/advisories/CVE-2026-115727.md) `CVE-2026-115727` · CVE record: Fosowl AgenticSeek · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-489 - [Sensitive Information Disclosure Due to Enabled Debug Mode in Production in SFM Software's Costifier](https://agentprime.io/advisories/CVE-2026-15575.md) `CVE-2026-15575` · CVE record: SFM Software Technologies Inc. Costifier · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-489 - [Postgres-exporter: net/http/pprof exposed on metrics listener](https://agentprime.io/advisories/CVE-2026-83550.md) `CVE-2026-83550` · CVE record: Red Hat Multicluster Global Hub · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-489 - [RCE via exposed JDWP debug agent in P4Search](https://agentprime.io/advisories/CVE-2026-100102.md) `CVE-2026-100102` · CVE record: Perforce P4 (Helix Core) · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-489 - [Cadmos LTI exposure of sensitive information via debug mode](https://agentprime.io/advisories/CVE-2026-102628.md) `CVE-2026-102628` · CVE record: Eummena Cadmos LTI · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-215, CWE-489 - [Active debug code in ASUS Router](https://agentprime.io/advisories/CVE-2026-13313.md) `CVE-2026-13313` · CVE record: ASUS Router · CVSS 8.9 High · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-489 - [yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure](https://agentprime.io/advisories/CVE-2026-103475.md) `CVE-2026-103475` · CVE record: yii2-starter-kit yii2-starter-kit · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-489 - [Active debug code in Anjvision YSSD-RTMP-H5](https://agentprime.io/advisories/CVE-2026-100295.md) `CVE-2026-100295` · CVE record: Anjvision YSSD-RTMP-H5 · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-489 - [Active debug code in Dell Secure Connect Gateway (SCG) Policy Manager](https://agentprime.io/advisories/CVE-2026-73593.md) `CVE-2026-73593` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 3.0 Low · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-489 - [Automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowany, routed without debug guard) allow advisory-lock starvation…](https://agentprime.io/advisories/CVE-2026-84486.md) `CVE-2026-84486` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 and 2 more · CVSS 8.2 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-489 - [Electron DevTools Arbitrary Code Execution Vulnerability in NitroSense](https://agentprime.io/advisories/CVE-2026-50228.md) `CVE-2026-50228` · CVE record: Acer NitroSense V5 · CVSS 6.1 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-489 - [PLANET IGS-5225-8P2T4S V1/V2 Debug Mode RCE](https://agentprime.io/advisories/CVE-2026-81943.md) `CVE-2026-81943` · CVE record: PLANET Technology Corp. PLANET IGS-5225-8P2T4S V1 and 1 more · CVSS 8.4 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-489 - [GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw](https://agentprime.io/advisories/CVE-2026-53952.md) `CVE-2026-53952` · CVE record: GetSimpleCMS-CE GetSimpleCMS-CE and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Broken access control, Authentication bypass, CWE-489 - [UEFI BIOS embedded Shell can be used to bypass Secure Boot](https://agentprime.io/advisories/CVE-2026-6485.md) `CVE-2026-6485` · CVE record: Insyde Software InsydeH2O · CVSS 8.2 High · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-489 - [Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig\* routes](https://agentprime.io/advisories/GHSA-3wgp-x9p5-c7cc.md) `GHSA-3wgp-x9p5-c7cc`, `CVE-2026-58191` · npm `@appium/base-driver`: affected `<10.7.0`, fixed in `10.7.0` · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-489 - [Active debug code in Ubiquiti Inc UniFi OS Server and others](https://agentprime.io/advisories/CVE-2026-77545.md) `CVE-2026-77545` · CVE record: Ubiquiti Inc UniFi OS Server and 4 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-489 - [Active debug code in ECOVACS ROBOTICS DEEBOT PRO M1 and others](https://agentprime.io/advisories/CVE-2026-66405.md) `CVE-2026-66405` · CVE record: ECOVACS ROBOTICS DEEBOT PRO M1 and 1 more · CVSS 8.7 High · Not analysed yet · Published 10 Aug 2026 · Tags: CWE-489 - [Active debug code in ECOVACS ROBOTICS DEEBOT PRO M1 and others](https://agentprime.io/advisories/CVE-2026-66403.md) `CVE-2026-66403` · CVE record: ECOVACS ROBOTICS DEEBOT PRO M1 and 1 more · CVSS 8.7 High · Not analysed yet · Published 10 Aug 2026 · Tags: CWE-489 - [Unauthenticated Go pprof exposure in Calico debug server](https://agentprime.io/advisories/CVE-2026-41186.md) `CVE-2026-41186` · CVE record: Tigera Calico and 2 more · CVSS 6.0 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: Information disclosure, CWE-489 - [Arbitrary Code Execution Vulnerability in CP PLUS EZ-P21 IP Camera](https://agentprime.io/advisories/CVE-2026-65893.md) `CVE-2026-65893` · CVE record: CP-Plus EZ-P21 IP Camera · CVSS 7.0 High · Not analysed yet · Published 27 Jul 2026 · Tags: CWE-489 - [crypto: qat - remove unused character device and IOCTLs](https://agentprime.io/advisories/CVE-2026-64529.md) `CVE-2026-64529` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 25 Jul 2026 · Tags: CWE-489 - [Allwinner TV Box TV98 ADB exposed on network](https://agentprime.io/advisories/CVE-2026-58378.md) `CVE-2026-58378` · CVE record: Allwinner H616 · CVSS 8.6 High · Not analysed yet · Published 9 Jul 2026 · Tags: CWE-489 - [Active debug code in Siemens CPCI85 Central Processing/Communication and others](https://agentprime.io/advisories/CVE-2026-54799.md) `CVE-2026-54799` · CVE record: Siemens CPCI85 Central Processing/Communication and 1 more · CVSS 8.4 High · Not analysed yet · Published 9 Jul 2026 · Tags: CWE-489 - [Active debug code in Siemens CPCI85 Central Processing/Communication and others](https://agentprime.io/advisories/CVE-2026-54798.md) `CVE-2026-54798` · CVE record: Siemens CPCI85 Central Processing/Communication and 1 more · CVSS 7.1 High · Not analysed yet · Published 9 Jul 2026 · Tags: CWE-489 - [JuiceFS - Authentication Bypass via pprof and metrics Endpoints](https://agentprime.io/advisories/CVE-2026-59092.md) `CVE-2026-59092` · CVE record: juicedata juicefs · CVSS 7.0 High · Not analysed yet · Published 2 Jul 2026 · Tags: CWE-489 - [fixurjavainstall: Previous Fuji versions can accidentally wipe \`/usr/share/man/man8\`](https://agentprime.io/advisories/GHSA-fq3w-p4fg-mw73.md) `GHSA-fq3w-p4fg-mw73` · crates.io `fixurjavainstall`: affected `<0.8.1`, fixed in `0.8.1` · CVSS 4.0, no score published · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-489 - [Elevated Root Command Execution via ai_cmd Sockets](https://agentprime.io/advisories/CVE-2026-49188.md) `CVE-2026-49188` · CVE record: Acer Connect M6E 5G Portable WiFi Router · CVSS 8.7 High · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-489 - [stigmem-node's federation insecure transport settings may allow non-loopback cleartext federation](https://agentprime.io/advisories/GHSA-jmfc-hfjq-pxcp.md) `GHSA-jmfc-hfjq-pxcp`, `CVE-2026-76244` · PyPI `stigmem-node`: affected `<0.9.0a2`, fixed in `0.9.0a2` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2026 · Tags: Weak cryptography or TLS, CWE-489 - [Arbitrary file read in rabbitmq-aws plugin](https://agentprime.io/advisories/CVE-2026-9133.md) `CVE-2026-9133` · CVE record: AWS RabbitMQ AWS · CVSS 8.3 High · Not analysed yet · Published 20 May 2026 · Tags: CWE-489 - [Algernon: Single-file mode unconditionally enables debug mode](https://agentprime.io/advisories/GHSA-fwqx-8365-9983.md) `GHSA-fwqx-8365-9983`, `CVE-2026-45728`, `GO-2026-5385` · Go `github.com/xyproto/algernon`: affected `<1.17.7`, fixed in `1.17.7` · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: Information disclosure, CWE-489, CWE-540, CWE-1188 - [Gardyn Cloud API Active Debug Code](https://agentprime.io/advisories/CVE-2026-32662.md) `CVE-2026-32662` · CVE record: Gardyn Cloud API · CVSS 6.9 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-489 - [Active debug code in GREEN HOUSE CO., LTD. Digital Photo Frame GH-WDF10A](https://agentprime.io/advisories/CVE-2026-33201.md) `CVE-2026-33201` · CVE record: GREEN HOUSE CO., LTD. Digital Photo Frame GH-WDF10A · CVSS 7.0 High · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-489 - [Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground](https://agentprime.io/advisories/GHSA-m59h-42jf-cphr.md) `GHSA-m59h-42jf-cphr`, `CVE-2026-27131`, `PKSA-73p9-59k3-bf4z` · Packagist `putyourlightson/craft-sprig`: affected `>=2.0.0, <2.15.2 || >=3.0.0, <3.7.2`, fixed in `2.15.2`, `3.7.2` · CVSS 5.5 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Information disclosure, CWE-489 - [Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)](https://agentprime.io/advisories/GHSA-vg9h-jx4v-cwx2.md) `GHSA-vg9h-jx4v-cwx2`, `CVE-2026-40035` · PyPI `dfir-unfurl`: affected `<=20250810`, no fixed version yet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jan 2026 · Tags: CWE-489 - [Active debug code in Moxa NPort 5000AI-M12 Series and others](https://agentprime.io/advisories/CVE-2025-15017.md) `CVE-2025-15017` · CVE record: Moxa NPort 5000AI-M12 Series and 4 more · CVSS 7.0 High · Not analysed yet · Published 31 Dec 2025 · Tags: CWE-489 - [Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal](https://agentprime.io/advisories/CVE-2025-42872.md) `CVE-2025-42872` · CVE record: SAP_SE SAP NetWeaver Enterprise Portal · CVSS 6.1 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-489 - [UEFI Shell accessible in AAVMF with Secure Boot enabled on Ubuntu](https://agentprime.io/advisories/CVE-2025-2486.md) `CVE-2025-2486` · CVE record: Ubuntu edk2 · CVSS 3.7 Low · Not analysed yet · Published 26 Nov 2025 · Tags: CWE-489 - [Active debug code in SwitchBot Smart Video Doorbell](https://agentprime.io/advisories/CVE-2025-64983.md) `CVE-2025-64983` · CVE record: SwitchBot Smart Video Doorbell · CVSS 8.6 High · Not analysed yet · Published 26 Nov 2025 · Tags: CWE-489 - [Active debug code in Fortinet FortiClientWindows](https://agentprime.io/advisories/CVE-2025-54660.md) `CVE-2025-54660` · CVE record: Fortinet FortiClientWindows · CVSS 4.9 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: CWE-489 - [Active debug code in Intel UEFI reference platforms](https://agentprime.io/advisories/CVE-2025-30185.md) `CVE-2025-30185` · CVE record: Intel UEFI reference platforms · CVSS 8.3 High · Not analysed yet · Published 11 Nov 2025 · Tags: CWE-489 - [Active debug code in Ubiquiti Inc UniFi Talk Touch and others](https://agentprime.io/advisories/CVE-2025-52663.md) `CVE-2025-52663` · CVE record: Ubiquiti Inc UniFi Talk Touch and 2 more · CVSS 7.3 High · Not analysed yet · Published 30 Oct 2025 · Tags: CWE-489 - [WatchGuard Firebox leftover debug code vulnerability](https://agentprime.io/advisories/CVE-2025-4106.md) `CVE-2025-4106` · CVE record: WatchGuard Fireware OS · CVSS 8.9 High · Not analysed yet · Published 24 Oct 2025 · Tags: CWE-489 - [Active debug code in Google Android](https://agentprime.io/advisories/CVE-2025-36899.md) `CVE-2025-36899` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 4 Sept 2025 · Tags: CWE-489 - [Leftover Debug Code in Secure Element](https://agentprime.io/advisories/CVE-2025-21472.md) `CVE-2025-21472` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 5.5 Medium · Not analysed yet · Published 6 Aug 2025 · Tags: CWE-489 - [Authentication bypass due to compatibility mode enabled by default](https://agentprime.io/advisories/CVE-2025-7705.md) `CVE-2025-7705` · CVE record: ABB Switch Actuator 4 DU-83330 and 1 more · CVSS 8.6 High · Not analysed yet · Published 22 Jul 2025 · Tags: CWE-489 - [Active debug code in Lenovo Legion Space for Legion Go and others](https://agentprime.io/advisories/CVE-2025-1479.md) `CVE-2025-1479` · CVE record: Lenovo Legion Space for Legion Go and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 30 May 2025 · Tags: CWE-489 - [Active debug code in NASA CryptoLib](https://agentprime.io/advisories/CVE-2025-46674.md) `CVE-2025-46674` · CVE record: NASA CryptoLib · CVSS 3.5 Low · Not analysed yet · Published 27 Apr 2025 · Tags: CWE-489 - [Netis WF-2404 UART hardware allows activation of test or debug logic at runtime](https://agentprime.io/advisories/CVE-2025-2919.md) `CVE-2025-2919` · CVE record: Netis WF-2404 · CVSS 7.0 High · Not analysed yet · Published 28 Mar 2025 · Tags: CWE-489, CWE-1313 - [Active debug code in Siemens SIPROTEC 5 6MD84 (CP300) and others](https://agentprime.io/advisories/CVE-2024-53648.md) `CVE-2024-53648` · CVE record: Siemens SIPROTEC 5 6MD84 (CP300) and 4 more · CVSS 7.0 High · Not analysed yet · Published 11 Feb 2025 · Tags: CWE-489 - [Four-Faith F3x36 bapply.cgi Auth Bypass](https://agentprime.io/advisories/CVE-2024-9644.md) `CVE-2024-9644` · CVE record: Four-Faith F3x36 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Feb 2025 · Tags: Authentication bypass, CWE-489 - [Four-Faith F3x36 Hidden Debug Credentials](https://agentprime.io/advisories/CVE-2024-9643.md) `CVE-2024-9643` · CVE record: Four-Faith F3x36 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Feb 2025 · Tags: Hard-coded credentials, CWE-489 - [Active debug code in Sharp Corporation home 5G HR02 and others](https://agentprime.io/advisories/CVE-2024-46873.md) `CVE-2024-46873` · CVE record: Sharp Corporation home 5G HR02 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Dec 2024 · Tags: CWE-489 - [Cisco Redundancy Configuration Manager Debug Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2022-20649.md) `CVE-2022-20649` · CVE record: Cisco Cisco Redundancy Configuration Manager · CVSS 8.1 High · Critical (CVSS 7+ and EPSS) · EPSS 0.12 · Not analysed yet · Published 15 Nov 2024 · Tags: CWE-489 - [Active debug code in SoftBank Corp. Mesh Wi-Fi router RP562B](https://agentprime.io/advisories/CVE-2024-29075.md) `CVE-2024-29075` · CVE record: SoftBank Corp. Mesh Wi-Fi router RP562B · CVSS 4.6 Medium · Not analysed yet · Published 12 Nov 2024 · Tags: CWE-489 - [Active debug code in TECHNO SUPPORT COMPANY Smart-tab Android app](https://agentprime.io/advisories/CVE-2024-41999.md) `CVE-2024-41999` · CVE record: TECHNO SUPPORT COMPANY Smart-tab Android app · CVSS 6.8 Medium · Not analysed yet · Published 30 Sept 2024 · Tags: CWE-489 - [Active debug code in Google Android](https://agentprime.io/advisories/CVE-2024-44092.md) `CVE-2024-44092` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 13 Sept 2024 · Tags: CWE-489 - [Active debug code in 10w (Type 82ST, 82SU) Laptop (Lenovo) BIOS and others](https://agentprime.io/advisories/CVE-2024-7756.md) `CVE-2024-7756` · CVE record: Lenovo 10w (Type 82ST, 82SU) Laptop (Lenovo) BIOS and 2 more · CVSS 6.8 Medium · Not analysed yet · Published 13 Sept 2024 · Tags: CWE-489 - [Grafana's default installation of \`synthetic-monitoring-agent\` exposes sensitive information in github.com/grafana/synthetic-monitoring-agent](https://agentprime.io/advisories/GHSA-9j4f-f249-q5w8.md) `GHSA-9j4f-f249-q5w8`, `CVE-2022-46156`, `GO-2022-1132` · Go `github.com/grafana/synthetic-monitoring-agent`: affected `<0.12.0`, fixed in `0.12.0` · CVSS 7.2 High · Not analysed yet · Published 21 Aug 2024 · Tags: CWE-489, CWE-749 - [Active debug code in Century Systems Co., Ltd. FutureNet NXR-1300 series and others](https://agentprime.io/advisories/CVE-2024-36475.md) `CVE-2024-36475` · CVE record: Century Systems Co., Ltd. FutureNet NXR-1300 series and 4 more · CVSS 7.2 High · Not analysed yet · Published 17 Jul 2024 · Tags: CWE-489 Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .