Advisories · Weakness

CWE-489.

Every Advisory and CVE whose sources give the weakness CWE-489, newest first.

CVE-2026-120637 CVE record

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD
- CWE-489
Not analysed yet 3 Nov 2026
CVE-2026-115727 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server
- Fosowl AgenticSeek
- CWE-489
Not analysed yet 23 Oct 2026
CVE-2026-15575 CVE record

CVSS 5.3 Medium

Sensitive Information Disclosure Due to Enabled Debug Mode in Production in SFM Software's Costifier
- SFM Software Technologies Inc. Costifier
- CWE-489
Not analysed yet 16 Oct 2026
CVE-2026-83550 CVE record

CVSS 7.1 High

Postgres-exporter: net/http/pprof exposed on metrics listener
- Red Hat Multicluster Global Hub
- CWE-489
Not analysed yet 6 Oct 2026
CVE-2026-100102 CVE record

CVSS 9.5 CriticalCritical · CVSS 9+

RCE via exposed JDWP debug agent in P4Search
- Perforce P4 (Helix Core)
- CWE-489
Not analysed yet 5 Oct 2026
CVE-2026-102628 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

Cadmos LTI exposure of sensitive information via debug mode
- Eummena Cadmos LTI
- CWE-215
- CWE-489
Not analysed yet 1 Oct 2026
CVE-2026-13313 CVE record

CVSS 8.9 High

Active debug code in ASUS Router
- ASUS Router
- CWE-489
Not analysed yet 1 Oct 2026
CVE-2026-103475 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure
- yii2-starter-kit
- CWE-489
Not analysed yet 30 Sept 2026
CVE-2026-100295 CVE record

CVSS 5.3 Medium

Active debug code in Anjvision YSSD-RTMP-H5
- Anjvision YSSD-RTMP-H5
- CWE-489
Not analysed yet 29 Sept 2026
CVE-2026-73593 CVE record

CVSS 3.0 Low

Active debug code in Dell Secure Connect Gateway (SCG) Policy Manager
- Dell Secure Connect Gateway (SCG) Policy Manager
- CWE-489
Not analysed yet 29 Sept 2026
CVE-2026-84486 CVE record

CVSS 8.2 High

Automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowany, routed without debug guard) allow advisory-lock starvation…
- Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Ansible Automation Platform 2.6
- CWE-489
Not analysed yet 23 Sept 2026
CVE-2026-50228 CVE record

CVSS 6.1 Medium

Electron DevTools Arbitrary Code Execution Vulnerability in NitroSense
- Acer NitroSense V5
- CWE-489
Not analysed yet 23 Sept 2026
CVE-2026-81943 CVE record

CVSS 8.4 High

PLANET IGS-5225-8P2T4S V1/V2 Debug Mode RCE
- PLANET Technology Corp. PLANET IGS-5225-8P2T4S V1
- PLANET Technology Corp. PLANET IGS-5225-8P2T4S V2
- CWE-489
Not analysed yet 18 Sept 2026
CVE-2026-53952 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw
- GetSimpleCMS-CE
- GetSimpleCMS
- Broken access control
- Authentication bypass
Not analysed yet 11 Sept 2026
CVE-2026-6485 CVE record

CVSS 8.2 High

UEFI BIOS embedded Shell can be used to bypass Secure Boot
- Insyde Software InsydeH2O
- CWE-489
Not analysed yet 9 Sept 2026
@appium/base-driver npm

CVSS 6.5 Medium

Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes
- Cross-site scripting (XSS)
- CWE-489
<10.7.0 · fixed in 10.7.0

GHSA-3wgp-x9p5-c7cc · CVE-2026-58191 Not analysed yet 1 Sept 2026
CVE-2026-77545 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Active debug code in Ubiquiti Inc UniFi OS Server and others
- Ubiquiti Inc UniFi OS Server
- Ubiquiti Inc Cloud Keys
- CWE-489
Not analysed yet 26 Aug 2026
CVE-2026-66405 CVE record

CVSS 8.7 High

Active debug code in ECOVACS ROBOTICS DEEBOT PRO M1 and others
- ECOVACS ROBOTICS DEEBOT PRO M1
- ECOVACS ROBOTICS DEEBOT PRO K1VAC
- CWE-489
Not analysed yet 10 Aug 2026
CVE-2026-66403 CVE record

CVSS 8.7 High

Active debug code in ECOVACS ROBOTICS DEEBOT PRO M1 and others
- ECOVACS ROBOTICS DEEBOT PRO M1
- ECOVACS ROBOTICS DEEBOT PRO K1VAC
- CWE-489
Not analysed yet 10 Aug 2026
CVE-2026-41186 CVE record

CVSS 6.0 Medium

Unauthenticated Go pprof exposure in Calico debug server
- Tigera Calico
- Tigera Calico Enterprise
- Information disclosure
- CWE-489
Not analysed yet 30 Jul 2026
CVE-2026-65893 CVE record

CVSS 7.0 High

Arbitrary Code Execution Vulnerability in CP PLUS EZ-P21 IP Camera
- CP-Plus EZ-P21 IP Camera
- CWE-489
Not analysed yet 27 Jul 2026
CVE-2026-64529 CVE record

CVSS 7.8 High

crypto: qat - remove unused character device and IOCTLs
- Linux kernel
- CWE-489
Not analysed yet 25 Jul 2026
CVE-2026-58378 CVE record

CVSS 8.6 High

Allwinner TV Box TV98 ADB exposed on network
- Allwinner H616
- CWE-489
Not analysed yet 9 Jul 2026
CVE-2026-54799 CVE record

CVSS 8.4 High

Active debug code in Siemens CPCI85 Central Processing/Communication and others
- Siemens CPCI85 Central Processing/Communication
- Siemens SICORE Base system
- CWE-489
Not analysed yet 9 Jul 2026
CVE-2026-54798 CVE record

CVSS 7.1 High

Active debug code in Siemens CPCI85 Central Processing/Communication and others
- Siemens CPCI85 Central Processing/Communication
- Siemens SICORE Base system
- CWE-489
Not analysed yet 9 Jul 2026
CVE-2026-59092 CVE record

CVSS 7.0 High

JuiceFS - Authentication Bypass via pprof and metrics Endpoints
- juicedata juicefs
- CWE-489
Not analysed yet 2 Jul 2026
fixurjavainstall crates.io

CVSS 4.0, no score published

fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`
- CWE-489
<0.8.1 · fixed in 0.8.1

GHSA-fq3w-p4fg-mw73 Not analysed yet 25 Jun 2026
CVE-2026-49188 CVE record

CVSS 8.7 High

Elevated Root Command Execution via ai_cmd Sockets
- Acer Connect M6E 5G Portable WiFi Router
- CWE-489
Not analysed yet 4 Jun 2026
stigmem-node PyPI

CVSS 9.1 CriticalCritical · CVSS 9+

stigmem-node's federation insecure transport settings may allow non-loopback cleartext federation
- Weak cryptography or TLS
- CWE-489
<0.9.0a2 · fixed in 0.9.0a2

GHSA-jmfc-hfjq-pxcp · CVE-2026-76244 Not analysed yet 29 May 2026
CVE-2026-9133 CVE record

CVSS 8.3 High

Arbitrary file read in rabbitmq-aws plugin
- RabbitMQ AWS
- CWE-489
Not analysed yet 20 May 2026
github.com/xyproto/algernon Go

CVSS 7.5 High

Algernon: Single-file mode unconditionally enables debug mode
- Information disclosure
- CWE-489
<1.17.7 · fixed in 1.17.7

GHSA-fwqx-8365-9983 · CVE-2026-45728 Not analysed yet 19 May 2026
CVE-2026-32662 CVE record

CVSS 6.9 Medium

Gardyn Cloud API Active Debug Code
- Gardyn Cloud API
- CWE-489
Not analysed yet 3 Apr 2026
CVE-2026-33201 CVE record

CVSS 7.0 High

Active debug code in GREEN HOUSE CO., LTD. Digital Photo Frame GH-WDF10A
- GREEN HOUSE CO., LTD. Digital Photo Frame GH-WDF10A
- CWE-489
Not analysed yet 26 Mar 2026
putyourlightson/craft-sprig Packagist

CVSS 5.5 Medium

Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground
- Information disclosure
- CWE-489
>=2.0.0, <2.15.2 || >=3.0.0, <3.7.2 · fixed in 2.15.2, 3.7.2

GHSA-m59h-42jf-cphr · CVE-2026-27131 Not analysed yet 23 Mar 2026
dfir-unfurl PyPI

CVSS 9.3 CriticalCritical · CVSS 9+

Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)
- CWE-489
<=20250810 · no fixed version yet

GHSA-vg9h-jx4v-cwx2 · CVE-2026-40035 Not analysed yet 29 Jan 2026
CVE-2025-15017 CVE record

CVSS 7.0 High

Active debug code in Moxa NPort 5000AI-M12 Series and others
- Moxa NPort 5000AI-M12 Series
- Moxa NPort 5100 Series
- CWE-489
Not analysed yet 31 Dec 2025
CVE-2025-42872 CVE record

CVSS 6.1 Medium

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal
- SAP_SE SAP NetWeaver Enterprise Portal
- CWE-489
Not analysed yet 9 Dec 2025
CVE-2025-2486 CVE record

CVSS 3.7 Low

UEFI Shell accessible in AAVMF with Secure Boot enabled on Ubuntu
- Ubuntu edk2
- CWE-489
Not analysed yet 26 Nov 2025
CVE-2025-64983 CVE record

CVSS 8.6 High

Active debug code in SwitchBot Smart Video Doorbell
- SwitchBot Smart Video Doorbell
- CWE-489
Not analysed yet 26 Nov 2025
CVE-2025-54660 CVE record

CVSS 4.9 Medium

Active debug code in Fortinet FortiClientWindows
- Fortinet FortiClientWindows
- CWE-489
Not analysed yet 18 Nov 2025
CVE-2025-30185 CVE record

CVSS 8.3 High

Active debug code in Intel UEFI reference platforms
- Intel UEFI reference platforms
- CWE-489
Not analysed yet 11 Nov 2025
CVE-2025-52663 CVE record

CVSS 7.3 High

Active debug code in Ubiquiti Inc UniFi Talk Touch and others
- Ubiquiti Inc UniFi Talk Touch
- Ubiquiti Inc UniFi Talk Touch Max
- CWE-489
Not analysed yet 30 Oct 2025
CVE-2025-4106 CVE record

CVSS 8.9 High

WatchGuard Firebox leftover debug code vulnerability
- WatchGuard Fireware OS
- CWE-489
Not analysed yet 24 Oct 2025
CVE-2025-36899 CVE record

CVSS 8.4 High

Active debug code in Google Android
- Google Android
- CWE-489
Not analysed yet 4 Sept 2025
CVE-2025-21472 CVE record

CVSS 5.5 Medium

Leftover Debug Code in Secure Element
- Qualcomm, Inc. Snapdragon
- CWE-489
Not analysed yet 6 Aug 2025
CVE-2025-7705 CVE record

CVSS 8.6 High

Authentication bypass due to compatibility mode enabled by default
- ABB Switch Actuator 4 DU-83330
- ABB Switch actuator, door/light 4 DU -83330-500
- CWE-489
Not analysed yet 22 Jul 2025
CVE-2025-1479 CVE record

CVSS 4.8 Medium

Active debug code in Lenovo Legion Space for Legion Go and others
- Lenovo Legion Space for Legion Go
- Lenovo Legion Space for Legion PC
- CWE-489
Not analysed yet 30 May 2025
CVE-2025-46674 CVE record

CVSS 3.5 Low

Active debug code in NASA CryptoLib
- NASA CryptoLib
- CWE-489
Not analysed yet 27 Apr 2025
CVE-2025-2919 CVE record

CVSS 7.0 High

Netis WF-2404 UART hardware allows activation of test or debug logic at runtime
- Netis WF-2404
- CWE-489
- CWE-1313
Not analysed yet 28 Mar 2025
CVE-2024-53648 CVE record

CVSS 7.0 High

Active debug code in Siemens SIPROTEC 5 6MD84 (CP300) and others
- Siemens SIPROTEC 5 6MD84 (CP300)
- Siemens SIPROTEC 5 6MD85 (CP200)
- CWE-489
Not analysed yet 11 Feb 2025
CVE-2024-9644 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Four-Faith F3x36 bapply.cgi Auth Bypass
- Four-Faith F3x36
- Authentication bypass
- CWE-489
Not analysed yet 4 Feb 2025
CVE-2024-9643 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Four-Faith F3x36 Hidden Debug Credentials
- Four-Faith F3x36
- Hard-coded credentials
- CWE-489
Not analysed yet 4 Feb 2025
CVE-2024-46873 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Active debug code in Sharp Corporation home 5G HR02 and others
- Sharp Corporation home 5G HR02
- Sharp Corporation Wi-Fi STATION SH-52B
- CWE-489
Not analysed yet 23 Dec 2024
CVE-2022-20649 CVE record

CVSS 8.1 HighCritical · CVSS 7+ and EPSS

Cisco Redundancy Configuration Manager Debug Remote Code Execution Vulnerability
- Cisco Redundancy Configuration Manager
- CWE-489
Not analysed yet 15 Nov 2024
CVE-2024-29075 CVE record

CVSS 4.6 Medium

Active debug code in SoftBank Corp. Mesh Wi-Fi router RP562B
- SoftBank Corp. Mesh Wi-Fi router RP562B
- CWE-489
Not analysed yet 12 Nov 2024
CVE-2024-41999 CVE record

CVSS 6.8 Medium

Active debug code in TECHNO SUPPORT COMPANY Smart-tab Android app
- TECHNO SUPPORT COMPANY Smart-tab Android app
- CWE-489
Not analysed yet 30 Sept 2024
CVE-2024-44092 CVE record

CVSS 7.8 High

Active debug code in Google Android
- Google Android
- CWE-489
Not analysed yet 13 Sept 2024
CVE-2024-7756 CVE record

CVSS 6.8 Medium

Active debug code in 10w (Type 82ST, 82SU) Laptop (Lenovo) BIOS and others
- 10w (Type 82ST, 82SU) Laptop (Lenovo) BIOS
- Lenovo L390 (type 20NR, 20NS) Laptops (ThinkPad) BIOS
- CWE-489
Not analysed yet 13 Sept 2024
github.com/grafana/synthetic-monitoring-agent Go

CVSS 7.2 High

Grafana's default installation of `synthetic-monitoring-agent` exposes sensitive information in github.com/grafana/synthetic-monitoring-agent
- CWE-489
- CWE-749
<0.12.0 · fixed in 0.12.0

GHSA-9j4f-f249-q5w8 · CVE-2022-46156 Not analysed yet 21 Aug 2024
CVE-2024-36475 CVE record

CVSS 7.2 High

Active debug code in Century Systems Co., Ltd. FutureNet NXR-1300 series and others
- Century Systems Co., Ltd. FutureNet NXR-1300 series
- Century Systems Co., Ltd. FutureNet NXR-650
- CWE-489
Not analysed yet 17 Jul 2024