# CWE-636.

Every Advisory and CVE whose sources give the weakness CWE-636, newest first.

## Records, newest first

- [vault-java-driver: SslConfig silently disables requested TLS verification](https://agentprime.io/advisories/CVE-2026-109408.md)
  `CVE-2026-109408` · CVE record: jopenlibs vault-java-driver · CVSS 7.4 High · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS, CWE-636
- [Sandboxie-Plus: Sandbox containment bypass](https://agentprime.io/advisories/CVE-2026-102280.md)
  `CVE-2026-102280` · CVE record: sandboxie-plus Sandboxie · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure, Broken access control, CWE-390, CWE-636
- [node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound \`DefaultRolePermissions](https://agentprime.io/advisories/CVE-2026-95860.md)
  `CVE-2026-95860` · CVE record: node-opcua node-opcua · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control, CWE-636, CWE-1188
- [An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.](https://agentprime.io/advisories/CVE-2026-109593.md)
  `CVE-2026-109593` · CVE record: SonicWall Global Management System (GMS) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-636
- [Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured](https://agentprime.io/advisories/CVE-2026-110985.md)
  `CVE-2026-110985` · CVE record: Apache Software Foundation Apache Kafka · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Weak cryptography or TLS, CWE-345, CWE-636, CWE-1287
- [A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.](https://agentprime.io/advisories/CVE-2026-108142.md)
  `CVE-2026-108142` · CVE record: Veeam Backup and Replication · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-636
- [Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization](https://agentprime.io/advisories/CVE-2026-105933.md)
  `CVE-2026-105933` · CVE record: Apache Software Foundation Apache Pulsar · CVSS 2.3 Low · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-636
- [Not Failing Securely ('Failing Open') in hMailServer](https://agentprime.io/advisories/CVE-2026-114479.md)
  `CVE-2026-114479` · CVE record: Progressive Robot Ltd hMailServer · CVSS 5.8 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-636
- [Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up](https://agentprime.io/advisories/CVE-2026-74048.md)
  `CVE-2026-74048` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-636
- [hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25](https://agentprime.io/advisories/GHSA-p26c-h8c2-rwqj.md)
  `GHSA-p26c-h8c2-rwqj`, `CVE-2026-103502`, `EEF-CVE-2026-103502` · Hex `hex_core`: affected `>=0.1.0, <0.20.0`, fixed in `0.20.0` · CVSS 5.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Weak cryptography or TLS, CWE-636
- [Dell Secure Connect Gateway (SCG) Policy Manager: Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16…](https://agentprime.io/advisories/CVE-2026-78022.md)
  `CVE-2026-78022` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 6.8 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-636
- [SumatraPDF: \`sumatrapdfrestrict.ini\` never revokes any permission (fail-open policy initialization)](https://agentprime.io/advisories/CVE-2026-107735.md)
  `CVE-2026-107735` · CVE record: sumatrapdfreader sumatrapdf · CVSS 5.4 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-636
- [Fail-open response masking in Docker Sandboxes can expose proxy-managed credentials](https://agentprime.io/advisories/CVE-2026-101998.md)
  `CVE-2026-101998` · CVE record: Docker Docker Sandboxes · CVSS 5.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-636
- [Not Failing Securely ('Failing Open') in hMailServer](https://agentprime.io/advisories/CVE-2026-107584.md)
  `CVE-2026-107584` · CVE record: Progressive Robot Ltd hMailServer · CVSS 7.4 High · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-636
- [pgjdbc does not enforce requireAuth when the value excludes every authentication method](https://agentprime.io/advisories/CVE-2026-107314.md)
  `CVE-2026-107314` · CVE record: pgjdbc pgjdbc · CVSS 5.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-636
- [Authentication bypass via blank auth token in P4Search](https://agentprime.io/advisories/CVE-2026-103510.md)
  `CVE-2026-103510` · CVE record: Perforce P4 (Helix Core) · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-636
- [heym before 0.0.105 Authentication Bypass via Redis Node](https://agentprime.io/advisories/CVE-2026-100860.md)
  `CVE-2026-100860` · CVE record: heymrun heym · CVSS 6.8 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: CWE-636
- [TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check](https://agentprime.io/advisories/CVE-2026-100304.md)
  `CVE-2026-100304` · CVE record: TDuckCloud tduck-survey-form · CVSS 6.0 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-636
- [@bytebase/dbhub's read-only mode does not prevent database writes](https://agentprime.io/advisories/GHSA-mwwr-p57h-56pf.md)
  `GHSA-mwwr-p57h-56pf`, `CVE-2026-61788` · npm `@bytebase/dbhub`: affected `<0.22.6`, fixed in `0.22.6` · CVSS 7.4 High · Not analysed yet · Published 24 Sept 2026 · Tags: Broken access control, CWE-184, CWE-636
- [Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths](https://agentprime.io/advisories/CVE-2026-88831.md)
  `CVE-2026-88831` · CVE record: Red Hat Red Hat Hardened Images · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-636
- [Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug](https://agentprime.io/advisories/GHSA-5f42-97gr-vfhq.md)
  `GHSA-5f42-97gr-vfhq`, `CVE-2026-85724`, `CVE-2026-95842`, `CVE-2026-95843`, `CVE-2026-95844`, `CVE-2026-95845`, `CVE-2026-95846`, `CVE-2026-95847`, `CVE-2026-95848` · Maven `io.moquette:moquette-broker`: affected `<0.18.1`, fixed in `0.18.1` · CVSS 8.7 High · Not analysed yet · Published 23 Sept 2026 · Tags: Denial of service, Broken access control, CWE-20, CWE-99
- [AuthPoint Gateway Improper Authentication in LDAP Sync Allows First-Factor Authentication Bypass](https://agentprime.io/advisories/CVE-2026-95676.md)
  `CVE-2026-95676` · CVE record: WatchGuard AuthPoint Authentication Gateway · CVSS 7.4 High · Not analysed yet · Published 23 Sept 2026 · Tags: Authentication bypass, CWE-636
- [Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for](https://agentprime.io/advisories/GHSA-328g-jx67-v94g.md)
  `GHSA-328g-jx67-v94g`, `CVE-2026-77560`, `GO-2026-6552` · Go `github.com/tinyauthapp/tinyauth`: affected `<1.0.1-0.20260720133915-80bc87188ec3`, fixed in `1.0.1-0.20260720133915-80bc87188ec3` · CVSS 8.1 High · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control, CWE-178, CWE-636
- [Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer](https://agentprime.io/advisories/CVE-2026-92591.md)
  `CVE-2026-92591` · CVE record: craftcms cms · CVSS 8.2 High · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-636
- [djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data](https://agentprime.io/advisories/GHSA-3492-cvg7-9mr2.md)
  `GHSA-3492-cvg7-9mr2`, `CVE-2026-61595`, `PYSEC-2026-4036` · PyPI `djust`: affected `<1.0.7`, fixed in `1.0.7` · CVSS 7.7 High · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control, CWE-636
- [Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints](https://agentprime.io/advisories/CVE-2026-53459.md)
  `CVE-2026-53459` · CVE record: maziggy bambuddy · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-636, CWE-755
- [SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts](https://agentprime.io/advisories/EEF-CVE-2026-77866.md)
  `EEF-CVE-2026-77866`, `CVE-2026-77866` · Hex `safeurl`: affected `>=0.1.0`, no fixed version yet · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-636
- [Visual Studio Code Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-81379.md)
  `CVE-2026-81379` · CVE record: Microsoft Visual Studio Code · CVSS 8.2 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-636
- [APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard](https://agentprime.io/advisories/CVE-2026-86120.md)
  `CVE-2026-86120` · CVE record: apitable apitable · CVSS 5.3 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: CWE-636
- [Unchecked return value in chewkeanho software-actualizer](https://agentprime.io/advisories/CVE-2026-85649.md)
  `CVE-2026-85649` · CVE record: chewkeanho software-actualizer · CVSS 7.9 High · Not analysed yet · Published 4 Sept 2026 · Tags: CWE-252, CWE-636
- [NGINX ngx_http_js_module vulnerability](https://agentprime.io/advisories/CVE-2026-18329.md)
  `CVE-2026-18329` · CVE record: F5 NGINX JavaScript · CVSS 8.8 High · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-636
- [Ash.Reactor change step fails open, skipping a change when its where guard raises](https://agentprime.io/advisories/GHSA-3xq4-m876-fr88.md)
  `GHSA-3xq4-m876-fr88`, `CVE-2026-82744`, `EEF-CVE-2026-82744` · Hex `ash`: affected `>=3.0.0-rc.17, <3.32.2`, fixed in `3.32.2` · CVSS 2.1 Low · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-636
- [IGEL OS 12 / 11 Secure Boot Bypass via Unsigned igel.conf File](https://agentprime.io/advisories/CVE-2026-82018.md)
  `CVE-2026-82018` · CVE record: IGEL IGEL OS 12 and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-636
- [AIIR verification and policy gates could report success without enforcing the control (fail-open)](https://agentprime.io/advisories/GHSA-73p9-6hrp-8qhr.md)
  `GHSA-73p9-6hrp-8qhr` · PyPI `aiir`: affected `<1.7.0`, fixed in `1.7.0` · CVSS 4.0, no score published · Not analysed yet · Published 28 Aug 2026 · Tags: Weak cryptography or TLS, CWE-636
- [MyBB: Security Question insufficient validation](https://agentprime.io/advisories/CVE-2026-46482.md)
  `CVE-2026-46482` · CVE record: mybb mybb · CVSS 5.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-636
- [rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure](https://agentprime.io/advisories/CVE-2026-70452.md)
  `CVE-2026-70452` · CVE record: RsyncProject rsync · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control, CWE-636
- [Visual Studio Code Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-69306.md)
  `CVE-2026-69306` · CVE record: Microsoft Visual Studio Code · CVSS 8.2 High · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-636
- [Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access](https://agentprime.io/advisories/GHSA-74j5-6grg-g6wj.md)
  `GHSA-74j5-6grg-g6wj`, `CVE-2026-68746`, `EEF-CVE-2026-68746` · Hex `livebook`: affected `>=0.19.7, <0.19.9`, fixed in `0.19.9` · CVSS 7.7 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-636
- [Fallback to second RAUC slot with default credentials](https://agentprime.io/advisories/CVE-2026-44094.md)
  `CVE-2026-44094` · CVE record: Phoenix Contact CHARX SEC-3150 and 3 more · CVSS 8.3 High · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-636
- [nono-cli'scregistry pack verification can fail open when provenance metadata is absent](https://agentprime.io/advisories/GHSA-hc4m-q9jh-xw4j.md)
  `GHSA-hc4m-q9jh-xw4j` · crates.io `nono-cli`: affected `<0.61.3`, fixed in `0.61.3` · CVSS 6.6 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: CWE-636
- [Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)](https://agentprime.io/advisories/GHSA-8fpg-xm3f-6cx3.md)
  `GHSA-8fpg-xm3f-6cx3`, `CVE-2026-73421` · npm `next-auth`: affected `>=5.0.0-beta.0, <5.0.0-beta.32`, fixed in `5.0.0-beta.32` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: Broken access control, CWE-636
- [JupyterLab: Allowlist/blocklist check in \`PyPIExtensionManager.install()\` not enforced for direct callers (missing \`await\`)](https://agentprime.io/advisories/GHSA-whvh-wf3x-g77j.md)
  `GHSA-whvh-wf3x-g77j`, `BIT-jupyterlab-2026-73626`, `CVE-2026-73626` · PyPI `jupyterlab`: affected `<4.5.10 || >=4.6.0, <4.6.2`, fixed in `4.5.10`, `4.6.2` · CVSS 7.7 High · Not analysed yet · Published 22 Jul 2026 · Tags: Broken access control, CWE-636
- [PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms](https://agentprime.io/advisories/GHSA-j92g-9f8w-j867.md)
  `GHSA-j92g-9f8w-j867`, `BIT-postgresql-jdbc-driver-2026-54291`, `CVE-2026-54291` · Maven `org.postgresql:postgresql`: affected `>=42.7.4, <42.7.12`, fixed in `42.7.12` · CVSS 8.2 High · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-636, CWE-757
- [Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability](https://agentprime.io/advisories/GHSA-qvw7-jm5c-6hqw.md)
  `GHSA-qvw7-jm5c-6hqw`, `BIT-dotnet-2026-50528`, `BIT-dotnet-sdk-2026-50528`, `CVE-2026-50528` · NuGet `Microsoft.NetCore.App.Runtime.linux-arm` and 11 more: affected `>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.29`, `9.0.18`, `10.0.10` · CVSS 8.2 High · Not analysed yet · Published 20 Jul 2026 · Tags: Broken access control, CWE-302, CWE-636
- [Grav Flex-Objects < 1.4.3 Authorization Bypass via API](https://agentprime.io/advisories/CVE-2026-62235.md)
  `CVE-2026-62235` · CVE record: getgrav grav · CVSS 2.3 Low · Not analysed yet · Published 17 Jul 2026 · Tags: Broken access control, CWE-636
- [Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities](https://agentprime.io/advisories/GHSA-qvc3-6q9x-95pj.md)
  `GHSA-qvc3-6q9x-95pj`, `CVE-2026-53913` · Maven `org.apache.camel:camel-keycloak`: affected `>=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.18.3`, `4.21.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: Authentication bypass, CWE-636
- [OpenClaw: Mattermost handlers could fall open when channel type was missing](https://agentprime.io/advisories/GHSA-gp79-m99v-gjmh.md)
  `GHSA-gp79-m99v-gjmh`, `CVE-2026-53837` · npm `openclaw`: affected `<2026.5.6`, fixed in `2026.5.6` · CVSS 6.3 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: CWE-636
- [OnGres SCRAM silent channel-binding authentication downgrade via unsupported certificate algorithms](https://agentprime.io/advisories/GHSA-p9jg-fcr6-3mhf.md)
  `GHSA-p9jg-fcr6-3mhf`, `CVE-2026-53712` · Maven `com.ongres.scram:scram-client` and 1 more: affected `<3.3`, fixed in `3.3` · CVSS 8.2 High · Not analysed yet · Published 1 Jul 2026 · Tags: CWE-636, CWE-757
- [Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails](https://agentprime.io/advisories/GHSA-4mr2-fg2p-w63c.md)
  `GHSA-4mr2-fg2p-w63c`, `CVE-2026-54762`, `GO-2026-5128` · Go `github.com/traefik/traefik/v3`: affected `>=3.7.0-ea.1, <3.7.5`, fixed in `3.7.5` · CVSS 5.9 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-636, CWE-693
- [guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext](https://agentprime.io/advisories/GHSA-wpwq-4j6v-78m3.md)
  `GHSA-wpwq-4j6v-78m3`, `CVE-2026-55568`, `PKSA-k22t-f949-t9g6` · Packagist `guzzlehttp/guzzle`: affected `<7.12.1`, fixed in `7.12.1` · CVSS 5.9 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Weak cryptography or TLS, CWE-636
- [OpenClaw: Empty-scope device re-pairing could confuse caller scope containment](https://agentprime.io/advisories/GHSA-8mg9-j9cf-54cj.md)
  `GHSA-8mg9-j9cf-54cj`, `CVE-2026-53852` · npm `openclaw`: affected `<2026.4.25`, fixed in `2026.4.25` · CVSS 2.3 Low · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-636
- [Duplicate Advisory: Empty-scope device re-pairing could confuse caller scope containment](https://agentprime.io/advisories/GHSA-hc4w-hm59-9w88.md)
  `GHSA-hc4w-hm59-9w88` · npm `openclaw`: affected `<=2026.4.24`, no fixed version yet · CVSS 5.4 Medium · Withdrawn · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-636
- [Duplicate Advisory: OpenClaw: Mattermost handlers could fall open when channel type was missing](https://agentprime.io/advisories/GHSA-chqm-wxm2-w73w.md)
  `GHSA-chqm-wxm2-w73w` · npm `openclaw`: affected `<2026.5.6`, fixed in `2026.5.6` · CVSS 3.7 Low · Withdrawn · Not analysed yet · Published 13 Jun 2026 · Tags: CWE-636
- [Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot](https://agentprime.io/advisories/CVE-2026-49318.md)
  `CVE-2026-49318` · CVE record: Indian Motorcycle Scout Bobber + Tech · CVSS 1.0 Low · Not analysed yet · Published 29 May 2026 · Tags: CWE-636, CWE-696, CWE-754
- [Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot](https://agentprime.io/advisories/CVE-2026-49317.md)
  `CVE-2026-49317` · CVE record: Indian Motorcycle Scout Bobber + Tech · CVSS 1.0 Low · Not analysed yet · Published 29 May 2026 · Tags: CWE-636, CWE-696, CWE-754
- [MCP Registry: OCI validator skips ownership check on upstream rate limits](https://agentprime.io/advisories/GHSA-2v5f-5r6w-p67r.md)
  `GHSA-2v5f-5r6w-p67r`, `CVE-2026-45781`, `GO-2026-5008` · Go `github.com/modelcontextprotocol/registry`: affected `<1.7.9`, fixed in `1.7.9` · CVSS 3.5 Low · Not analysed yet · Published 19 May 2026 · Tags: CWE-636
- [net-imap vulnerable to STARTTLS stripping via invalid response timing](https://agentprime.io/advisories/GHSA-vcgp-9326-pqcp.md)
  `GHSA-vcgp-9326-pqcp`, `CVE-2026-42246` · RubyGems `net-imap`: affected `<0.3.10 || >=0.4.0, <0.4.24 || >=0.5.0, <0.5.14 || >=0.6.0, <0.6.4`, fixed in `0.3.10`, `0.4.24`, `0.5.14`, `0.6.4` · CVSS 7.6 High · Not analysed yet · Published 4 May 2026 · Tags: CWE-325, CWE-392, CWE-393, CWE-636
- [OpenViking: Unauthenticated remote bot control via OpenAPI HTTP routes](https://agentprime.io/advisories/GHSA-jgq2-vq69-gr6h.md)
  `GHSA-jgq2-vq69-gr6h`, `CVE-2026-40525`, `PYSEC-2026-438` · PyPI `openviking`: affected `<0.3.9`, fixed in `0.3.9` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Apr 2026 · Tags: CWE-636
- [free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors](https://agentprime.io/advisories/GHSA-gx38-8h33-pmxr.md)
  `GHSA-gx38-8h33-pmxr`, `CVE-2026-40249`, `GO-2026-5407` · Go `github.com/free5gc/udr`: affected `<=1.4.2`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-636, CWE-754
- [free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions](https://agentprime.io/advisories/GHSA-jgq2-qv8v-5cmj.md)
  `GHSA-jgq2-qv8v-5cmj`, `CVE-2026-40248`, `GO-2026-5470` · Go `github.com/free5gc/udr`: affected `<=1.4.2`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 14 Apr 2026 · Tags: Broken access control, CWE-636

Older: <https://agentprime.io/advisories/tag/cwe-636.md?cursor=WyIyMDI2LTA0LTE0VDIwOjAwOjQ1LjAwMDAwMFoiLCJHSFNBLWpncTItcXY4di01Y21qIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-636>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-636/>. Everything for agents: <https://agentprime.io/llms.txt>.