# CWE-682.

Every Advisory and CVE whose sources give the weakness CWE-682, newest first.

## Records, newest first

- [MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)](https://agentprime.io/advisories/GHSA-6hp3-vr39-rqw8.md)
  `GHSA-6hp3-vr39-rqw8`, `CVE-2026-48705` · PyPI `monai`: affected `<1.6.1`, fixed in `1.6.1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-20, CWE-682
- [netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount](https://agentprime.io/advisories/CVE-2026-116541.md)
  `CVE-2026-116541` · CVE record: netty netty-tcnative and 1 more · CVSS 8.2 High · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-682
- [Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion](https://agentprime.io/advisories/CVE-2026-115786.md)
  `CVE-2026-115786` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 6.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-682
- [Multiple Cisco Products Snort 3 Software Hardening Release: October 2026](https://agentprime.io/advisories/CVE-2026-20236.md)
  `CVE-2026-20236` · CVE record: Cisco Cisco Cyber Vision and 3 more · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-682
- [Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches](https://agentprime.io/advisories/CVE-2026-114117.md)
  `CVE-2026-114117` · CVE record: vyperlang vyper · CVSS 8.2 High · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-682
- [Incorrect calculation in Google Chrome](https://agentprime.io/advisories/CVE-2026-113007.md)
  `CVE-2026-113007` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-682
- [Junos OS and Junos OS Evolved: A BGP EVPN neighbor causes an rpd crash when SRv6 multihoming is used](https://agentprime.io/advisories/CVE-2026-101963.md)
  `CVE-2026-101963` · CVE record: Juniper Networks Junos OS and 1 more · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-682
- [macrozheng mall mall-admin/mall-portal moneyInfo OmsOrderServiceImpl.updateMoneyInfo calculation](https://agentprime.io/advisories/CVE-2026-109410.md)
  `CVE-2026-109410` · CVE record: macrozheng mall · CVSS 4.8 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-682
- [fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)](https://agentprime.io/advisories/GHSA-687g-22h4-j4w4.md)
  `GHSA-687g-22h4-j4w4`, `CVE-2026-107721` · npm `fast-jwt`: affected `<6.3.0`, fixed in `6.3.0` · CVSS 5.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass, CWE-682
- [Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver](https://agentprime.io/advisories/CVE-2026-106438.md)
  `CVE-2026-106438` · CVE record: MongoDB C Driver · CVSS 5.1 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-682
- [Cisco Meraki Hardening Release - Incorrect Calculation Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76470.md)
  `CVE-2026-76470` · CVE record: Cisco Cisco Campus Gateway Software and 3 more · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-682
- [Incorrect calculation in Google Chrome](https://agentprime.io/advisories/CVE-2026-106420.md)
  `CVE-2026-106420` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-682
- [Vyper: Call stack corruption when passing complex type containing non-base type members as argument](https://agentprime.io/advisories/GHSA-4v7v-gqf9-ww2g.md)
  `GHSA-4v7v-gqf9-ww2g`, `CVE-2020-37287` · PyPI `vyper`: affected `<0.2.6`, fixed in `0.2.6` · CVSS 8.2 High · Not analysed yet · Published 6 Oct 2026 · Tags: Memory corruption, CWE-682
- [WordPress CURCY plugin <= 2.2.17 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-97071.md)
  `CVE-2026-97071` · CVE record: VillaTheme CURCY · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-682
- [ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function.](https://agentprime.io/advisories/CVE-2026-88371.md)
  `CVE-2026-88371` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-682
- [Incorrect Calculation vulnerability in RTI Connext Professional (Core Libraries) allows Abuse Existing Functionality.](https://agentprime.io/advisories/CVE-2026-18459.md)
  `CVE-2026-18459` · CVE record: RTI Connext Professional · CVSS 8.7 High · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-682
- [Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Incorrect Calculation Vulnerabilities](https://agentprime.io/advisories/CVE-2026-20335.md)
  `CVE-2026-20335` · CVE record: Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and 2 more · CVSS 8.1 High · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-682
- [snipe-it before 8.7.0 Checkout Request Counter Integrity Failure](https://agentprime.io/advisories/CVE-2026-86736.md)
  `CVE-2026-86736` · CVE record: grokability snipe-it · CVSS 5.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-682
- [PREVAIL: ALU32 pointer arithmetic accepted without is64 gate — verifier emits false PASS for pointer-corrupting programs](https://agentprime.io/advisories/CVE-2026-53706.md)
  `CVE-2026-53706` · CVE record: vbpf prevail · CVSS 8.8 High · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-682
- [PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification](https://agentprime.io/advisories/CVE-2026-53670.md)
  `CVE-2026-53670` · CVE record: vbpf prevail · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-682
- [PREVAIL: Context-write no-op in do_mem_store allows unsafe eBPF programs to pass verification](https://agentprime.io/advisories/CVE-2026-53671.md)
  `CVE-2026-53671` · CVE record: vbpf prevail · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-682
- [Cisco IOS XR Software Security Hardening Release: September 2026](https://agentprime.io/advisories/CVE-2026-20275.md)
  `CVE-2026-20275` · CVE record: Cisco Cisco IOS XR Software · CVSS 8.8 High · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-682
- [Klever: Marketplace settlement mints KLV when referral % + royalty % exceed the bid (negative seller share silently skipped)](https://agentprime.io/advisories/GHSA-p7gw-2pcp-5pf8.md)
  `GHSA-p7gw-2pcp-5pf8`, `CVE-2026-54754`, `GO-2026-6315` · Go `github.com/klever-io/klever-go`: affected `<1.7.19`, fixed in `1.7.19` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2026 · Tags: Memory corruption, Race condition, CWE-682
- [Incorrect calculation in Google Chrome](https://agentprime.io/advisories/CVE-2026-76043.md)
  `CVE-2026-76043` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-682
- [New API: Integer overflow in quota billing yields negative charges (self-crediting)](https://agentprime.io/advisories/GHSA-8r8v-xf7q-rcpr.md)
  `GHSA-8r8v-xf7q-rcpr`, `CVE-2026-71479`, `GO-2026-6242` · Go `github.com/QuantumNous/new-api`: affected `<1.0.0-rc.18`, fixed in `1.0.0-rc.18` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Aug 2026 · Tags: Memory corruption, CWE-682
- [dm-integrity: don't increment hash_offset twice](https://agentprime.io/advisories/CVE-2026-72099.md)
  `CVE-2026-72099` · CVE record: Linux Linux · CVSS 7.1 High · Not analysed yet · Published 15 Aug 2026 · Tags: CWE-682
- [Incorrect calculation in Intel(R) TDX Guest software](https://agentprime.io/advisories/CVE-2026-20763.md)
  `CVE-2026-20763` · CVE record: Intel(R) TDX Guest software · CVSS 4.6 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-682
- [Cisco IOS XE Software Security Hardening Release](https://agentprime.io/advisories/CVE-2026-20270.md)
  `CVE-2026-20270` · CVE record: Cisco Cisco IOS XE Software · CVSS 8.6 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-682
- [Out-of-bounds read in DHCPv4 client message-type name lookup (net_dhcpv4_msg_type_name)](https://agentprime.io/advisories/CVE-2026-10773.md)
  `CVE-2026-10773` · CVE record: zephyrproject zephyr · CVSS 5.4 Medium · Not analysed yet · Published 1 Aug 2026 · Tags: Memory corruption, CWE-682
- [smb/client: fix chown/chgrp with SMB3 POSIX Extensions](https://agentprime.io/advisories/CVE-2026-64388.md)
  `CVE-2026-64388` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 25 Jul 2026 · Tags: CWE-682
- [AWS CDK CodeBuild S3 Log Encryption Boolean Inversion](https://agentprime.io/advisories/GHSA-464c-974j-9xm6.md)
  `GHSA-464c-974j-9xm6`, `GO-2026-6093` · Go `github.com/aws/aws-cdk-go/awscdk` and 9 more: affected `>=1.175.0-devpreview, <=1.204.0-devpreview`, no fixed version yet · CVSS 3.3 Low · Not analysed yet · Published 24 Jul 2026 · Tags: Weak cryptography or TLS, CWE-682
- [ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments](https://agentprime.io/advisories/GHSA-c4v7-w88g-m6c4.md)
  `GHSA-c4v7-w88g-m6c4`, `CVE-2026-55597` · NuGet `Magick.NET-Q16-AnyCPU` and 16 more: affected `<14.15.0`, fixed in `14.15.0` · CVSS 5.5 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Memory corruption, CWE-682
- [libheif Vulnerable to Heap Information Disclosure via Grid Image Gap + Uninitialized Pixel Plane Allocation](https://agentprime.io/advisories/CVE-2026-47247.md)
  `CVE-2026-47247` · CVE record: strukturag libheif · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Information disclosure, Memory corruption, CWE-226, CWE-682
- [JIT miscompilation in the JavaScript: WebAssembly component](https://agentprime.io/advisories/CVE-2026-16363.md)
  `CVE-2026-16363` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption, CWE-682
- [wifi: iwlwifi: mvm: fix driver-set TX rates on old devices](https://agentprime.io/advisories/CVE-2026-64176.md)
  `CVE-2026-64176` · CVE record: Linux Linux · CVSS 8.1 High · Not analysed yet · Published 19 Jul 2026 · Tags: CWE-682
- [X25519 x86_64 assembly final reduction leaves non-canonical field element](https://agentprime.io/advisories/CVE-2026-10512.md)
  `CVE-2026-10512` · CVE record: wolfSSL wolfSSL · CVSS 2.3 Low · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-682
- [net: mvpp2: sync RX data at the hardware packet offset](https://agentprime.io/advisories/CVE-2026-53217.md)
  `CVE-2026-53217` · CVE record: Linux Linux · CVSS 8.6 High · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-682
- [io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries](https://agentprime.io/advisories/CVE-2026-53191.md)
  `CVE-2026-53191` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-682
- [netfilter: xt_policy: fix strict mode inbound policy matching](https://agentprime.io/advisories/CVE-2026-52920.md)
  `CVE-2026-52920` · CVE record: Linux Linux · CVSS 8.3 High · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-682
- [netfilter: nft_inner: Fix IPv6 inner_thoff desync](https://agentprime.io/advisories/CVE-2026-46244.md)
  `CVE-2026-46244` · CVE record: Linux Linux · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jun 2026 · Tags: CWE-682, CWE-823
- [rxrpc: Fix re-decryption of RESPONSE packets](https://agentprime.io/advisories/CVE-2026-45988.md)
  `CVE-2026-45988` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: CWE-682
- [bpf: Preserve id of register in sync_linked_regs()](https://agentprime.io/advisories/CVE-2026-45933.md)
  `CVE-2026-45933` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 27 May 2026 · Tags: CWE-682
- [Bitwise OR of errno values](https://agentprime.io/advisories/CVE-2026-44074.md)
  `CVE-2026-44074` · CVE record: Netatalk Netatalk · CVSS 3.7 Low · Not analysed yet · Published 21 May 2026 · Tags: CWE-682
- [hextoint macro uppercase bug](https://agentprime.io/advisories/CVE-2026-7836.md)
  `CVE-2026-7836` · CVE record: Netatalk Netatalk · CVSS 3.1 Low · Not analysed yet · Published 21 May 2026 · Tags: CWE-682
- [Ledger Bitcoin App 2.1.0 Address Derivation Error via Miniscript](https://agentprime.io/advisories/CVE-2023-7346.md)
  `CVE-2023-7346` · CVE record: Ledger Ledger Bitcoin app · CVSS 4.1 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-682
- [bpf: Properly mark live registers for indirect jumps](https://agentprime.io/advisories/CVE-2026-43321.md)
  `CVE-2026-43321` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 8 May 2026 · Tags: CWE-682
- [Zebra's Block Validator Undercounts Coinbase and P2SH Sigops](https://agentprime.io/advisories/GHSA-jv4h-j224-23cc.md)
  `GHSA-jv4h-j224-23cc`, `CVE-2026-44498` · crates.io `zebrad`: affected `<4.4.0`, fixed in `4.4.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 May 2026 · Tags: CWE-682
- [crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption](https://agentprime.io/advisories/CVE-2026-43033.md)
  `CVE-2026-43033` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 1 May 2026 · Tags: CWE-682
- [bpf: Fix regsafe() for pointers to packet](https://agentprime.io/advisories/CVE-2026-43030.md)
  `CVE-2026-43030` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 1 May 2026 · Tags: CWE-682
- [bpf: Fix incorrect pruning due to atomic fetch precision tracking](https://agentprime.io/advisories/CVE-2026-43009.md)
  `CVE-2026-43009` · CVE record: Linux Linux · CVSS 7.8 High · Not analysed yet · Published 1 May 2026 · Tags: CWE-682
- [libcrux-sha3: Incorrect output from SHAKE squeeze functions](https://agentprime.io/advisories/GHSA-q29p-9pfr-j652.md)
  `GHSA-q29p-9pfr-j652`, `RUSTSEC-2026-0074` · crates.io `libcrux-sha3`: affected `<0.0.8`, fixed in `0.0.8` · CVSS 4.0, no score published · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-682
- [validateSignature Loop Variable Capture Signature Bypass in goxmldsig](https://agentprime.io/advisories/GHSA-479m-364c-43vc.md)
  `GHSA-479m-364c-43vc`, `CVE-2026-33487`, `GO-2026-4753` · Go `github.com/russellhaering/goxmldsig`: affected `<1.6.0`, fixed in `1.6.0` · CVSS 7.5 High · Not analysed yet · Published 18 Mar 2026 · Tags: Weak cryptography or TLS, CWE-682
- [The Graph: Revocable vesting contracts allows early access to locked tokens](https://agentprime.io/advisories/CVE-2026-28410.md)
  `CVE-2026-28410` · CVE record: graphprotocol contracts · CVSS 5.3 Medium · Not analysed yet · Published 5 Mar 2026 · Tags: Broken access control, CWE-682
- [CIRCL has an incorrect calculation in secp384r1 CombinedMult](https://agentprime.io/advisories/GHSA-q9hv-hpm4-hj6x.md)
  `GHSA-q9hv-hpm4-hj6x`, `CVE-2026-1229`, `GO-2026-4550` · Go `github.com/cloudflare/circl`: affected `<1.6.3`, fixed in `1.6.3` · CVSS 2.9 Low · Not analysed yet · Published 25 Feb 2026 · Tags: CWE-682
- [iccDEV memcpy-param-overlap in CIccTagMultiProcessElement::Apply()](https://agentprime.io/advisories/CVE-2026-25634.md)
  `CVE-2026-25634` · CVE record: InternationalColorConsortium iccDEV · CVSS 7.8 High · Not analysed yet · Published 6 Feb 2026 · Tags: Memory corruption, CWE-123, CWE-628, CWE-682
- [ml-dsa's UseHint function has off by two error when r0 equals zero](https://agentprime.io/advisories/GHSA-h37v-hp6w-2pp8.md)
  `GHSA-h37v-hp6w-2pp8` · crates.io `ml-dsa`: affected `<0.1.0-rc.5`, fixed in `0.1.0-rc.5` · CVSS 4.0, no score published · Not analysed yet · Published 2 Feb 2026 · Tags: CWE-193, CWE-682
- [soroban-fixed-point-math has Incorrect Rounding and Overflow Handling in Signed Fixed-Point Math with Negatives](https://agentprime.io/advisories/GHSA-x5m4-43jf-hh65.md)
  `GHSA-x5m4-43jf-hh65`, `CVE-2026-24783` · crates.io `soroban-fixed-point-math`: affected `>=1.3.0, <1.3.1 || >=1.4.0, <1.4.1`, fixed in `1.3.1`, `1.4.1` · CVSS 7.5 High · Not analysed yet · Published 28 Jan 2026 · Tags: CWE-682
- [Junos OS Evolved: Flapping management interface causes MAC learning on label-switched interfaces to stop](https://agentprime.io/advisories/CVE-2026-21911.md)
  `CVE-2026-21911` · CVE record: Juniper Networks Junos OS Evolved · CVSS 7.1 High · Not analysed yet · Published 15 Jan 2026 · Tags: CWE-682
- [Vercel’s AI SDK's filetype whitelists can be bypassed when uploading files](https://agentprime.io/advisories/GHSA-rwvc-j5jr-mgvh.md)
  `GHSA-rwvc-j5jr-mgvh`, `CVE-2025-48985` · npm `ai`: affected `<5.0.52 || >=5.1.0-beta.0, <5.1.0-beta.9`, fixed in `5.0.52`, `5.1.0-beta.9` · CVSS 3.7 Low · Not analysed yet · Published 7 Nov 2025 · Tags: CWE-20, CWE-682
- [pytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together.](https://agentprime.io/advisories/PYSEC-2025-204.md)
  `PYSEC-2025-204`, `BIT-pytorch-2025-55552`, `CVE-2025-55552` · PyPI `torch`: affected `<2.9.0`, fixed in `2.9.0` · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2025 · Tags: CWE-682

Older: <https://agentprime.io/advisories/tag/cwe-682.md?cursor=WyIyMDI1LTA5LTI1VDE2OjE1OjM0LjMyMDAwMFoiLCJQWVNFQy0yMDI1LTIwNCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-682>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-682/>. Everything for agents: <https://agentprime.io/llms.txt>.