CWE-459: Incomplete Cleanup
Filter
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
What the weakness is: CWE-459 at MITRE
Ask an AI about CWE-459
Show the prompt
Explain CWE-459: Incomplete Cleanup and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/459.html and https://cve.bz/cve/cwe/459?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 2.1CVE-2026-121750
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.5 through 0.40.8, `nvm_download_artifact` downloads a release archive directly to its final path in `$NVM_DIR/.cache` a…
- 8.8CVE-2026-121204EPSS 0.2%
Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
- –CVE-2026-121096EPSS 0.1%
Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local program. (Chromium security severity: Medium)
- –CVE-2026-121055EPSS 0.2%
Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Low)
- 4.6CVE-2026-85033EPSS 0.2%
The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index (get_avrcp_tg()), with the per-transfer context (tid, sent_len, and t…
- –CVE-2026-116132EPSS 0.3%
HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk. The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part…
- 7.1CVE-2026-115478EPSS 0.3%
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate memory notes from SQLite…
- 8.8CVE-2026-113168EPSS 0.5%
Incomplete cleanup in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
- 8.8CVE-2026-113073EPSS 0.4%
Incomplete cleanup in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
- 6.5CVE-2026-113050EPSS 0.3%
Incomplete cleanup in HID in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted Chrome extension. (Chr…
- 8.8CVE-2026-113012EPSS 0.5%
Incomplete cleanup in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
- 6.5CVE-2026-113010EPSS 0.4%
Incomplete cleanup in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
- 7.5CVE-2026-113658EPSS 0.6%
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not r…
- 7.5CVE-2026-93446EPSS 0.6%
Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122. U…
- 7.5CVE-2026-88041EPSS 0.5%
Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.26, from 10.1.27 through 10.1.60,…
- 4.2CVE-2026-110008EPSS 0.10%
@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at …
- 5.1CVE-2026-112180EPSS 0.3%
MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report t…
- 7.5CVE-2026-109869EPSS 0.3%
undici is an HTTP client library for Node.js. In versions 6.23.0 through 6.29.0, 7.18.0 through 7.30.0, and 8.0.0 through 8.12.1, its fetch() implementation crashes the Node.js process when a malicious server returns a response with more t…
- 5.1CVE-2026-17525EPSS 0.1%
Incomplete cleanup vulnerability in ABB My Control System. This issue affects My Control System: 26.4 and 26.5.
- 8.7CVE-2026-102030EPSS 0.5%
An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos OS and Junos OS Evolved allows a configured MVPN neighbor to cause a denial of service via a BGP MVPN update when an inter‑region segmented VRF with 'protocol…
- 8.7CVE-2026-103937EPSS 0.5%
Misskey is an open source, federated social media platform. From 13.0.0 until 2025.4.1 and from 2025.5.0 until 2026.7.0, cleanup processing may not execute during file uploads. Repeated uploads can exhaust storage or file descriptors and d…
- 5.1CVE-2026-49484EPSS 0.3%
Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /…
- 6.9CVE-2026-109276EPSS 0.4%
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input. Attackers can submit crafted JNG files for processing to repeat…
- 7.2CVE-2026-108982EPSS 0.2%
VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service (go-nfsv4) and its associated VeraCrypt core-service helper processes when a volume is dismo…
- 6.5CVE-2026-19740EPSS 0.1%
The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains the receive node that carried an accepted LL_PHY_UPDATE_IND so that it can later be reused for the host notification when the upd…
- 6.5CVE-2026-19739EPSS 0.1%
The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retains the received RX node while a Connection Update / Connection Parameter procedure waits for its instant, so the node can later c…
- 7.8CVE-2026-107914EPSS 0.1%
Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested …
- 6.8CVE-2026-107332EPSS 0.1%
Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files. To mitigate this issue, use…
- 4.3CVE-2026-106394EPSS 0.2%
Incomplete cleanup in Glic in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
- 9.6CVE-2026-106375EPSS 0.4%
Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- 5.4CVE-2026-106366EPSS 0.2%
Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
- 9.1CVE-2026-106294EPSS 0.3%
Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)
- 4.2CVE-2026-106262EPSS 0.2%
Incomplete cleanup in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security…
- 5.3CVE-2026-106243EPSS 0.1%
Incomplete cleanup in Proxy Auth in Google Chrome prior to 155.0.8059.39 allowed an adjacent attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: High)
- 8.8CVE-2026-106203EPSS 0.4%
Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
- 8.2CVE-2026-104427EPSS 0.3%
Zebra before 6.1.0 contains an incomplete cleanup vulnerability in the state write task that allows remote unauthenticated peers to stall node synchronization by poisoning parent_error_map. Attackers can deliver a coinbase-malleated block …
- 6.9CVE-2026-104421EPSS 0.3%
Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by leaving rejected hashes in SentHashes. Attackers can send a contextually invalid block sharing an hon…
- 8.4CVE-2026-95326EPSS 0.3%
Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
- 6.5CVE-2026-95303EPSS 0.3%
Incomplete cleanup in SmartCard in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
- 9.0CVE-2026-15390EPSS 0.2%
Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can deliver fragmented IP traffic can execute arbitrary code by sending duplicated last-fragment IP packe…
- 5.3CVE-2026-101100EPSS 0.3%
A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07. This vulnerability affects the function FilterToolCallsMiddleware of the file sdks/typescript/packages/client/src/middleware/filter-tool-calls.ts of the component Middleware. …
- 7.3CVE-2026-78437EPSS 0.5%
Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 th…
- 3.1CVE-2026-91730EPSS 0.2%
Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain cross-origin data via a crafted HTML page. (Chromium s…
- 2.1CVE-2026-75945EPSS 0.2%
A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.
- 5.6CVE-2026-75944EPSS 0.2%
A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control …
- 2.1CVE-2026-75943EPSS 0.2%
A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass wit…
- 5.3CVE-2026-88932EPSS 0.5%
multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are…
- 7.5CVE-2026-87776EPSS 0.5%
compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroye…
- 6.5CVE-2026-87549EPSS 0.4%
Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
- 6.5CVE-2026-87446EPSS 0.3%
Incomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)