# CWE-704.

Every Advisory and CVE whose sources give the weakness CWE-704, newest first.

## Records, newest first

- [Kyverno before 1.19.2 Denial of Service via In/NotIn Operator Panic](https://agentprime.io/advisories/CVE-2026-122319.md)
  `CVE-2026-122319` · CVE record: kyverno kyverno · CVSS 8.7 High · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-704
- [arbitrary read/write via grant copy](https://agentprime.io/advisories/CVE-2026-102703.md)
  `CVE-2026-102703` · CVE record: Xen Xen · CVSS 4.4 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-704
- [spatie url-signer URL Validation AbstractUrlSigner.php validate type conversion](https://agentprime.io/advisories/CVE-2026-121589.md)
  `CVE-2026-121589` · CVE record: spatie url-signer · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-704
- [phpMyAdmin SQL-Parser ExplainStatement.php parse type conversion](https://agentprime.io/advisories/CVE-2026-121262.md)
  `CVE-2026-121262` · CVE record: phpMyAdmin SQL-Parser · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-704
- [qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)](https://agentprime.io/advisories/GHSA-6pq8-jhm2-2vcw.md)
  `GHSA-6pq8-jhm2-2vcw`, `CVE-2026-110816` · npm `qs`: affected `>=6.7.0, <6.16.1`, fixed in `6.16.1` · CVSS 6.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-248, CWE-704
- [beam_mcp: JSON boolean and null tool arguments reach dispatch as strings](https://agentprime.io/advisories/GHSA-wv7p-j6qh-3hj4.md)
  `GHSA-wv7p-j6qh-3hj4`, `CVE-2026-104634`, `EEF-CVE-2026-104634` · Hex `beam_mcp`: affected `>=0.1.0, <0.10.1`, fixed in `0.10.1` · CVSS 2.3 Low · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-704
- [vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features](https://agentprime.io/advisories/GHSA-ph72-cqr5-qpp7.md)
  `GHSA-ph72-cqr5-qpp7`, `CVE-2026-105754`, `PYSEC-2026-4309` · PyPI `vllm`: affected `<0.30.0`, fixed in `0.30.0` · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Denial of service, Broken access control, Information disclosure, CWE-20
- [Zebra before 6.3.0 Peer Misbehavior Ban Bypass via Gossiped Blocks](https://agentprime.io/advisories/CVE-2026-104420.md)
  `CVE-2026-104420` · CVE record: ZcashFoundation zebra · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-704
- [Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software IKEv2 Certificate Authentication Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-20249.md)
  `CVE-2026-20249` · CVE record: Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and 1 more · CVSS 8.6 High · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-704
- [MS Calendar plugin: unrecovered handler panics from malformed post-action requests could crash the plugin process](https://agentprime.io/advisories/CVE-2026-86348.md)
  `CVE-2026-86348` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-704
- [Incorrect type conversion in Google Chrome](https://agentprime.io/advisories/CVE-2026-87546.md)
  `CVE-2026-87546` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-704
- [Incorrect type conversion in Google Android](https://agentprime.io/advisories/CVE-2026-58822.md)
  `CVE-2026-58822` · CVE record: Google Android · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-704
- [Incorrect type conversion in Google Android](https://agentprime.io/advisories/CVE-2026-28609.md)
  `CVE-2026-28609` · CVE record: Google Android · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-704
- [Microsoft Windows Search Component Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69585.md)
  `CVE-2026-69585` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-704
- [iccDEV: CIccEmbedIO::Read8() size_t underflow](https://agentprime.io/advisories/CVE-2026-50278.md)
  `CVE-2026-50278` · CVE record: InternationalColorConsortium iccDEV · CVSS 6.5 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Memory corruption, CWE-704
- [Boards plugin panics on WebSocket command with non-string field types](https://agentprime.io/advisories/CVE-2026-10080.md)
  `CVE-2026-10080` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-704
- [User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter](https://agentprime.io/advisories/CVE-2026-15826.md)
  `CVE-2026-15826` · CVE record: cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Aug 2026 · Tags: CWE-704
- [rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping](https://agentprime.io/advisories/CVE-2026-53798.md)
  `CVE-2026-53798` · CVE record: RsyncProject rsync · CVSS 6.9 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-704
- [Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid](https://agentprime.io/advisories/CVE-2026-18675.md)
  `CVE-2026-18675` · CVE record: Kong Inc. Kong Mesh · CVSS 5.3 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: CWE-248, CWE-704
- [An information leakage vulnerability in the TCG TPM 2.0 reference code.](https://agentprime.io/advisories/CVE-2026-6726.md)
  `CVE-2026-6726` · CVE record: Trusted Computing Group TPM2.0 · CVSS 7.9 High · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-704
- [Russh: client wrong-length X25519 \`clone_from_slice\` panic (pre-auth DoS)](https://agentprime.io/advisories/GHSA-g9hv-x236-4qp3.md)
  `GHSA-g9hv-x236-4qp3`, `CVE-2026-73429` · crates.io `russh`: affected `<0.62.4`, fixed in `0.62.4` · CVSS 5.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: CWE-704, CWE-754
- [node-tar: Process crash via PAX numeric path type confusion](https://agentprime.io/advisories/GHSA-w8wr-v893-vjvp.md)
  `GHSA-w8wr-v893-vjvp`, `CVE-2026-59871` · npm `tar`: affected `<7.5.18`, fixed in `7.5.18` · CVSS 5.3 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-704
- [An issue was discovered in RISC-V PicoRV32 commit 87c89a.](https://agentprime.io/advisories/CVE-2025-51678.md)
  `CVE-2025-51678` · CVE record · CVSS 7.5 High · Not analysed yet · Published 17 Jul 2026 · Tags: Memory corruption, CWE-704
- [Windows Notification Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-50337.md)
  `CVE-2026-50337` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-704
- [Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking](https://agentprime.io/advisories/GHSA-75vm-6w67-gwvp.md)
  `GHSA-75vm-6w67-gwvp`, `CVE-2026-55076`, `GO-2026-5907` · Go `github.com/coder/coder/v2`: affected `<2.29.17 || >=2.30.0, <2.32.7 || >=2.33.0, <2.33.8 || >=2.34.0, <2.34.2`, fixed in `2.29.17`, `2.32.7`, `2.33.8`, `2.34.2` · CVSS 7.4 High · Not analysed yet · Published 6 Jul 2026 · Tags: Authentication bypass, CWE-704
- [Unchecked enum cast vulnerability in NI grpc-device in BeginSidebandStream](https://agentprime.io/advisories/CVE-2026-48140.md)
  `CVE-2026-48140` · CVE record: NI grpc-device and 1 more · CVSS 7.1 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-704
- [unbounded-spsc: Sender::send pointer-as-value transmute causes OOB read and fake-Arc drop under TX/RX race](https://agentprime.io/advisories/GHSA-6m57-8r3p-pqx6.md)
  `GHSA-6m57-8r3p-pqx6`, `CVE-2026-46690` · crates.io `unbounded-spsc`: affected `<=0.2.0`, no fixed version yet · CVSS 5.8 Medium · Not analysed yet · Published 29 May 2026 · Tags: Memory corruption, CWE-704
- [Ledger Live hw-app-eth EIP-712 Message Parsing Integer Truncation](https://agentprime.io/advisories/CVE-2023-7345.md)
  `CVE-2023-7345` · CVE record: Ledger ledgerhq/hw-app-eth and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 19 May 2026 · Tags: CWE-704
- [OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages](https://agentprime.io/advisories/GHSA-j8p6-96vp-f3r9.md)
  `GHSA-j8p6-96vp-f3r9`, `CVE-2026-45685`, `GO-2026-5456` · Go `go.opentelemetry.io/obi`: affected `<0.9.0`, fixed in `0.9.0` · CVSS 7.5 High · Not analysed yet · Published 18 May 2026 · Tags: CWE-20, CWE-248, CWE-704
- [free5GC's UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)](https://agentprime.io/advisories/GHSA-jqfc-gwj5-3w63.md)
  `GHSA-jqfc-gwj5-3w63`, `CVE-2026-44324`, `GO-2026-5478` · Go `github.com/free5gc/udr`: affected `<1.4.3`, fixed in `1.4.3` · CVSS 6.5 Medium · Not analysed yet · Published 8 May 2026 · Tags: CWE-704, CWE-754
- [vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters](https://agentprime.io/advisories/GHSA-83vm-p52w-f9pw.md)
  `GHSA-83vm-p52w-f9pw`, `CVE-2026-44223`, `PYSEC-2026-145` · PyPI `vllm`: affected `>=0.18.0, <0.20.0`, fixed in `0.20.0` · CVSS 6.5 Medium · Not analysed yet · Published 6 May 2026 · Tags: Memory corruption, CWE-704
- [apko \`DiscoverKeys\` has a panic on non-rsa jwks key that causes crash during key discovery](https://agentprime.io/advisories/GHSA-m7hm-vm4x-28jf.md)
  `GHSA-m7hm-vm4x-28jf`, `CVE-2026-42576`, `GO-2026-5497` · Go `chainguard.dev/apko`: affected `<1.2.7`, fixed in `1.2.7` · CVSS 6.5 Medium · Not analysed yet · Published 4 May 2026 · Tags: CWE-704
- [Coturn: Misaligned Memory Access in coturn STUN Attribute Parser (Remote DoS on ARM64)](https://agentprime.io/advisories/CVE-2026-40613.md)
  `CVE-2026-40613` · CVE record: coturn coturn · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-704
- [OpenEXR has a misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)](https://agentprime.io/advisories/CVE-2026-34379.md)
  `CVE-2026-34379` · CVE record: AcademySoftwareFoundation openexr · CVSS 7.1 High · Not analysed yet · Published 6 Apr 2026 · Tags: Memory corruption, CWE-475, CWE-704
- [Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact](https://agentprime.io/advisories/CVE-2021-4456.md)
  `CVE-2021-4456` · CVE record: MRSAM Net::CIDR · CVSS 6.5 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: CWE-704
- [psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps](https://agentprime.io/advisories/GHSA-24p2-j2jr-386w.md)
  `GHSA-24p2-j2jr-386w`, `CVE-2026-27809`, `PYSEC-2026-2262` · PyPI `psd-tools`: affected `<1.12.2`, fixed in `1.12.2` · CVSS 6.8 Medium · Not analysed yet · Published 26 Feb 2026 · Tags: Memory corruption, Denial of service, CWE-409, CWE-704
- [SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-40541.md)
  `CVE-2025-40541` · CVE record: SolarWinds Serv-U · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: CWE-704
- [SolarWinds Serv-U Type Confusion Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-40540.md)
  `CVE-2025-40540` · CVE record: SolarWinds Serv-U · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: CWE-704
- [SolarWinds Serv-U Type Confusion Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-40539.md)
  `CVE-2025-40539` · CVE record: SolarWinds Serv-U · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: CWE-704
- [An unsafe cast in the MongoDB query planner can result in a segmentation fault.](https://agentprime.io/advisories/CVE-2026-25613.md)
  `CVE-2026-25613` · CVE record: MongoDB Inc MongoDB Server · CVSS 7.1 High · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-704
- [iccDEV Has Type Confusion in CIccTagEmbeddedHeightImage::Validate()](https://agentprime.io/advisories/CVE-2026-25503.md)
  `CVE-2026-25503` · CVE record: InternationalColorConsortium iccDEV · CVSS 7.1 High · Not analysed yet · Published 3 Feb 2026 · Tags: Memory corruption, CWE-704
- [cert-manager-controller DoS via Specially Crafted DNS Response](https://agentprime.io/advisories/GHSA-gx3x-vq4p-mhhv.md)
  `GHSA-gx3x-vq4p-mhhv`, `BIT-cert-manager-2026-25518`, `CVE-2026-25518`, `GO-2026-4399` · Go `github.com/cert-manager/cert-manager`: affected `>=1.18.0, <1.18.5 || >=1.19.0, <1.19.3`, fixed in `1.18.5`, `1.19.3` · CVSS 5.9 Medium · Not analysed yet · Published 2 Feb 2026 · Tags: CWE-129, CWE-704
- [iccDEV has UB runtime error in \<icTagTypeSignature>](https://agentprime.io/advisories/CVE-2026-24856.md)
  `CVE-2026-24856` · CVE record: InternationalColorConsortium iccDEV · CVSS 7.8 High · Not analysed yet · Published 28 Jan 2026 · Tags: CWE-20, CWE-681, CWE-704
- [A floating-point exception (FPE) in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.](https://agentprime.io/advisories/CVE-2025-71002.md)
  `CVE-2025-71002` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: Denial of service, CWE-681, CWE-704
- [base64.b64decode() always accepts "+/" characters, despite setting altchars](https://agentprime.io/advisories/CVE-2025-12781.md)
  `CVE-2025-12781` · CVE record: Python Software Foundation CPython · CVSS 6.3 Medium · Not analysed yet · Published 21 Jan 2026 · Tags: CWE-704
- [iccDEV has Type Confusion in ToXmlCurve() at IccXML/IccLibXML/IccMpeXml.cpp](https://agentprime.io/advisories/CVE-2026-21692.md)
  `CVE-2026-21692` · CVE record: InternationalColorConsortium iccDEV · CVSS 8.8 High · Not analysed yet · Published 7 Jan 2026 · Tags: Memory corruption, CWE-20, CWE-588, CWE-704
- [loggingredactor converts non-string types to string types in logs](https://agentprime.io/advisories/GHSA-rvjx-cfjh-5mc9.md)
  `GHSA-rvjx-cfjh-5mc9`, `CVE-2026-22041`, `PYSEC-2026-1582` · PyPI `loggingredactor`: affected `<0.0.6`, fixed in `0.0.6` · CVSS 2.0 Low · Not analysed yet · Published 7 Jan 2026 · Tags: CWE-704
- [iccDEV has Integer Overflow/Underflow in CIccXmlArrayType::ParseTextCountNum()](https://agentprime.io/advisories/CVE-2026-21673.md)
  `CVE-2026-21673` · CVE record: InternationalColorConsortium iccDEV · CVSS 7.8 High · Not analysed yet · Published 6 Jan 2026 · Tags: Memory corruption, CWE-681, CWE-704
- [Incorrect type conversion in Google Chrome](https://agentprime.io/advisories/CVE-2025-13720.md)
  `CVE-2025-13720` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 2 Dec 2025 · Tags: CWE-704
- [Type confusion in string addition in QuickJS](https://agentprime.io/advisories/CVE-2025-62494.md)
  `CVE-2025-62494` · CVE record: QuickJS QuickJS · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2025 · Tags: CWE-704
- [Vermillion FTP <= 1.31 Daemon PORT Command Memory Corruption](https://agentprime.io/advisories/CVE-2010-20115.md)
  `CVE-2010-20115` · CVE record: Arcane Software Vermillion FTP Daemon · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2025 · Tags: Memory corruption, CWE-704
- [Polkadot Frontier's constructing smart contract can bypass precompile address bounding](https://agentprime.io/advisories/CVE-2025-54429.md)
  `CVE-2025-54429` · CVE record: polkadot-evm frontier · CVSS 6.9 Medium · Not analysed yet · Published 28 Jul 2025 · Tags: CWE-704
- [Pilz: Authentication Bypass in IndustrialPI Webstatus](https://agentprime.io/advisories/CVE-2025-41648.md)
  `CVE-2025-41648` · CVE record: Pilz IndustrialPI 4 with IndustrialPI webstatus · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2025 · Tags: CWE-704
- [RevPi Webstatus application is vulnerable to an authentication bypass](https://agentprime.io/advisories/CVE-2025-41646.md)
  `CVE-2025-41646` · CVE record: Kunbus Revolution Pi webstatus · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.51 · Not analysed yet · Published 6 Jun 2025 · Tags: CWE-704
- [bpf: Fix wrong reg type conversion in release_reference()](https://agentprime.io/advisories/CVE-2022-49873.md)
  `CVE-2022-49873` · CVE record: Linux Linux · CVSS 5.5 Medium · Not analysed yet · Published 1 May 2025 · Tags: CWE-704
- [Incorrect Type Conversion or Cast in Multimedia Frameworks](https://agentprime.io/advisories/CVE-2024-43058.md)
  `CVE-2024-43058` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.8 High · Not analysed yet · Published 7 Apr 2025 · Tags: CWE-704
- [Keylime registrar is vulnerable to Denial-of-Service attack when updated to version 7.12.0](https://agentprime.io/advisories/GHSA-9jxq-5x44-gx23.md)
  `GHSA-9jxq-5x44-gx23`, `CVE-2025-1057`, `PYSEC-2026-1488` · PyPI `keylime`: affected `>=7.12.0, <7.12.1`, fixed in `7.12.1` · CVSS 4.3 Medium · Not analysed yet · Published 14 Feb 2025 · Tags: CWE-704, CWE-1287
- [Mobile crash via improper validation of proto style in attachments](https://agentprime.io/advisories/CVE-2025-20072.md)
  `CVE-2025-20072` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 16 Jan 2025 · Tags: CWE-704
- [Mattermost Incorrect Type Conversion or Cast](https://agentprime.io/advisories/GHSA-8j3q-gc9x-7972.md)
  `GHSA-8j3q-gc9x-7972`, `CVE-2025-21088`, `GO-2025-3393` · Go `github.com/mattermost/mattermost/server/v8`: affected `<8.0.0-20241127161322-25ff7a3779a5 || >=9.11.0, <9.11.6 || >=10.0.0, <10.0.4 || >=10.1.0, <10.1.4 || >=10.2.0, <10.2.1`, fixed in `8.0.0-20241127161322-25ff7a3779a5`, `9.11.6`, `10.0.4`, `10.1.4`, `10.2.1` · CVSS 6.5 Medium · Not analysed yet · Published 15 Jan 2025 · Tags: CWE-704
- [Unaligned memory access in RPL option processing in Contiki-NG](https://agentprime.io/advisories/CVE-2024-47181.md)
  `CVE-2024-47181` · CVE record: contiki-ng contiki-ng · CVSS 7.5 High · Not analysed yet · Published 27 Nov 2024 · Tags: CWE-704

Older: <https://agentprime.io/advisories/tag/cwe-704.md?cursor=WyIyMDI0LTExLTI3VDE4OjIwOjQxLjU4MzAwMFoiLCJDVkUtMjAyNC00NzE4MSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-704>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-704/>. Everything for agents: <https://agentprime.io/llms.txt>.