Weakness (CWE)
CWE-459: Incomplete Cleanup
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
How to prevent it (1 mitigation)
-
Architecture and Design, Implementation
Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.
Source: MITRE CWE-459
164 results · Feed
-
Medium 4.6
Improper cleanup of shared register resources in GPU firmware could allow an admin-privileged attacker from a Guest Vir…
-
Critical 9.6
Missing authentication check in SAP Commerce cloud configuration
Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of…
-
High 8.0
Apache CloudStack: MinIO policy remains intact on bucket deletion
Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned. If another user creates a new bucket with the same name, the previous owners can gain unauthorized read and write acces…
-
Critical 9.8
seg6: separate dst_cache for input and output paths in seg6 lwtunnel
In the Linux kernel, the following vulnerability has been resolved: seg6: separate dst_cache for input and output paths in seg6 lwtunnel The seg6 lwtunnel uses a single dst_cache per encap route, shared between seg6_input_core() and seg6_output_core(). These …
-
Low 3.4
uutils coreutils mknod Security Label Inconsistency and Broken Cleanup on SELinux Systems
The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails, the utility attempts cleanup using std::fs::remove_dir, which cannot remove device nodes or FIFOs.…
-
Low 3.3
Nesquena Hermes WebUI Environment Variable Credential Leakage via Profile Switch
nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously active profile before loading the next profile. Attackers or users can exploit additive dotenv reload…
-
Critical 9.8
Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse
Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a failure to …
-
High 8.7CVE-2026-3304 Public exploit
Multer vulnerable to Denial of Service via incomplete cleanup
Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion. Users should up…
-
Low 2.3
In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk
-
Medium 5.3
webtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams Map
webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memory consumption repeatedly creating and closing many WebTransport streams. Closed streams were not removed from an internal session map, pre…
-
Medium 4.3
Tanium addressed an uncontrolled resource consumption vulnerability in Connect.
Tanium addressed an uncontrolled resource consumption vulnerability in Connect.
-
High 8.2
Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.…
-
Medium —
Babylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond
### Summary A state consistency bug in `x/costaking` can leave a BTC delegator with non-zero `ActiveSatoshis` (Phatom Stake) even after they have fully unbonded their BTC delegation, if their Finality Provider (FP) drops out of the active set in the exact sam…
-
High 7.5
Apache Struts: File leak in multipart request processing causes disk exhaustion (DoS)
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0.0 through 6.7.0, from 7.0.0 through 7.0.3. Users are recommended to upgrade to version 6.8.0 or 7.1.…
-
Medium 5.3
A bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest using stale TLB entries…
-
High 7.6
PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function
-
Critical 9.2
Possible denial of service with multiple incoming connections to a Schannel based server with a TLS backend
There is an incomplete cleanup vulnerability in Qt Network's Schannel support on Windows which can lead to a Denial of Service over a long period. This issue affects Qt from 5.15.0 through 6.8.3, from 6.9.0 before 6.9.2.
-
High 7.5
BIG-IP DNS cache vulnerability
When DNS cache is configured on a BIG-IP or BIG-IP Next CNF virtual server, undisclosed DNS queries can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
-
Medium 5.3
A vulnerability in the Day One setup process of Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers for…
-
Medium 6.3
CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php.
-
High 7.2
Improper cleanup in AMD CPU microcode patch loading could allow an attacker with local administrator privilege to load …
-
Low 3.2
Incomplete cleanup after loading a CPU microcode patch may allow a privileged attacker to degrade the entropy of the RD…
-
High 8.1
Tunnelblick 3.5beta06 before 7.0, when incompletely uninstalled, allows attackers to execute arbitrary code as root (up…
-
Low 3.1
An incomplete cleanup vulnerability [CWE-459] in FortiOS 7.2 all versions and before & FortiProxy version 7.2.0 through…
-
High 7.5
Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame
Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOf…
-
High 7.1
Eclipse ThreadX NetX Duo HTTP component server denial of service
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.3, an attacker can cause a denial of service by specially crafted packets. The core issue is missing closing of a file in case of an error condition, resulting in the 404 error f…
-
Medium 6.5
A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-A…
-
Medium 6.5
A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-A…
-
Medium 6.5
Insufficient clearing of GPU global memory could allow a malicious process running on the same GPU to read left over me…
-
High 7.1
Eclipse ThreadX NetX Duo HTTP server denial of service
In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause a denial of service by specially crafted packets. The core issue is missing closing of a file in case of an error condition, resulting in the 404 error f…
-
Medium 5.5
NVIDIA vGPU software contains a vulnerability in the host driver, where it can allow a guest to cause an interrupt stor…
-
Medium 5.5
NVIDIA Unified Memory driver for Linux contains a vulnerability where an attacker could leak uninitialized memory. A su…
-
Medium 6.5
Incomplete Cleanup vulnerability in PMB platform
Vulnerability in the PMB platform that allows an attacker to persist temporary files on the server, affecting versions 4.0.10 and above. This vulnerability exists in the file upload functionality on the ‘/pmb/authorities/import/iimport_authorities’ endpoint. …
-
High 8.7
SiYuan has an arbitrary file deletion vulnerability
SiYuan is self-hosted, open source personal knowledge management software. SiYuan Note version 3.1.18 has an arbitrary file deletion vulnerability. The vulnerability exists in the `POST /api/history/getDocHistoryContent` endpoint. An attacker can craft a payl…
-
Critical 9.1
IBOS v4.5.5 has an arbitrary file deletion vulnerability via \system\modules\dashboard\controllers\LoginController.php.
-
Medium 4.0
Vulnerability of resources not being closed or released in the keystore module Impact: Successful exploitation of this …
-
Medium 4.4
Incomplete system memory cleanup in SEV firmware could allow a privileged attacker to corrupt guest private memory, pot…
-
Low 1.9
Incomplete cleanup in the ASP may expose the Master Encryption Key (MEK) to a privileged attacker with access to the BI…
-
Low 3.7
Incomplete Cleanup in Conduit
Incomplete cleanup when performing redactions in Conduit, allowing an attacker to check whether certain strings were present in the PDU before redaction
-
High 7.5
moodle: HTTP authorization header is preserved between "emulated redirects"
The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.