# CWE-757.

Every Advisory and CVE whose sources give the weakness CWE-757, newest first.

## Records, newest first

- [In Modem, there is a possible information disclosure due to side channel information disclosure.](https://agentprime.io/advisories/CVE-2026-20578.md)
  `CVE-2026-20578` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 5.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-757
- [rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share](https://agentprime.io/advisories/GHSA-w44r-93j7-qv28.md)
  `GHSA-w44r-93j7-qv28`, `RUSTSEC-2026-0349` · crates.io `rustls`: affected `<0.23.46 || >=0.24.0-dev.1, <0.24.0-dev.2`, fixed in `0.23.46`, `0.24.0-dev.2` · CVSS 3.7 Low · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-757
- [RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET](https://agentprime.io/advisories/CVE-2026-110310.md)
  `CVE-2026-110310` · CVE record: Amazon Amazon.Extensions.S3.Encryption · CVSS 6.0 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-204, CWE-757
- [FreeRDP 3.0.0 before 3.32.0 Security Protocol Downgrade via Negotiation Response](https://agentprime.io/advisories/CVE-2026-109952.md)
  `CVE-2026-109952` · CVE record: FreeRDP FreeRDP · CVSS 6.0 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-757
- [AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext](https://agentprime.io/advisories/GHSA-rqf5-2wxv-rjf4.md)
  `GHSA-rqf5-2wxv-rjf4`, `CVE-2026-107231` · Maven `org.asynchttpclient:async-http-client`: affected `>=3.0.0.Beta1, <3.0.13 || >=2.0.0, <2.16.1`, fixed in `3.0.13`, `2.16.1` · CVSS 8.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: Weak cryptography or TLS, Hard-coded credentials, CWE-757
- [AsyncHttpClient: Digest mutual authentication is switched off by a peer offering qop=auth-int](https://agentprime.io/advisories/CVE-2026-107279.md)
  `CVE-2026-107279` · CVE record: AsyncHttpClient async-http-client · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass, CWE-757
- [Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade](https://agentprime.io/advisories/CVE-2026-102508.md)
  `CVE-2026-102508` · CVE record: Apache Software Foundation Apache PLC4X · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Weak cryptography or TLS, CWE-757
- [Howyar｜WeenyGenius - Use of Insecure Protocol](https://agentprime.io/advisories/CVE-2026-89177.md)
  `CVE-2026-89177` · CVE record: Howyar WeenyGenius · CVSS 8.7 High · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-757
- [SMB minimum protocol dialect defaults to SMB1](https://agentprime.io/advisories/CVE-2026-59293.md)
  `CVE-2026-59293` · CVE record: Spring Spring Integration · CVSS 6.6 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-757
- [Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify](https://agentprime.io/advisories/CVE-2026-72889.md)
  `CVE-2026-72889` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2026 · Tags: Weak cryptography or TLS, CWE-757
- [Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token](https://agentprime.io/advisories/CVE-2026-72887.md)
  `CVE-2026-72887` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Aug 2026 · Tags: CWE-757
- [Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure](https://agentprime.io/advisories/CVE-2026-18691.md)
  `CVE-2026-18691` · CVE record: MongoDB MongoDB Server · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-757
- [TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication](https://agentprime.io/advisories/CVE-2026-55953.md)
  `CVE-2026-55953` · CVE record: Erlang OTP · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jul 2026 · Tags: CWE-757
- [PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms](https://agentprime.io/advisories/GHSA-j92g-9f8w-j867.md)
  `GHSA-j92g-9f8w-j867`, `BIT-postgresql-jdbc-driver-2026-54291`, `CVE-2026-54291` · Maven `org.postgresql:postgresql`: affected `>=42.7.4, <42.7.12`, fixed in `42.7.12` · CVSS 8.2 High · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-636, CWE-757
- [IBM i is Affected by Algorithm Downgrade in Transport Layer Security \[\]](https://agentprime.io/advisories/CVE-2026-4942.md)
  `CVE-2026-4942` · CVE record: IBM i · CVSS 5.9 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-757
- [Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default](https://agentprime.io/advisories/GHSA-9h47-pqcx-hjr4.md)
  `GHSA-9h47-pqcx-hjr4`, `CVE-2026-67336` · npm `better-auth`: affected `<1.6.11`, fixed in `1.6.11` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jul 2026 · Tags: Weak cryptography or TLS, CWE-757, CWE-1188
- [OnGres SCRAM silent channel-binding authentication downgrade via unsupported certificate algorithms](https://agentprime.io/advisories/GHSA-p9jg-fcr6-3mhf.md)
  `GHSA-p9jg-fcr6-3mhf`, `CVE-2026-53712` · Maven `com.ongres.scram:scram-client` and 1 more: affected `<3.3`, fixed in `3.3` · CVSS 8.2 High · Not analysed yet · Published 1 Jul 2026 · Tags: CWE-636, CWE-757
- [Encrypt-then-MAC could fall back to MAC-then-Encrypt when HAVE_ENCRYPT_THEN_MAC is configured](https://agentprime.io/advisories/CVE-2026-6092.md)
  `CVE-2026-6092` · CVE record: wolfSSL wolfSSL · CVSS 2.1 Low · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-757
- [CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass](https://agentprime.io/advisories/GHSA-4v55-cpmv-3vcm.md)
  `GHSA-4v55-cpmv-3vcm`, `CVE-2026-54780` · NuGet `CoreWCF.Primitives`: affected `<1.8.1 || >=1.9.0, <1.9.1`, fixed in `1.8.1`, `1.9.1` · CVSS 3.7 Low · Not analysed yet · Published 19 Jun 2026 · Tags: Weak cryptography or TLS, CWE-757
- [Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade](https://agentprime.io/advisories/GHSA-rrj9-5q2j-4gvr.md)
  `GHSA-rrj9-5q2j-4gvr`, `CVE-2026-48747`, `PKSA-9y9v-rcsm-h82j`, `PKSA-v1cq-8qyb-2p5n` · Packagist `symfony/mailomat-mailer` and 1 more: affected `>=7.2.0, <7.4.13 || >=8.0.0, <8.0.13`, fixed in `7.4.13`, `8.0.13` · CVSS 6.3 Medium · Not analysed yet · Published 15 Jun 2026 · Tags: Weak cryptography or TLS, CWE-757
- [net: TLS 1.2 connections allowed on TLS 1.3 sockets](https://agentprime.io/advisories/CVE-2026-1677.md)
  `CVE-2026-1677` · CVE record: zephyrproject-rtos Zephyr · CVSS 5.3 Medium · Not analysed yet · Published 11 May 2026 · Tags: CWE-757
- [AWS Encryption SDK for Python: Key commitment policy bypass via shared key cache](https://agentprime.io/advisories/GHSA-v638-38fc-rhfv.md)
  `GHSA-v638-38fc-rhfv`, `CVE-2026-6550`, `PYSEC-2026-2387` · PyPI `aws-encryption-sdk`: affected `>=2.0.0, <3.3.1 || >=4.0.0, <4.0.5`, fixed in `3.3.1`, `4.0.5` · CVSS 5.7 Medium · Not analysed yet · Published 24 Apr 2026 · Tags: CWE-757
- [Anviz CrossChex Standard Algorithm Downgrade](https://agentprime.io/advisories/CVE-2026-32650.md)
  `CVE-2026-32650` · CVE record: Anviz Anviz CrossChex Standard · CVSS 7.5 High · Not analysed yet · Published 17 Apr 2026 · Tags: CWE-757
- [OpenSSL TLS 1.3 server may choose unexpected key agreement group](https://agentprime.io/advisories/CVE-2026-2673.md)
  `CVE-2026-2673` · CVE record: OpenSSL OpenSSL · CVSS 6.5 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-757
- [Silicon Labs Z-Wave PIR Sensor Joins Network as Non-Secure](https://agentprime.io/advisories/CVE-2025-10693.md)
  `CVE-2025-10693` · CVE record: silabs.com Silicon Labs Z-Wave SDK · CVSS 7.6 High · Not analysed yet · Published 31 Oct 2025 · Tags: CWE-757
- [psPAS does not enforce TLS 1.2 within Get-PASSAMLResponse](https://agentprime.io/advisories/CVE-2025-59270.md)
  `CVE-2025-59270` · CVE record: pspete psPAS · CVSS 2.3 Low · Not analysed yet · Published 16 Sept 2025 · Tags: CWE-757
- [Dell NetWorker: Dell NetWorker, versions 19.12.0.1 and prior…](https://agentprime.io/advisories/CVE-2025-36582.md)
  `CVE-2025-36582` · CVE record: Dell NetWorker · CVSS 4.8 Medium · Not analysed yet · Published 1 Jul 2025 · Tags: CWE-757
- [Protocol Downgrade in SIMPLE.ERP](https://agentprime.io/advisories/CVE-2024-8773.md)
  `CVE-2024-8773` · CVE record: Simple SA SIMPLE.ERP · CVSS 8.3 High · Not analysed yet · Published 24 Mar 2025 · Tags: CWE-757
- [An out-of-bounds write was addressed with improved input validation.](https://agentprime.io/advisories/CVE-2025-24154.md)
  `CVE-2025-24154` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jan 2025 · Tags: CWE-757
- [Protocol Downgrade in Wapro ERP Desktop](https://agentprime.io/advisories/CVE-2024-4995.md)
  `CVE-2024-4995` · CVE record: Asseco Business Solutions S.A. Wapro ERP Desktop · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Dec 2024 · Tags: Information disclosure, CWE-757
- [An issue in Horizon Business Services Inc.](https://agentprime.io/advisories/CVE-2024-38883.md)
  `CVE-2024-38883` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Aug 2024 · Tags: CWE-757
- [In modem, there is a possible selection of less-secure algorithm during the VoWiFi IKE due to a missing DH downgrade check.](https://agentprime.io/advisories/CVE-2024-20069.md)
  `CVE-2024-20069` · CVE record: MediaTek, Inc. MT6833, MT6853, MT6855, MT6873, MT6875, MT6875T, MT6877, MT6883, MT6885, MT6889, MT6891, MT6893, MT8675, MT8771, MT8791T, MT8797 · CVSS 6.5 Medium · Not analysed yet · Published 3 Jun 2024 · Tags: CWE-757
- [Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers](https://agentprime.io/advisories/GHSA-gr79-9v6v-gc9r.md)
  `GHSA-gr79-9v6v-gc9r`, `CVE-2024-23656`, `GO-2024-2476` · Go `github.com/dexidp/dex`: affected `<0.0.0-20240125115555-5bbdb4420254 || >=2.37.0, <2.38.0`, fixed in `0.0.0-20240125115555-5bbdb4420254`, `2.38.0` · CVSS 7.5 High · Not analysed yet · Published 26 Jan 2024 · Tags: Weak cryptography or TLS, CWE-757
- [IBM Security Directory Suite information disclosure](https://agentprime.io/advisories/CVE-2022-33160.md)
  `CVE-2022-33160` · CVE record: IBM Security Directory Suite · CVSS 3.7 Low · Not analysed yet · Published 6 Oct 2023 · Tags: CWE-757
- [quarkus-core vulnerable to client driven TLS cipher downgrading](https://agentprime.io/advisories/GHSA-3fhx-3vvg-2j84.md)
  `GHSA-3fhx-3vvg-2j84`, `CVE-2023-2974` · Maven `io.quarkus:quarkus-core`: affected `<2.16.8.Final`, fixed in `2.16.8.Final` · CVSS 6.5 Medium · Not analysed yet · Published 4 Jul 2023 · Tags: CWE-757
- [Weak Default SSL use in Port Forwarding Service](https://agentprime.io/advisories/CVE-2022-23000.md)
  `CVE-2022-23000` · CVE record: Western Digital My Cloud · CVSS 7.3 High · Not analysed yet · Published 25 Jul 2022 · Tags: CWE-757
- [Silicon Labs Z-Wave: The Z-Wave specification requires that S2 security can be downgraded to S0 or other less…](https://agentprime.io/advisories/CVE-2018-25029.md)
  `CVE-2018-25029` · CVE record: Silicon Labs Z-Wave · No CVSS score · Not analysed yet · Published 4 Feb 2022 · Tags: CWE-757
- [Dell EMC Streaming Data Platform: Dell EMC Streaming Data Platform, versions prior to 1.3 contain an SSL Strip…](https://agentprime.io/advisories/CVE-2021-36326.md)
  `CVE-2021-36326` · CVE record: Dell Dell EMC Streaming Data Platform · CVSS 6.5 Medium · Not analysed yet · Published 30 Nov 2021 · Tags: CWE-757
- [Philips Clinical Collaboration Platform Algorithm Downgrade](https://agentprime.io/advisories/CVE-2020-16200.md)
  `CVE-2020-16200` · CVE record: Philips Clinical Collaboration Platform · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2020 · Tags: CWE-757
- [Bluetooth devices supporting BR/EDR v5.2 and earlier are vulnerable to impersonation attacks](https://agentprime.io/advisories/CVE-2020-10135.md)
  `CVE-2020-10135` · CVE record: Bluetooth BR/EDR · CVSS 5.4 Medium · Not analysed yet · Published 19 May 2020 · Tags: CWE-757
- [Red Hat wildfly: A flaw was found when an OpenSSL security provider is used with Wildfly…](https://agentprime.io/advisories/CVE-2019-14887.md)
  `CVE-2019-14887` · CVE record: Red Hat wildfly · CVSS 7.4 High · Not analysed yet · Published 16 Mar 2020 · Tags: CWE-757
- [postfix-mta-sts-resolver Algorithm Downgrade vulnerability](https://agentprime.io/advisories/GHSA-h92m-42h4-82f6.md)
  `GHSA-h92m-42h4-82f6`, `CVE-2019-16791`, `PYSEC-2020-174` · PyPI `postfix-mta-sts-resolver`: affected `<0.5.1`, fixed in `0.5.1` · CVSS 6.9 Medium · Not analysed yet · Published 5 Jul 2019 · Tags: CWE-757
- [eDirectory LDAP peer certificate validation issue](https://agentprime.io/advisories/CVE-2017-9267.md)
  `CVE-2017-9267` · CVE record: Novell eDirectory · CVSS 6.5 Medium · Not analysed yet · Published 2 Mar 2018 · Tags: CWE-757
- [lack of keypinning in libzypp could lead to repository switching](https://agentprime.io/advisories/CVE-2017-9269.md)
  `CVE-2017-9269` · CVE record: SUSE libzypp · CVSS 7.7 High · Not analysed yet · Published 1 Mar 2018 · Tags: CWE-757

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-757>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-757/>. Everything for agents: <https://agentprime.io/llms.txt>.