# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path](https://agentprime.io/advisories/GHSA-96h3-5x6v-m776.md)
  `GHSA-96h3-5x6v-m776`, `BIT-composer-2026-59944`, `CVE-2026-59944`, `PKSA-ddsx-fjz2-sbs3` · Packagist `composer/composer`: affected `>=1.0, <2.2.30 || >=2.3.0, <2.10.3`, fixed in `2.2.30`, `2.10.3` · CVSS 6.1 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Path traversal, Broken access control
- [Anubis: Policy bypass via client controlled X-Original-URI header](https://agentprime.io/advisories/GHSA-6wcg-mqvh-fcvg.md)
  `GHSA-6wcg-mqvh-fcvg`, `CVE-2026-62314`, `GO-2026-6639` · Go `github.com/TecharoHQ/anubis`: affected `>=1.22.0, <1.26.0`, fixed in `1.26.0` · CVSS 5.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [Apache Traffic Server: SNI to Host header matching policy is not properly enforced](https://agentprime.io/advisories/CVE-2026-102795.md)
  `CVE-2026-102795` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.0 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View](https://agentprime.io/advisories/CVE-2026-104914.md)
  `CVE-2026-104914` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-103626.md)
  `CVE-2026-103626` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data](https://agentprime.io/advisories/CVE-2026-104912.md)
  `CVE-2026-104912` · CVE record: MISP MISP · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [Missing Authorization in Meari IoT Cloud Platform OpenAPI Service](https://agentprime.io/advisories/CVE-2026-96613.md)
  `CVE-2026-96613` · CVE record: Meari IoT Cloud Platform OpenAPI Service · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization](https://agentprime.io/advisories/CVE-2026-104910.md)
  `CVE-2026-104910` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [Missing Authorization in Meari IoT Cloud Platform OpenAPI Service](https://agentprime.io/advisories/CVE-2026-101104.md)
  `CVE-2026-101104` · CVE record: Meari IoT Cloud Platform OpenAPI Service · CVSS 6.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging](https://agentprime.io/advisories/CVE-2026-104908.md)
  `CVE-2026-104908` · CVE record: MISP MISP · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-39717.md)
  `CVE-2026-39717` · CVE record: ThimPress LearnPress · CVSS 4.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-39444.md)
  `CVE-2026-39444` · CVE record: PublishPress PublishPress Series · CVSS 5.4 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [onetwothreeneth HospitalManagementSystem controller.php edit_patient unrestricted upload](https://agentprime.io/advisories/CVE-2026-104637.md)
  `CVE-2026-104637` · CVE record: onetwothreeneth HospitalManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [WordPress WebSamurai plugin <= 1.0.7 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-39439.md)
  `CVE-2026-39439` · CVE record: Kiera Howe WebSamurai · CVSS 6.5 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [WordPress Airano MCP Bridge plugin <= 2.11.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-32585.md)
  `CVE-2026-32585` · CVE record: airano Airano MCP Bridge · CVSS 6.5 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [IDOR in AVEZ Electronics's LMS](https://agentprime.io/advisories/CVE-2026-85209.md)
  `CVE-2026-85209` · CVE record: AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS) · CVSS 6.5 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler](https://agentprime.io/advisories/CVE-2026-104472.md)
  `CVE-2026-104472` · CVE record: YesWiki yeswiki · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [YesWiki before 4.6.7 Authorization Bypass via Public API Mode](https://agentprime.io/advisories/CVE-2026-104467.md)
  `CVE-2026-104467` · CVE record: YesWiki yeswiki · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche](https://agentprime.io/advisories/CVE-2026-104449.md)
  `CVE-2026-104449` · CVE record: YesWiki yeswiki · CVSS 8.3 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [YesWiki before 4.6.7 Authorization Bypass via Comments API editComment](https://agentprime.io/advisories/CVE-2026-104444.md)
  `CVE-2026-104444` · CVE record: YesWiki yeswiki · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [YesWiki before 4.6.7 Scope Bypass via Triples Delete API](https://agentprime.io/advisories/CVE-2026-104443.md)
  `CVE-2026-104443` · CVE record: YesWiki yeswiki · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [YesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actions](https://agentprime.io/advisories/CVE-2026-104438.md)
  `CVE-2026-104438` · CVE record: YesWiki yeswiki · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [SiYuan before 3.8.5 Information Disclosure via /api/export/preview](https://agentprime.io/advisories/CVE-2026-104410.md)
  `CVE-2026-104410` · CVE record: siyuan-note siyuan · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints](https://agentprime.io/advisories/CVE-2026-103762.md)
  `CVE-2026-103762` · CVE record: siyuan-note siyuan · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-104403.md)
  `CVE-2026-104403` · CVE record: ThimPress LearnPress · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [WordPress Advanced Ads plugin <= 2.0.26 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-94180.md)
  `CVE-2026-94180` · CVE record: Monetizemore Advanced Ads · CVSS 4.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [WordPress Download Manager plugin <= 3.3.71 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-94405.md)
  `CVE-2026-94405` · CVE record: Shahjada Download Manager · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category\[\]' Parameter](https://agentprime.io/advisories/CVE-2026-94541.md)
  `CVE-2026-94541` · CVE record: amauric WPMobile.App – Android and iOS App Builder · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [Unauthorized Cross-Chatbot Tool Invocation in HAVELSAN's Sef - AI Chatbot Platform](https://agentprime.io/advisories/CVE-2026-80337.md)
  `CVE-2026-80337` · CVE record: HAVELSAN Inc. Sef - AI Chatbot Platform · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter](https://agentprime.io/advisories/CVE-2026-94432.md)
  `CVE-2026-94432` · CVE record: latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter](https://agentprime.io/advisories/CVE-2026-97219.md)
  `CVE-2026-97219` · CVE record: Unknown MStore API · CVSS 4.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST API](https://agentprime.io/advisories/CVE-2026-90952.md)
  `CVE-2026-90952` · CVE record: Unknown WP Edit Password Protected · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [Popup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing Authorization](https://agentprime.io/advisories/CVE-2026-85005.md)
  `CVE-2026-85005` · CVE record: Unknown Popup Maker WP · CVSS 5.4 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form](https://agentprime.io/advisories/CVE-2026-79618.md)
  `CVE-2026-79618` · CVE record: Unknown WP User Frontend · CVSS 4.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [CMP - Coming Soon & Maintenance < 4.1.20 - Unauthenticated Maintenance Mode Bypass via Login URL Match](https://agentprime.io/advisories/CVE-2026-13413.md)
  `CVE-2026-13413` · CVE record: Unknown CMP – Coming Soon & Maintenance · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [Motors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featured](https://agentprime.io/advisories/CVE-2026-91023.md)
  `CVE-2026-91023` · CVE record: Unknown Motors · CVSS 3.1 Low · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [Popup Maker WP <= 1.4.5 - Subscriber+ Missing Authorization via sgpm_connect](https://agentprime.io/advisories/CVE-2026-85004.md)
  `CVE-2026-85004` · CVE record: Unknown Popup Maker · CVSS 4.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization](https://agentprime.io/advisories/CVE-2026-104054.md)
  `CVE-2026-104054` · CVE record: calcom cal.diy · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membership](https://agentprime.io/advisories/CVE-2026-104480.md)
  `CVE-2026-104480` · CVE record: Discord libdave · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control, CWE-390
- [TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py.](https://agentprime.io/advisories/CVE-2026-51916.md)
  `CVE-2026-51916` · CVE record · CVSS 7.5 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller.](https://agentprime.io/advisories/CVE-2026-51915.md)
  `CVE-2026-51915` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller.](https://agentprime.io/advisories/CVE-2026-51914.md)
  `CVE-2026-51914` · CVE record · CVSS 8.8 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller.](https://agentprime.io/advisories/CVE-2026-51904.md)
  `CVE-2026-51904` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control.](https://agentprime.io/advisories/CVE-2026-51901.md)
  `CVE-2026-51901` · CVE record · CVSS 8.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) allow authenticated users from…](https://agentprime.io/advisories/CVE-2026-51899.md)
  `CVE-2026-51899` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium](https://agentprime.io/advisories/GHSA-w7c2-w76w-5hmj.md)
  `GHSA-w7c2-w76w-5hmj`, `BIT-cilium-2026-56742`, `BIT-cilium-operator-2026-56742`, `BIT-hubble-relay-2026-56742`, `CVE-2026-56742`, `GO-2026-6596` · Go `github.com/cilium/cilium`: affected `<1.17.17 || >=1.18.0, <1.18.11 || >=1.19.0, <1.19.5`, fixed in `1.17.17`, `1.18.11`, `1.19.5` · CVSS 5.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Missing authorization in Motorola Setup App](https://agentprime.io/advisories/CVE-2026-93832.md)
  `CVE-2026-93832` · CVE record: Motorola Setup App · CVSS 4.8 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [RT-Labs AB C-Open CANopen SDO Server Write Protection Bypass](https://agentprime.io/advisories/CVE-2026-82358.md)
  `CVE-2026-82358` · CVE record: RT-Labs AB C-Open · CVSS 7.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block](https://agentprime.io/advisories/GHSA-vg99-7gj7-2fr5.md)
  `GHSA-vg99-7gj7-2fr5`, `CVE-2026-73606`, `GO-2026-6635` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260812083335-251596fc0de2`, fixed in `0.0.0-20260812083335-251596fc0de2` · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route](https://agentprime.io/advisories/GHSA-9cqf-hhrq-7v45.md)
  `GHSA-9cqf-hhrq-7v45`, `CVE-2026-73608`, `GO-2026-6632` · Go `github.com/siyuan-note/siyuan/kernel`: affected `>=0.0.0-20260726161145-9b8e8956f997, <0.0.0-20260812083335-251596fc0de2`, fixed in `0.0.0-20260812083335-251596fc0de2` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering](https://agentprime.io/advisories/GHSA-j4ph-9xwf-wcj4.md)
  `GHSA-j4ph-9xwf-wcj4`, `CVE-2026-73609`, `GO-2026-6634` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260812083335-251596fc0de2`, fixed in `0.0.0-20260812083335-251596fc0de2` · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Apache HTTP Server: mod_proxy_ftp PASV address handling](https://agentprime.io/advisories/CVE-2026-63045.md)
  `CVE-2026-63045` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem](https://agentprime.io/advisories/GHSA-hf8h-97gm-4x2p.md)
  `GHSA-hf8h-97gm-4x2p`, `CVE-2026-73605`, `GO-2026-6626` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260812083335-251596fc0de2`, fixed in `0.0.0-20260812083335-251596fc0de2` · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check](https://agentprime.io/advisories/GHSA-53fp-9jmv-227g.md)
  `GHSA-53fp-9jmv-227g`, `CVE-2026-73607`, `GO-2026-6624` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260812083335-251596fc0de2`, fixed in `0.0.0-20260812083335-251596fc0de2` · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package](https://agentprime.io/advisories/GHSA-c48m-32m9-vx93.md)
  `GHSA-c48m-32m9-vx93`, `CVE-2026-92951` · npm `vm2`: affected `<3.11.7`, fixed in `3.11.7` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control, CWE-706, CWE-829
- [vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes](https://agentprime.io/advisories/GHSA-6rh5-qq4q-97xh.md)
  `GHSA-6rh5-qq4q-97xh`, `CVE-2026-92958` · npm `vm2`: affected `<3.11.7`, fixed in `3.11.7` · CVSS 8.4 High · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation, Broken access control
- [vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process](https://agentprime.io/advisories/GHSA-8686-vhfx-7r3j.md)
  `GHSA-8686-vhfx-7r3j`, `CVE-2026-92957` · npm `vm2`: affected `<3.11.7`, fixed in `3.11.7` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation, Broken access control
- [vm2 NodeVM can replace the host process TLS trust store](https://agentprime.io/advisories/GHSA-98xx-8mx4-x7cm.md)
  `GHSA-98xx-8mx4-x7cm`, `CVE-2026-92941` · npm `vm2`: affected `>=3.11.3, <3.11.7`, fixed in `3.11.7` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted](https://agentprime.io/advisories/GHSA-7q3f-wx44-378m.md)
  `GHSA-7q3f-wx44-378m`, `CVE-2026-92945` · npm `vm2`: affected `<3.11.7`, fixed in `3.11.7` · CVSS 2.3 Low · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal, Broken access control
- [SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state](https://agentprime.io/advisories/CVE-2026-17053.md)
  `CVE-2026-17053` · CVE record: zephyrproject zephyr · CVSS 4.4 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTAxVDE1OjA4OjUyLjcyMTAwMFoiLCJDVkUtMjAyNi0xNzA1MyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTAyVDE5OjMxOjE3LjAwMDAwMFoiLCJHSFNBLXF4cHAtcWpnOC14NGp2Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTAyVDE5OjMxOjE3LjAwMDAwMFoiLCJHSFNBLXF4cHAtcWpnOC14NGp2Il0>. Everything for agents: <https://agentprime.io/llms.txt>.