# CWE-628.

Every Advisory and CVE whose sources give the weakness CWE-628, newest first.

## Records, newest first

- [Tanium addressed a business logic error in Threat Response.](https://agentprime.io/advisories/CVE-2026-116652.md)
  `CVE-2026-116652` · CVE record: Tanium Threat Response · CVSS 4.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-628
- [libIEC61850: Server-side out-of-bounds stack read in association-specific dynamic dataset creation due to reversed StringUtils_copyStringToBuffer arguments](https://agentprime.io/advisories/CVE-2026-68907.md)
  `CVE-2026-68907` · CVE record: mz-automation libiec61850 · CVSS 8.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Memory corruption, CWE-628
- [Apache Thrift: Python \`TZlibTransport\` stops enforcing its decompressed-size limit once the limit is exactly used up](https://agentprime.io/advisories/CVE-2026-94636.md)
  `CVE-2026-94636` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-409, CWE-628, CWE-1284
- [Zebra 4.5.0 Consensus Split via P2SH Sigop Overcount](https://agentprime.io/advisories/CVE-2026-104430.md)
  `CVE-2026-104430` · CVE record: ZcashFoundation zebra · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-628
- [Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO sessi…](https://agentprime.io/advisories/CVE-2026-19349.md)
  `CVE-2026-19349` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Aug 2026 · Tags: CWE-305, CWE-628
- [KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation](https://agentprime.io/advisories/CVE-2026-43133.md)
  `CVE-2026-43133` · CVE record: Linux Linux · CVSS 7.9 High · Not analysed yet · Published 6 May 2026 · Tags: CWE-628, CWE-754
- [iccDEV memcpy-param-overlap in CIccTagMultiProcessElement::Apply()](https://agentprime.io/advisories/CVE-2026-25634.md)
  `CVE-2026-25634` · CVE record: InternationalColorConsortium iccDEV · CVSS 7.8 High · Not analysed yet · Published 6 Feb 2026 · Tags: Memory corruption, CWE-123, CWE-628, CWE-682
- [iccDEV has Undefined Behavior - Null Pointer Passed to memcpy() in CIccTagSparseMatrixArray](https://agentprime.io/advisories/CVE-2026-21503.md)
  `CVE-2026-21503` · CVE record: InternationalColorConsortium iccDEV · CVSS 6.1 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: Memory corruption, CWE-20, CWE-628
- [A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour configuration page in the web interface of t…](https://agentprime.io/advisories/CVE-2025-0325.md)
  `CVE-2025-0325` · CVE record: Axis Communications AB AXIS OS · CVSS 4.3 Medium · Not analysed yet · Published 2 Jun 2025 · Tags: CWE-628, CWE-1287
- [MIT krb5: A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x…](https://agentprime.io/advisories/CVE-2019-14844.md)
  `CVE-2019-14844` · CVE record: MIT krb5 · CVSS 7.5 High · Not analysed yet · Published 26 Sept 2019 · Tags: CWE-628
- [Snapd seccomp filter TIOCSTI ioctl bypass](https://agentprime.io/advisories/CVE-2019-7303.md)
  `CVE-2019-7303` · CVE record: Canonical snapd · CVSS 5.7 Medium · Not analysed yet · Published 23 Apr 2019 · Tags: CWE-628

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-628>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-628/>. Everything for agents: <https://agentprime.io/llms.txt>.