# CWE-790.

Every Advisory and CVE whose sources give the weakness CWE-790, newest first.

## Records, newest first

- [Potential wildcard CNAME RPZ policy bypass](https://agentprime.io/advisories/CVE-2026-11331.md)
  `CVE-2026-11331` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-790
- [Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths](https://agentprime.io/advisories/CVE-2026-9658.md)
  `CVE-2026-9658` · CVE record: RRWO Plack::Middleware::Security::Common · CVSS 7.3 High · Not analysed yet · Published 28 May 2026 · Tags: Other injection, CWE-790
- [Backend Access Due to Insufficient Input Validation](https://agentprime.io/advisories/CVE-2026-2328.md)
  `CVE-2026-2328` · CVE record: WAGO Device Sphere and 1 more · CVSS 7.5 High · Not analysed yet · Published 30 Mar 2026 · Tags: CWE-790
- [Ericsson Indoor Connect 8855 - Improper Filtering of Special Elements Vulnerability](https://agentprime.io/advisories/CVE-2025-27260.md)
  `CVE-2025-27260` · CVE record: Ericsson Indoor Connect 8855 · CVSS 7.2 High · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-790
- [Jail chroot escape via fd exchange with a different jail](https://agentprime.io/advisories/CVE-2025-15576.md)
  `CVE-2025-15576` · CVE record: FreeBSD FreeBSD · CVSS 7.5 High · Not analysed yet · Published 9 Mar 2026 · Tags: Privilege escalation, CWE-488, CWE-790
- [Enterprise Protection Backslash URL Rewrite Bypass](https://agentprime.io/advisories/CVE-2025-0431.md)
  `CVE-2025-0431` · CVE record: Proofpoint Enterprise Protection · CVSS 5.8 Medium · Not analysed yet · Published 19 Mar 2025 · Tags: CWE-790
- [Dell RecoverPoint for Virtual Machines 6.0.x contains Denial of Service vulnerability.](https://agentprime.io/advisories/CVE-2024-47984.md)
  `CVE-2024-47984` · CVE record: Dell RecoverPoint for Virtual Machines · CVSS 4.4 Medium · Not analysed yet · Published 13 Dec 2024 · Tags: CWE-790
- [Multiple issues in ctl(4) CAM Target Layer](https://agentprime.io/advisories/CVE-2024-42416.md)
  `CVE-2024-42416` · CVE record: FreeBSD FreeBSD · CVSS 8.4 High · Not analysed yet · Published 5 Sept 2024 · Tags: CWE-790, CWE-823
- [Stored XSS in process management](https://agentprime.io/advisories/CVE-2024-43443.md)
  `CVE-2024-43443` · CVE record: OTRS AG OTRS and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 26 Aug 2024 · Tags: CWE-790
- [Stored XSS in System Configuration](https://agentprime.io/advisories/CVE-2024-43442.md)
  `CVE-2024-43442` · CVE record: OTRS AG OTRS and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 26 Aug 2024 · Tags: Cross-site scripting (XSS), CWE-790
- [Information exlosure in external interface](https://agentprime.io/advisories/CVE-2024-6540.md)
  `CVE-2024-6540` · CVE record: OTRS AG OTRS · CVSS 5.7 Medium · Not analysed yet · Published 15 Jul 2024 · Tags: CWE-790
- [An issue discovered in RG-RSR10-01G-T(W)-S and RG-RSR10-01G-T(WA)-S routers with firmware version RSR10-01G-T-S_RSR_3.0(1)B9P2, Release(07150910) allows attackers to execute arbitrary code via the co…](https://agentprime.io/advisories/CVE-2024-31616.md)
  `CVE-2024-31616` · CVE record · CVSS 8.8 High · Not analysed yet · Published 23 Apr 2024 · Tags: CWE-790
- [Meta tac_plus: A lack of input validation exists in tac_plus prior to commit 4fdf178 which…](https://agentprime.io/advisories/CVE-2023-45239.md)
  `CVE-2023-45239` · CVE record: Meta tac_plus · No CVSS score · Not analysed yet · Published 6 Oct 2023 · Tags: CWE-790
- [Sequelize - Default support for “raw attributes” when using parentheses](https://agentprime.io/advisories/GHSA-f598-mfpv-gmfx.md)
  `GHSA-f598-mfpv-gmfx`, `CVE-2023-22578` · npm `sequelize` and 1 more: affected `<6.29.0`, fixed in `6.29.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2023 · Tags: CWE-790
- [Duplicate advisory: Sequelize vulnerable to Improper Filtering of Special Elements](https://agentprime.io/advisories/GHSA-8mwq-mj73-qv68.md)
  `GHSA-8mwq-mj73-qv68` · npm `sequelize` and 1 more: affected `<6.29.0`, fixed in `6.29.0` · CVSS 10.0 Critical · Withdrawn · Not analysed yet · Published 16 Feb 2023 · Tags: CWE-790
- [Admin privilege escalation and arbitrary code execution via malicious \*.etherpad imports](https://agentprime.io/advisories/CVE-2021-43802.md)
  `CVE-2021-43802` · CVE record: ether etherpad-lite · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Dec 2021 · Tags: CWE-790, CWE-1287

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-790>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-790/>. Everything for agents: <https://agentprime.io/llms.txt>.