# CWE-909.

Every Advisory and CVE whose sources give the weakness CWE-909, newest first.

## Records, newest first

- [libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserReset](https://agentprime.io/advisories/CVE-2026-113351.md)
  `CVE-2026-113351` · CVE record: libexpat libexpat · CVSS 8.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-909
- [Exim: In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA…](https://agentprime.io/advisories/CVE-2026-40687.md)
  `CVE-2026-40687` · CVE record: Exim Exim · CVSS 4.8 Medium · Not analysed yet · Published 30 Apr 2026 · Tags: CWE-909
- [Account Takeover via Reset Password Functionality in PAD CMS](https://agentprime.io/advisories/CVE-2025-8117.md)
  `CVE-2025-8117` · CVE record: Polska Akademia Dostępności PAD CMS · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2025 · Tags: CWE-909
- [Moby firewalld reload removes bridge network isolation](https://agentprime.io/advisories/GHSA-4vq8-7jfc-9cvp.md)
  `GHSA-4vq8-7jfc-9cvp`, `CVE-2025-54410`, `GO-2025-3829` · Go `github.com/docker/docker`: affected `<25.0.13 || >=26.0.0-rc1, <28.0.0`, fixed in `25.0.13`, `28.0.0` · CVSS 3.3 Low · Not analysed yet · Published 29 Jul 2025 · Tags: CWE-909
- [Moby firewalld reload makes published container ports accessible from remote hosts](https://agentprime.io/advisories/GHSA-x4rx-4gw3-53p4.md)
  `GHSA-x4rx-4gw3-53p4`, `CVE-2025-54388`, `GO-2025-3830` · Go `github.com/docker/docker`: affected `>=28.2.0, <28.3.3`, fixed in `28.3.3` · CVSS 5.1 Medium · Not analysed yet · Published 29 Jul 2025 · Tags: CWE-909
- [Teradata Vantage Editor 1.0.1 is mostly intended for SQL database access and docs.teradata.com access, but provides unintended functionality (including Chromium Developer Tools) that can result in a…](https://agentprime.io/advisories/CVE-2024-52870.md)
  `CVE-2024-52870` · CVE record · CVSS 7.1 High · Not analysed yet · Published 17 Jan 2025 · Tags: CWE-909
- [AES/CBC Constant IV Vulnerability in ESPTouch v2](https://agentprime.io/advisories/CVE-2024-53845.md)
  `CVE-2024-53845` · CVE record: espressif esp-idf · CVSS 6.6 Medium · Not analysed yet · Published 11 Dec 2024 · Tags: Weak cryptography or TLS, CWE-909
- [Multiple issues in ctl(4) CAM Target Layer](https://agentprime.io/advisories/CVE-2024-8178.md)
  `CVE-2024-8178` · CVE record: FreeBSD FreeBSD · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2024 · Tags: Memory corruption, CWE-909
- [LaTeX post content manipulation via renderer state leak across contexts](https://agentprime.io/advisories/CVE-2024-32945.md)
  `CVE-2024-32945` · CVE record: Mattermost Mattermost · CVSS 2.6 Low · Not analysed yet · Published 15 Jul 2024 · Tags: CWE-909
- [ospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) through 9.1 allows remote attackers to cause a denial of service (ospfd daemon crash) via a malformed OSPF LSA packet, because of an attempted a…](https://agentprime.io/advisories/CVE-2024-27913.md)
  `CVE-2024-27913` · CVE record · CVSS 6.2 Medium · Not analysed yet · Published 28 Feb 2024 · Tags: CWE-909
- [A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer).](https://agentprime.io/advisories/CVE-2022-0175.md)
  `CVE-2022-0175` · CVE record: virglrenderer · No CVSS score · Not analysed yet · Published 26 Aug 2022 · Tags: CWE-909
- [Missing Initialization of Resource in Apache Arrow](https://agentprime.io/advisories/GHSA-cjw4-2w9r-r8mv.md)
  `GHSA-cjw4-2w9r-r8mv`, `CVE-2019-12410`, `PYSEC-2019-196` · PyPI `pyarrow` and 1 more: affected `>=0.12.0, <0.15.1`, fixed in `0.15.1` · CVSS 7.5 High · Not analysed yet · Published 24 May 2022 · Tags: CWE-909
- [kernel: An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC…](https://agentprime.io/advisories/CVE-2022-0382.md)
  `CVE-2022-0382` · CVE record: kernel · No CVSS score · Not analysed yet · Published 11 Feb 2022 · Tags: CWE-909
- [Missing Initialization of Resource in pnet](https://agentprime.io/advisories/GHSA-24g6-5rx7-58wj.md)
  `GHSA-24g6-5rx7-58wj`, `CVE-2019-25054`, `GHSA-r6ff-2q3c-v3pv`, `RUSTSEC-2019-0037` · crates.io `pnet`: affected `<0.27.2`, fixed in `0.27.2` · CVSS 7.5 High · Not analysed yet · Published 6 Jan 2022 · Tags: CWE-909
- [Memory corruption in array-tools](https://agentprime.io/advisories/GHSA-6wp2-fw3v-mfmc.md)
  `GHSA-6wp2-fw3v-mfmc`, `CVE-2020-36452`, `RUSTSEC-2020-0132` · crates.io `array-tools`: affected `<0.3.2`, fixed in `0.3.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2021 · Tags: Memory corruption, CWE-909
- [A vulnerability was found in the Linux kernel in versions prior to v5.14-rc1.](https://agentprime.io/advisories/CVE-2021-3655.md)
  `CVE-2021-3655` · CVE record: kernel · No CVSS score · Not analysed yet · Published 5 Aug 2021 · Tags: CWE-909
- [The Eclipse Foundation Eclipse OpenJ9: In Eclipse Openj9 to version 0.25.0, usage of the jdk.internal.reflect.ConstantPool API…](https://agentprime.io/advisories/CVE-2021-28167.md)
  `CVE-2021-28167` · CVE record: The Eclipse Foundation Eclipse OpenJ9 · No CVSS score · Not analysed yet · Published 21 Apr 2021 · Tags: CWE-909
- [Phoenix Contact mGuard Devices versions before 8.8.3: LAN ports get functional after reboot even if they are disabled in the device configuration](https://agentprime.io/advisories/CVE-2020-12523.md)
  `CVE-2020-12523` · CVE record: Phoenix Contact TC MGUARD RS4000 4G VZW VPN (1010461) and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 17 Dec 2020 · Tags: CWE-909
- [\[UNKNOWN\] cockpit: It was found that cockpit before version 184 used glib's base64 decode functionality…](https://agentprime.io/advisories/CVE-2019-3804.md)
  `CVE-2019-3804` · CVE record: \[UNKNOWN\] cockpit · CVSS 7.5 High · Not analysed yet · Published 26 Mar 2019 · Tags: CWE-909

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-909>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-909/>. Everything for agents: <https://agentprime.io/llms.txt>.