CWE-459: Incomplete Cleanup
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
Also known as Insufficient Cleanup.
A kind of CWE-404 Improper Resource Shutdown or Release.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeIncomplete cleanup in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...6.5 Medium
- google chromeIncomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote...6.5 Medium
- google chromeIncomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker...9.1 Critical
- elastic cloud on kubernetes, eck operator +1 moreIncomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention3.5 Low
- expressjs multermulter vulnerable to Denial of Service via file descriptor leak on aborted uploads7.5 High
- filebrowserfilebrowser through 2.63.23 Stale Share Link via File Rename2.3 Low
- filebrowserFile Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion2.3 Low
- google chromeIncomplete cleanup in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker...6.5 Medium
- google chromeIncomplete cleanup in GetUserMedia in Google Chrome prior to 152.0.7977.65 allowed a remote...5.3 Medium
- google chromeIncomplete cleanup in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote...3.1 Low
- rocq-prover rocqRocq Prover through 9.2.0 Universe Checking State Desynchronised After Module Close6.8 Medium
- misp misp-stixCross-Document Parser State Contamination in misp-stix6.3 Medium
- frangoteam fuxaFUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup2.0 Low
- mattermost, mattermost server +1 moreMattermost thread memberships persist after team removal, exposing private channel thread metadata on re-invite3.5 Low
- @fastify/multipart, fastify fastify-multipart +1 more@fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload7.5 High
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 8 +7 more +9 morePodman: podman: quadlet install --replace non-truncating write retains removed host-access directives4.2 Medium
- No product listedIncomplete cleanup in some UEFI firmware for some Intel(R) reference platforms within UEFI may...4.0 Medium
- microsoft powerpoint, 365 apps, 365 apps for enterprise +6 more +8 morePowerpoint Information Disclosure Vulnerability5.5 Medium
- poco-ai poco-agentpoco-ai poco-agent Claude File workspace.py WorkspaceManager._setup_session_persistence cleanup6.3 Medium
- sharp corporation mfps, toshiba tec corporation tec mfps +1 moreSharp and Toshiba Tec MFPs (multifunction printers) caches data internally when printing, and...2.4 Low
- xenvIRQ event channel binding may break Xenstore7.5 High
- linux, linux kernel +1 morebpf: Support for hardening against JIT spraying5.5 Medium
- linux, linux kernel +1 morearm64: tlb: Flush walk cache when unsharing PMD tables7.8 High
- imaginationtech ddk, imagination technologies graphics ddk +1 moreGPU DDK - Page UAF read in PMMETA_PROTECT heap memory7.8 High
- better-authbetter-auth Stale Sessions Persist After User Deletion5.1 Medium
- zcashfoundation zebra, zebra-state +1 moreZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip6.5 Medium
- zcashfoundation zebraZEBRA: Block suppression via NU5 same-header body poisoning of sent-hash cache8.7 High
- eclipse threadx netx duo, eclipse foundation threadx - netx duo +1 moreThe security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally call…7.5 High
- expressjs multermulter vulnerable to Denial of Service via incomplete cleanup of aborted uploads5.3 Medium
- cap-go capgoCapgo < 12.128.2 - Orphaned File Retention via Profile Image Replacement5.3 Medium
- significant-gravitas autogptAutoGPT: Unauthenticated DoS via Disk Space Exhaustion7.5 High
- amd instinct™ mi210, instinct™ mi300x, instinct™ mi325x +1 more +3 moreImproper cleanup of shared register resources in GPU firmware could allow an admin-privileged...4.6 Medium
- sap se commerce cloud configurationMissing authentication check in SAP Commerce cloud configuration9.6 Critical
- linux, linux kernel +1 moredrm/xe/sync: Cleanup partially initialized sync on parse failure5.5 Medium
- apache cloudstackApache CloudStack: MinIO policy remains intact on bucket deletion8.0 High
- linux, linux kernel +1 moreseg6: separate dst_cache for input and output paths in seg6 lwtunnel9.8 Critical
- uutils coreutilsuutils coreutils mknod Security Label Inconsistency and Broken Cleanup on SELinux Systems3.4 Low
- nesquena hermes-webuiNesquena Hermes WebUI Environment Variable Credential Leakage via Profile Switch4.8 Medium
- go-vikunja vikunjaVikunja Vulnerable to Account Takeover via Password Reset Token Reuse9.8 Critical
- expressjs multer, red hat logging subsystem for red hat openshift, developer hub 1.8 +7 more +9 moreMulter vulnerable to Denial of Service via incomplete cleanup8.7 High
- jetbrains teamcityIn JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on...2.3 Low
- quic-go webtransport-gowebtransport-go affected by a Memory Exhaustion Attack due to Missing Cleanup of Streams Map5.3 Medium
- tanium connectTanium addressed an uncontrolled resource consumption vulnerability in Connect.4.3 Medium
- apache strutsApache Struts: File leak in multipart request processing causes disk exhaustion (DoS) - version ranges fixed8.2 High
github.com/babylonlabs-io/babylonGo,github.com/babylonlabs-io/babylon/v2Go,github.com/babylonlabs-io/babylon/v3Go +1 more +3 moreBabylon Incorrect FP inactive accounting in costaking creates “phantom stake” that earns rewards after BTC unbond6.9 Medium- apache strutsApache Struts: File leak in multipart request processing causes disk exhaustion (DoS)7.5 High
- amd epyc™ 8004 series processors, epyc™ 9004 series processors, epyc™ 9005 series processors +5 more +7 moreA bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest...5.3 Medium
- perfree perfreeblogPerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function7.6 High
- qtPossible denial of service with multiple incoming connections to a Schannel based server with a TLS backend9.2 Critical
- f5 big-ip, big-ip next cnf, big-ip access policy manager +21 more +23 moreBIG-IP DNS cache vulnerability8.7 High
- Show moreLoading…