Advisories · Weakness
CWE-669.
Every Advisory and CVE whose sources give the weakness CWE-669, newest first.
- CVSS 7.2 High
@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim.
- twilio-labs netlify-okta-auth
- CWE-669
- CVSS 6.1 Medium
Yealink UVC40 E2: On Yealink UVC40 E2 devices before 319.410.0.71…
- Yealink UVC40 E2
- CWE-669
- CVSS 6.5 Medium
Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping…
- Roundcube Webmail
- CWE-669
- CVSS 4.3 Medium
OpenStack Cinder: In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the…
- OpenStack Cinder
- CWE-669
- CVSS 4.3 Medium
Openwave Messaging (Ireland) Limited Webtop Media Transcoder: Openwave Webtop Media Transcoder does not enforce administrator-defined file type…
- Openwave Messaging (Ireland) Limited Webtop Media Transcoder
- CWE-669
- CVSS 8.1 High
Wheels: Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a…
- Wheels
- CWE-669
- CVSS 7.5 High
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens.
- Backdrop
- CWE-669
- CVSS 2.2 Low
OpenBSD OpenSSH: In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly…
- OpenBSD OpenSSH
- CWE-669
- CVSS 2.2 Low
OpenBSD OpenSSH: In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a…
- OpenBSD OpenSSH
- CWE-669
- CVSS 8.9 High
vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks
- CWE-669
>=3.11.4, <3.11.7 · fixed in 3.11.7
GHSA-jf8q-945g-9q4c · CVE-2026-92952 - CVSS 7.8 High
NVIDIA Virtual GPU Manager: NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability where an attacker…
- NVIDIA Virtual GPU Manager
- CWE-669
- CVSS 7.8 High
Pexip Infinity: Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0…
- Pexip Infinity
- CWE-669
- CVSS 6.8 Medium
Duplicate Advisory: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks
- CWE-669
>=3.11.4, <=3.11.6 · no fixed version yet
GHSA-hmpr-c9rf-qcrf - CVSS 9.1 CriticalCritical · CVSS 9+
Cisco Identity Services Engine Hardening Release - Incorrect Resource Transfer Vulnerabilities
- Cisco Identity Services Engine Software
- Cisco ISE Passive Identity Connector
- CWE-669
- CVSS 2.9 Low
In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0.
- Oraios AI Serena
- CWE-669
- CVSS 3.7 Low
TrustedFirmware Mbed TLS: In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2…
- TrustedFirmware Mbed TLS
- CWE-669
- CVSS 3.1 Low
An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3.
- MediaWiki ProofreadPage
- CWE-669
- CVSS 3.1 Low
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3.
- MediaWiki CheckUser
- CWE-669
- CVSS 7.5 High
Amazon ca-certificates: The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2)…
- Amazon ca-certificates
- CWE-669
- CVSS 3.0 Low
Floodlight 71fe8a7 allows disruption of host communication via link spoofing.
- Floodlight
- CWE-669
- CVSS 2.9 Low
PCRE2: In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary…
- PCRE2
- CWE-669
- CVSS 6.5 Medium
Tor: Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not…
- Tor
- CWE-669
- CVSS 5.6 Medium
xmlsoft libxml2: In xinclude in libxml2 before 2.15.4…
- xmlsoft libxml2
- CWE-669
- CVSS 6.4 Medium
Roundcube Webmail: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3…
- Roundcube Webmail
- CWE-669
- CVSS 5.8 Medium
Roundcube Webmail: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3…
- Roundcube Webmail
- CWE-669
- CVSS 5.8 Medium
Roundcube Webmail: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3…
- Roundcube Webmail
- CWE-669
- CVSS 3.1 Low
Zimbra Collaboration: In Zimbra Collaboration before 10.1.17…
- Zimbra Collaboration
- CWE-669
- CVSS 6.8 Medium
OpenStack Designate: In OpenStack Designate before 22.0.2…
- OpenStack Designate
- CWE-669
- CVSS 3.5 Low
OpenBSD OpenSSH: In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended…
- OpenBSD OpenSSH
- CWE-669
- CVSS 5.4 Medium
OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints
- CWE-669
>=18.0.0, <=31.3.0 || >=32.0.0, <32.2.1 || >=33.0.0, <33.0.2 · fixed in 32.2.1, 33.0.2
GHSA-mfg3-p6m3-gjgr · CVE-2026-46448 - CVSS 7.4 High
Avira Password Manager credential disclosure via cross-origin autofill in Firefox
- Gen Digital Avira Password Manager
- CWE-669
- CVSS 5.8 Medium
OpenStack Ironic allows Boot Script Injection
- CWE-669
>=17.0.0, <26.1.7 || >=27.0.0, <29.0.6 || >=30.0.0, <32.0.2 || >=33.0.0, <35.0.2 · fixed in 26.1.7, 29.0.6, 32.0.2, 35.0.2
GHSA-jrh2-f5jc-xpgr · CVE-2026-46447 - CVSS 4.9 Medium
OpenStack Ironic: OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager…
- OpenStack Ironic
- CWE-669
- CVSS 3.7 Low
Roundcube Webmail: Roundcube Webmail 1.6.x before 1.6.16…
- Roundcube Webmail
- CWE-669
- CVSS 6.5 Medium
Roundcube Webmail: In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1…
- Roundcube Webmail
- CWE-669
- CVSS 6.5 Medium
Roundcube Webmail: In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1…
- Roundcube Webmail
- CWE-669
- CVSS 7.3 High
Wine: Wine ships a .desktop file that registers itself as a MIME handler for EXE files and…
- Wine
- CWE-669
- CVSS 7.5 High
Talos Linux has a local privilege escalation from untrusted workloads
- CWE-669
<1.12.7 · fixed in 1.12.7
GHSA-m38g-vww2-mvgx - CVSS 3.7 Low
Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.
- Tor
- CWE-669
- CVSS 7.7 High
OpenStack Ironic has an Incorrect Resource Transfer Between Spheres
- Information disclosure
- CWE-669
<26.1.6 || >=27.0.0, <29.0.5 || >=30.0.0, <32.0.1 || >=33.0.0, <35.0.1 · fixed in 26.1.6, 29.0.5, 32.0.1, 35.0.1
GHSA-54w4-233h-x86g · CVE-2026-42997 - CVSS 4.7 Medium
Remote Code Execution in multiple BinSoft products
- BinSoft mpGabinet
- BinSoft mpFirma
- CWE-669
- CVSS 6.5 Medium
KDE Dolphin: KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor…
- KDE Dolphin
- CWE-669
- CVSS 7.8 HighCritical · KEV, CVSS 7+ and EPSSKEV
crypto: algif_aead - Revert to operating out-of-place
- Linux kernel
- CWE-669
- CWE-1288
- CVSS 6.2 Medium
Ascensio ONLYOFFICE DesktopEditors: In ONLYOFFICE DesktopEditors before 9.3.0…
- Ascensio ONLYOFFICE DesktopEditors
- CWE-669
- CVSS 2.9 Low
systemd: In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of…
- systemd
- CWE-669
- CVSS 6.4 Medium
systemd: In udev in systemd before 260, local root execution can occur via malicious hardware…
- systemd
- CWE-669
- CVSS 5.3 Medium
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages
- CWE-669
>=1.7-beta, <1.7-rc5 · fixed in 1.7-rc5
GHSA-xpqh-grpw-4xmg · CVE-2026-35544 - CVSS 5.3 Medium
Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message
- CWE-669
>=1.7-beta, <1.7-rc5 · fixed in 1.7-rc5
GHSA-w846-74jr-76cv · CVE-2026-35545 - CVSS 5.4 Medium
Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages
- Server-side request forgery (SSRF)
- CWE-669
>=1.7-beta, <1.7-rc5 · fixed in 1.7-rc5
GHSA-vxg2-hhgr-37fx · CVE-2026-35540 - CVSS 5.3 Medium
Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message
- CWE-669
>=1.7-beta, <1.7-rc5 · fixed in 1.7-rc5
GHSA-j2g6-8rvg-7mf6 · CVE-2026-35543 - CVSS 5.3 Medium
Roundcube: Bypass of remote image blocking via crafted BODY background attribute
- CWE-669
>=1.7-beta, <1.7-rc5 · fixed in 1.7-rc5
GHSA-5hf6-crg4-fg59 · CVE-2026-35542 - CVSS 8.8 High
CODESYS Control Boot Application Replacement Enables Code Execution
- CODESYS Control RTE (SL)
- CODESYS Control RTE (for Beckhoff CX) SL
- CWE-669
- CVSS 6.3 Medium
In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.
- LibreChat
- CWE-669
- CVSS 3.4 Low
GNU inetutils: telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment…
- GNU inetutils
- CWE-669
- CVSS 8.2 High
OpenStack Nova calls qemu-img without format restrictions for resize
- Path traversal
- CWE-669
<=30.2.1 || >=31.0.0.0rc1, <=31.2.0 || >=32.0.0.0rc1, <=32.1.0 · no fixed version yet
GHSA-m4f3-qp2w-gwh6 · CVE-2026-24708 - CVSS 8.8 HighCritical · CVSS 7+ and EPSS
OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl
- Information disclosure
- CWE-669
<2026.1.29 · fixed in 2026.1.29
GHSA-g8p2-7wf7-98mq · CVE-2026-25253 - CVSS 8.8 High
Duplicate Advisory: 1-Click RCE via Authentication Token Exfiltration From gatewayUrl
- CWE-669
<2026.1.29 · fixed in 2026.1.29
GHSA-r2c6-8jc8-g32w - CVSS 4.3 Medium
Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credential...
- Broken access control
- CWE-669
<=1.9.1 · no fixed version yet
PYSEC-2025-103 · CVE-2025-63387 - CVSS 9.8 CriticalCritical · CVSS 9+
Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context
- CWE-669
<2.0.0 · fixed in 2.0.0
GHSA-66h8-3g48-6hx8 · CVE-2025-67895 - CVSS 8.0 High
Mercku M6a devices through 2.1.0 allow root TELNET logins via the web admin password.
- Mercku M6a
- CWE-669