CWE-459 vulnerabilities

CVE-2026-120806 is a vulnerability in MongoDB Server affecting versions 7.0.0 through 7.0.47, 8.0.0 through 8.0.36, 8.3.0 through 8.3.15, and 9.0.0 through 9.0.6. It involves incomplete cleanup of role authorization data when roles are dropped, causing stale references to persist in user and role documents. This can lead to users silently inheriting privileges from newly created roles with the same name without explicit grants or audit events. Exploitation requires authenticated administrative access to the database. The issue is fixed in versions 7.0.48, 8.0.37, 8.3.16, and 9.0.7.

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.5 through 0.40.8, `nvm_download_artifact` downloads a release archive directly to its final path in `$NVM_DIR/.cache` and verifies its checksum afterwards; on a checksum mismatch it reports an error but leaves the rejected archive in place. A later `nvm install --offline` of the same version installs that cached file without a checksum, so an archive that was just rejected gets installed and its `node` and `npm` run. This gives code execution to a party who can alter the downloaded tarball (for example a poisoned CDN or cache object) but cannot also forge the `SHASUMS256.txt` beside it, if the victim runs `nvm install --offline` for that version after the visible "Checksums do not match" failure and before any online retry. Version 0.41.0 only puts an archive in the cache once its checksum has passed.

HTTP::Body versions before 1.23_01 for Perl have a vulnerability where temporary files from incomplete multipart uploads are not cleaned up. This occurs because the multipart parser only adds temporary files to the upload list upon completion of the file part, so incomplete uploads leave orphaned temporary files on disk. An attacker can exploit this by sending repeated incomplete upload requests, causing disk space exhaustion.

obsidian-tc versions from 1.0.1 up to but not including 1.31.4 have an incomplete cleanup vulnerability where certain entity lifecycle operations can overwrite or corrupt vault notes due to inconsistent handling of note ownership and filesystem failures. This can lead to unintended destruction or overwriting of note content outside the intended entity. The issue is fixed in version 1.31.4.

ApostropheCMS versions prior to 4.33.0 contain an uncontrolled resource consumption vulnerability in the unauthenticated Rich Text CSV conversion route. This route writes multipart uploads to the system temporary directory before validating the file extension and does not remove rejected files. Attackers can exploit this by repeatedly uploading large invalid files, consuming disk space and potentially disrupting ApostropheCMS and other services sharing the same disk partition. The issue is fixed in version 4.33.0.

CVE-2026-93446 is an incomplete cleanup vulnerability in Apache Tomcat that can cause TLS 1.3 connections to fail intermittently. The issue affects multiple versions of Apache Tomcat and has been fixed in later releases. Users should upgrade to the fixed versions to resolve the problem.

An incomplete cleanup vulnerability in Apache Tomcat allows trailer information from a previous request to leak into a subsequent request. This affects multiple versions of Apache Tomcat and has been fixed in later releases.

@fastify/oauth2 versions 7.2.0 through 8.3.1 contain a Cross-Site Request Forgery (CSRF) vulnerability due to inconsistent cookie Path attributes for state and code-verifier cookies during OAuth2 login flows. This inconsistency allows the state cookie to persist beyond the OAuth callback, violating the single-use guarantee. An attacker who learns a valid state value can perform login CSRF by forcing the victim's browser to sign into the attacker’s account. The issue is fixed in version 8.3.2.

MISP versions up to 2.5.48 contain a data integrity vulnerability in the event deletion process. When an event is deleted by an authenticated user with sufficient privileges, several associated records such as report tags, graph entries, correlations, ssdeep chunks, and attachment scan results are not removed, resulting in orphaned database entries. These residual records may retain sensitive threat intelligence data and could be exposed through other application queries or administrative interfaces. This flaw leads to unintended data retention and potential information exposure, as well as possible storage bloat over time.

CVE-2026-17525 is an incomplete cleanup vulnerability in ABB My Control System versions 26.4 and 26.5. The vulnerability does not impact confidentiality or integrity but can cause availability issues. It has a medium severity rating with a CVSS score of 5.2. No patch or remediation information is provided.

CVE-2026-102030 is an Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved. It allows a configured MVPN neighbor to cause a denial of service via a BGP MVPN update when an inter-region segmented VRF with 'protocols mvpn inter-region-template' is configured. This vulnerability has a high severity with a CVSS score of 7.5 and affects multiple versions of Junos OS and Junos OS Evolved as specified.

Misskey, an open source federated social media platform, has a vulnerability in versions from 12.0.0 through 13.14.2, from 2023.9.0-beta.1 up to but not including 2025.4.1, and from 2025.5.0 up to but not including 2026.7.0. The issue involves incomplete cleanup during file uploads, which can lead to exhaustion of storage or file descriptors, causing a denial of service. This vulnerability is fixed in version 2026.7.0.

A vulnerability in the codefori vscode-ibmi Visual Studio Code extension prior to version 3.0.1 allows insecure handling of temporary files. Specifically, Object Browser downloads and edit-save flow content are stored in the shared /tmp directory without reliable cleanup, potentially exposing file contents to other local users on the system. This issue is resolved in version 3.0.1.

ImageMagick versions before 6.9.13-57 and 7.x before 7.1.2-32 have an incomplete cleanup vulnerability in the JNG image decoder. This flaw causes temporary files created during processing of crafted JNG files to not be properly removed, leading to disk space consumption and potential degradation of system availability.

VeraCrypt 1.26.29 (FUSE-T build) on macOS has an incomplete cleanup vulnerability where the FUSE-T auxiliary service and related helper processes are not terminated after volume dismount. This causes the decrypted volume image to remain accessible via a loopback SMB session, allowing local users or processes to remount and access decrypted data without the passphrase. The macFUSE build is not affected.

Backdrop CMS versions 1.34 before 1.34.5 and 1.35 before 1.35.1 have a vulnerability where configuration export archives are not properly cleaned up after creation. This can lead to multiple configuration archive files persisting on the system. The vulnerability requires that the export operation was previously requested by a user with the 'Synchronize, import, and export configuration' permission. A related issue allows remote anonymous access to one specific archive filename, but this is separate from the main incomplete cleanup flaw.

Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files. To mitigate this issue, users should upgrade to version 4.10.0 or later.

Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packets. This issue was fixed in commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa in version 2026.07.

CVE-2026-78437 is an incomplete cleanup vulnerability in Apache Tomcat that may cause one user's request to fail due to a malformed request from another user, depending on timing. It affects Apache Tomcat versions 9.0.116 through 9.0.121, 10.1.53 through 10.1.59, and 11.0.19 through 11.0.25. The issue is fixed in versions 9.0.122, 10.1.60, and 11.0.26.

CVE-2026-75945 is a low-severity vulnerability in Arista Networks EOS where a race condition may cause a supplicant to remain authorized after the 'clear dot1x host all' command is issued. This incomplete cleanup issue could lead to a supplicant retaining an authorized state unexpectedly.