# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference Modification](https://agentprime.io/advisories/CVE-2026-109129.md)
  `CVE-2026-109129` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association](https://agentprime.io/advisories/CVE-2026-109837.md)
  `CVE-2026-109837` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation](https://agentprime.io/advisories/CVE-2026-109856.md)
  `CVE-2026-109856` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification](https://agentprime.io/advisories/CVE-2026-114235.md)
  `CVE-2026-114235` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Apache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List Modification](https://agentprime.io/advisories/CVE-2026-114271.md)
  `CVE-2026-114271` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Apache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content Disclosure](https://agentprime.io/advisories/CVE-2026-114272.md)
  `CVE-2026-114272` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [agentscope-ai AgentScope Bash Tool \_bash.py check_permissions authorization](https://agentprime.io/advisories/CVE-2026-123023.md)
  `CVE-2026-123023` · CVE record: agentscope-ai AgentScope · CVSS 6.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw](https://agentprime.io/advisories/CVE-2026-107912.md)
  `CVE-2026-107912` · CVE record: Red Hat Exploit Intelligence and 4 more · CVSS 7.7 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user](https://agentprime.io/advisories/CVE-2026-100109.md)
  `CVE-2026-100109` · CVE record: Unknown Security For WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Missing authorization in Samsung Semiconductor Exynos 1580 and others](https://agentprime.io/advisories/CVE-2026-69002.md)
  `CVE-2026-69002` · CVE record: Samsung Semiconductor Exynos 1580 and 3 more · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Kyverno before 1.19.2 Cross-Namespace Resource Read via generate.clone](https://agentprime.io/advisories/CVE-2026-122320.md)
  `CVE-2026-122320` · CVE record: kyverno kyverno · CVSS 8.3 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Kyverno 1.17.0 before 1.19.2 Cross-Namespace Write via NamespacedMutatingPolicy mutateExisting](https://agentprime.io/advisories/CVE-2026-122316.md)
  `CVE-2026-122316` · CVE record: kyverno kyverno · CVSS 8.4 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Kyverno before 1.19.2 Label Spoofing via Generation Handler processRequest](https://agentprime.io/advisories/CVE-2026-122308.md)
  `CVE-2026-122308` · CVE record: kyverno kyverno · CVSS 8.4 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Kyverno before 1.19.2 Policy Bypass via admissionpolicygenerator PolicyException Handling](https://agentprime.io/advisories/CVE-2026-122307.md)
  `CVE-2026-122307` · CVE record: kyverno kyverno · CVSS 8.3 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader](https://agentprime.io/advisories/CVE-2026-122304.md)
  `CVE-2026-122304` · CVE record: kyverno kyverno · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy](https://agentprime.io/advisories/CVE-2026-122303.md)
  `CVE-2026-122303` · CVE record: kyverno kyverno · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [InvoiceShelf MemberService.php create access control](https://agentprime.io/advisories/CVE-2026-122158.md)
  `CVE-2026-122158` · CVE record: InvoiceShelf · CVSS 5.1 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Privilege escalation, Broken access control
- [purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure](https://agentprime.io/advisories/CVE-2026-122154.md)
  `CVE-2026-122154` · CVE record: purocean Yank Note · CVSS 6.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure, Broken access control
- [Presenton User Configuration user-config JSON.parse cross-site request forgery](https://agentprime.io/advisories/CVE-2026-122151.md)
  `CVE-2026-122151` · CVE record: Presenton · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [nliautaud pico-content-editor cross-site request forgery](https://agentprime.io/advisories/CVE-2026-122144.md)
  `CVE-2026-122144` · CVE record: nliautaud pico-content-editor · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [Open edX: Support "manage_course_team" REST API omits the \`require_support_permission\` gate its sibling support views enforce](https://agentprime.io/advisories/CVE-2026-97702.md)
  `CVE-2026-97702` · CVE record: openedx openedx-platform · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control, CWE-204
- [Campcodes Complete Advance Loan Management System banner.php move_uploaded_file unrestricted upload](https://agentprime.io/advisories/CVE-2026-122047.md)
  `CVE-2026-122047` · CVE record: Campcodes Complete Advance Loan Management System · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control, Unrestricted file upload
- [Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences](https://agentprime.io/advisories/CVE-2026-62662.md)
  `CVE-2026-62662` · CVE record: pocket-id pocket-id · CVSS 7.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control, CWE-20
- [GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds](https://agentprime.io/advisories/CVE-2026-53631.md)
  `CVE-2026-53631` · CVE record: glpi-project glpi · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [VitaFit Cloud API Excessive Data Exposure via relation/search Endpoint](https://agentprime.io/advisories/CVE-2026-54383.md)
  `CVE-2026-54383` · CVE record: Shenzhen Shine Industrial Co., Ltd. VitaFit · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [GLPI: Unallowed notifications sending](https://agentprime.io/advisories/CVE-2026-57152.md)
  `CVE-2026-57152` · CVE record: glpi-project glpi · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [NST Labs Tech Nstbrowser Local Agent API info information disclosure](https://agentprime.io/advisories/CVE-2026-122028.md)
  `CVE-2026-122028` · CVE record: NST Labs Tech Nstbrowser · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure, Broken access control
- [VitaFit Cloud API Storage Bucket Unauthenticated Access Information Disclosure](https://agentprime.io/advisories/CVE-2026-54381.md)
  `CVE-2026-54381` · CVE record: Shenzhen Shine Industrial Co., Ltd. VitaFit · CVSS 8.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [VitaFit Cloud API IDOR via profile_id Endpoints](https://agentprime.io/advisories/CVE-2026-54377.md)
  `CVE-2026-54377` · CVE record: Shenzhen Shine Industrial Co., Ltd. VitaFit · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Sandboxie-Plus: Sandbox containment bypass](https://agentprime.io/advisories/CVE-2026-102280.md)
  `CVE-2026-102280` · CVE record: sandboxie-plus Sandboxie · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure, Broken access control, CWE-390, CWE-636
- [Readest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Session to the caller](https://agentprime.io/advisories/CVE-2026-57562.md)
  `CVE-2026-57562` · CVE record: readest readest · CVSS 6.5 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [6amTech 6valley Social Login Flow existing-account-check existingAccountCheck authorization](https://agentprime.io/advisories/CVE-2026-122019.md)
  `CVE-2026-122019` · CVE record: 6amTech 6valley · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover](https://agentprime.io/advisories/CVE-2026-103002.md)
  `CVE-2026-103002` · CVE record: gpustack gpustack · CVSS 8.8 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise](https://agentprime.io/advisories/CVE-2026-97693.md)
  `CVE-2026-97693` · CVE record: xerrors Yuxi · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Command injection, Broken access control, Hard-coded credentials
- [Multiple vulnerabilities that affects IBM Db2 Genius Hub](https://agentprime.io/advisories/CVE-2026-110282.md)
  `CVE-2026-110282` · CVE record: IBM Db2 Genius Hub · CVSS 6.5 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets](https://agentprime.io/advisories/CVE-2026-102340.md)
  `CVE-2026-102340` · CVE record: telepresenceio telepresence · CVSS 8.5 High · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass, Broken access control
- [WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints](https://agentprime.io/advisories/CVE-2026-122224.md)
  `CVE-2026-122224` · CVE record: retspen webvirtcloud · CVSS 7.2 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable](https://agentprime.io/advisories/CVE-2026-102339.md)
  `CVE-2026-102339` · CVE record: telepresenceio telepresence · CVSS 8.2 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Nexus Repository 3 - Group Repository Member Authorization Bypass](https://agentprime.io/advisories/CVE-2026-113368.md)
  `CVE-2026-113368` · CVE record: Sonatype Nexus Repository 3 · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation](https://agentprime.io/advisories/CVE-2026-113374.md)
  `CVE-2026-113374` · CVE record: Sonatype Nexus Repository 3 · CVSS 8.6 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Zulip: Saving a draft DM to a user bypasses can_access_all_users_group permission](https://agentprime.io/advisories/CVE-2026-115474.md)
  `CVE-2026-115474` · CVE record: zulip zulip · CVSS 6.5 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels](https://agentprime.io/advisories/CVE-2026-115574.md)
  `CVE-2026-115574` · CVE record: zulip zulip · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Invoice Ninja < 5.13.28 Broken Access Control via Vendor Portal](https://agentprime.io/advisories/CVE-2026-82029.md)
  `CVE-2026-82029` · CVE record: invoiceninja invoiceninja · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Yealink T3XW Series Phones and others](https://agentprime.io/advisories/CVE-2026-122116.md)
  `CVE-2026-122116` · CVE record: Yealink T3XW Series Phones and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735](https://agentprime.io/advisories/GHSA-93cm-2v4m-c56c.md)
  `GHSA-93cm-2v4m-c56c`, `CVE-2026-55098`, `GO-2026-6913` · Go `github.com/basekick-labs/arc`: affected `<0.0.0-20260610131716-5dc8f53b70a3`, fixed in `0.0.0-20260610131716-5dc8f53b70a3` · CVSS 6.5 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure, Broken access control
- [@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter](https://agentprime.io/advisories/GHSA-mc8m-rr6c-r5qr.md)
  `GHSA-mc8m-rr6c-r5qr`, `CVE-2026-93363` · npm `@payloadcms/storage-vercel-blob`: affected `>=3.25.0, <3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice](https://agentprime.io/advisories/CVE-2026-119748.md)
  `CVE-2026-119748` · CVE record: AyeCode Ltd Payment forms, Buy now buttons, and Invoicing System | GetPaid · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [GetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST API](https://agentprime.io/advisories/CVE-2026-119747.md)
  `CVE-2026-119747` · CVE record: AyeCode Ltd Payment forms, Buy now buttons, and Invoicing System | GetPaid · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Cisco Identity Services Engine Authorization Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-20241.md)
  `CVE-2026-20241` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Warpgate: Kubernetes authorization correlation can be reused by a recreated same-name account](https://agentprime.io/advisories/CVE-2026-91168.md)
  `CVE-2026-91168` · CVE record: warp-tech warpgate · CVSS 6.8 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Oqtane Framework before 10.3.0 Broken Access Control via SettingController](https://agentprime.io/advisories/CVE-2026-122007.md)
  `CVE-2026-122007` · CVE record: oqtane oqtane.framework · CVSS 7.4 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Sender WordPress Plugin < 2.11.3 Broken Access Control via admin_post_sender_debug_download](https://agentprime.io/advisories/CVE-2026-119745.md)
  `CVE-2026-119745` · CVE record: Sender Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [wePOS before 2.0.3 Missing Authorization via payment/process Endpoint](https://agentprime.io/advisories/CVE-2026-121993.md)
  `CVE-2026-121993` · CVE record: wedevs wePOS – Point Of Sale (POS) for WooCommerce & Dokan · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [CoopCycle coopcycle-web before 6.20.1 IDOR via Incident Resource and Action Endpoint](https://agentprime.io/advisories/CVE-2026-121945.md)
  `CVE-2026-121945` · CVE record: CoopCycle coopcycle-web · CVSS 7.2 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Stonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script Controllers](https://agentprime.io/advisories/CVE-2026-121940.md)
  `CVE-2026-121940` · CVE record: Stonewuu ai-fusion-video · CVSS 8.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [langchain4j-aideepin before 3.31.0 IDOR via GET /character/{uuid}](https://agentprime.io/advisories/CVE-2026-121938.md)
  `CVE-2026-121938` · CVE record: moyangzhan langchain4j-aideepin · CVSS 6.0 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [loonflow before r3.2.3 IDOR via ticket_flow_history Endpoint](https://agentprime.io/advisories/CVE-2026-121937.md)
  `CVE-2026-121937` · CVE record: blackholll loonflow · CVSS 2.3 Low · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [CVE-2026-118516: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control](https://agentprime.io/advisories/PKSA-y8c5-1b7f-r1gj.md)
  `PKSA-y8c5-1b7f-r1gj`, `CVE-2026-118516` · Packagist `symfony/routing`: affected `>=4.1.0, <4.2.0 || >=4.2.0, <4.3.0 || >=4.3.0, <4.4.0 || >=4.4.0, <5.0.0 || >=5.0.0, <5.1.0 || >=5.1.0, <5.2.0 || >=5.2.0, <5.3.0 || >=5.3.0, <5.4.0 || >=5.4.0, <5.4.56 || >=6.0.0, <6.1.0 || >=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11`, fixed in `4.2.0`, `4.3.0`, `4.4.0`, `5.0.0`, `5.1.0`, `5.2.0`, `5.3.0`, `5.4.0`, `5.4.56`, `6.1.0`, `6.2.0`, `6.3.0`, `6.4.0`, `6.4.50`, `7.1.0`, `7.2.0`, `7.3.0`, `7.4.0`, `7.4.23`, `8.1.0`, `8.1.11` · CVSS 6.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control, CWE-436
- [CVE-2026-118516: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control](https://agentprime.io/advisories/PKSA-py6w-7ynw-bn9j.md)
  `PKSA-py6w-7ynw-bn9j`, `CVE-2026-118516` · Packagist `symfony/symfony`: affected `>=4.1.0, <4.2.0 || >=4.2.0, <4.3.0 || >=4.3.0, <4.4.0 || >=4.4.0, <5.0.0 || >=5.0.0, <5.1.0 || >=5.1.0, <5.2.0 || >=5.2.0, <5.3.0 || >=5.3.0, <5.4.0 || >=5.4.0, <5.4.56 || >=6.0.0, <6.1.0 || >=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11`, fixed in `4.2.0`, `4.3.0`, `4.4.0`, `5.0.0`, `5.1.0`, `5.2.0`, `5.3.0`, `5.4.0`, `5.4.56`, `6.1.0`, `6.2.0`, `6.3.0`, `6.4.0`, `6.4.50`, `7.1.0`, `7.2.0`, `7.3.0`, `7.4.0`, `7.4.23`, `8.1.0`, `8.1.11` · CVSS 6.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control, CWE-436
- [Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID](https://agentprime.io/advisories/CVE-2026-100252.md)
  `CVE-2026-100252` · CVE record: Apache Software Foundation Apache ZooKeeper · CVSS 8.6 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTExLTA0VDEwOjQ0OjE3LjM2NzAwMFoiLCJDVkUtMjAyNi0xMDAyNTIiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTExLTA1VDEzOjM5OjQwLjA3MzAwMFoiLCJDVkUtMjAyNi0xMDU0NjEiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTExLTA1VDEzOjM5OjQwLjA3MzAwMFoiLCJDVkUtMjAyNi0xMDU0NjEiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.