agentprime: Broken access controlEvery new Broken access control Advisory and CVE.https://agentprime.io/CVE-2026-63017: Subnet Solutions PowerSYSTEM Center Incorrect Authorizationhttps://agentprime.io/advisories/CVE-2026-63017/https://agentprime.io/advisories/CVE-2026-63017/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 06 Nov 2026 00:01:21 GMTCVEcriticalCVE-2026-102943: Dagu MCP DAG specification read bypasses path containment and workspace isolationhttps://agentprime.io/advisories/CVE-2026-102943/https://agentprime.io/advisories/CVE-2026-102943/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 22:48:45 GMTCVECVE-2026-88982: Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)https://agentprime.io/advisories/CVE-2026-88982/https://agentprime.io/advisories/CVE-2026-88982/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 22:25:58 GMTCVECVE-2026-77596: Kubeflow Pipelines API server lacks authorization for shared pipeline uploadshttps://agentprime.io/advisories/CVE-2026-77596/https://agentprime.io/advisories/CVE-2026-77596/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 22:23:13 GMTCVEcriticalCVE-2026-88984: Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelineshttps://agentprime.io/advisories/CVE-2026-88984/https://agentprime.io/advisories/CVE-2026-88984/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 22:13:12 GMTCVECVE-2026-111490: Insecure direct object reference (IDOR) vulnerability in the MatchPoint APIhttps://agentprime.io/advisories/CVE-2026-111490/https://agentprime.io/advisories/CVE-2026-111490/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 21:49:40 GMTCVEcriticalCVE-2026-85076: Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)https://agentprime.io/advisories/CVE-2026-85076/https://agentprime.io/advisories/CVE-2026-85076/CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 20:28:01 GMTCVEcriticalCVE-2026-102940: OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignmenthttps://agentprime.io/advisories/CVE-2026-102940/https://agentprime.io/advisories/CVE-2026-102940/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 20:07:31 GMTCVEcriticalCVE-2026-104134: OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)https://agentprime.io/advisories/CVE-2026-104134/https://agentprime.io/advisories/CVE-2026-104134/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 20:03:37 GMTCVECVE-2026-103939: OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directoryhttps://agentprime.io/advisories/CVE-2026-103939/https://agentprime.io/advisories/CVE-2026-103939/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 20:02:37 GMTCVECVE-2026-104138: OpenEMR: Missing authorization on QRDA Category I/III download endpointshttps://agentprime.io/advisories/CVE-2026-104138/https://agentprime.io/advisories/CVE-2026-104138/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 20:01:53 GMTCVECVE-2026-115573: OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumerationhttps://agentprime.io/advisories/CVE-2026-115573/https://agentprime.io/advisories/CVE-2026-115573/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 20:01:06 GMTCVECVE-2026-104133: OpenEMR: Missing authorization in DORN `compendium_install.php` — non-admin destructive lab-compendium reinstallhttps://agentprime.io/advisories/CVE-2026-104133/https://agentprime.io/advisories/CVE-2026-104133/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 20:00:19 GMTCVECVE-2026-104135: OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birthhttps://agentprime.io/advisories/CVE-2026-104135/https://agentprime.io/advisories/CVE-2026-104135/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 19:58:44 GMTCVECVE-2026-104136: OpenEMR: Arbitrary Patient Recall and Contact Detail Readhttps://agentprime.io/advisories/CVE-2026-104136/https://agentprime.io/advisories/CVE-2026-104136/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 19:57:53 GMTCVECVE-2026-104137: OpenEMR: Patient Data Search Without Sufficient ACLhttps://agentprime.io/advisories/CVE-2026-104137/https://agentprime.io/advisories/CVE-2026-104137/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 19:56:13 GMTCVECVE-2026-104139: OpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHIhttps://agentprime.io/advisories/CVE-2026-104139/https://agentprime.io/advisories/CVE-2026-104139/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 19:55:24 GMTCVECVE-2026-44875: Incorrect default permissions in Hewlett Packard Enterprise (HPE) HPE Cray Programming Environmenthttps://agentprime.io/advisories/CVE-2026-44875/https://agentprime.io/advisories/CVE-2026-44875/CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 19:17:41 GMTCVECVE-2026-100360: SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Recordhttps://agentprime.io/advisories/CVE-2026-100360/https://agentprime.io/advisories/CVE-2026-100360/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:41:33 GMTCVECVE-2026-100361: SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)https://agentprime.io/advisories/CVE-2026-100361/https://agentprime.io/advisories/CVE-2026-100361/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:40:35 GMTCVECVE-2026-100364: SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijackhttps://agentprime.io/advisories/CVE-2026-100364/https://agentprime.io/advisories/CVE-2026-100364/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:39:41 GMTCVECVE-2026-69144: SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.phphttps://agentprime.io/advisories/CVE-2026-69144/https://agentprime.io/advisories/CVE-2026-69144/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:22:20 GMTCVECVE-2026-61650: SuiteCRM: Incorrect Access Control in V8 relationship creation via missing edit authorizationhttps://agentprime.io/advisories/CVE-2026-61650/https://agentprime.io/advisories/CVE-2026-61650/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:19:14 GMTCVECVE-2026-63217: SuiteCRM: IDOR in generatePdf Entry Point Allows Record Data Exfiltrationhttps://agentprime.io/advisories/CVE-2026-63217/https://agentprime.io/advisories/CVE-2026-63217/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:13:19 GMTCVECVE-2026-63218: SuiteCRM: Record-level Authorization Bypass via AOR_Reports changeReportPagehttps://agentprime.io/advisories/CVE-2026-63218/https://agentprime.io/advisories/CVE-2026-63218/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:11:30 GMTCVECVE-2026-63111: SuiteCRM: Non-admin user creates SchedulersJob: SSRF via cronhttps://agentprime.io/advisories/CVE-2026-63111/https://agentprime.io/advisories/CVE-2026-63111/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:09:36 GMTCVECVE-2026-115451: Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6https://agentprime.io/advisories/CVE-2026-115451/https://agentprime.io/advisories/CVE-2026-115451/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:02:50 GMTCVECVE-2026-107130: Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0https://agentprime.io/advisories/CVE-2026-107130/https://agentprime.io/advisories/CVE-2026-107130/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:57:57 GMTCVECVE-2026-123184: Incorrect Authorization in Altium 365 Git Service Allows Unauthorized Repository Writeshttps://agentprime.io/advisories/CVE-2026-123184/https://agentprime.io/advisories/CVE-2026-123184/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:41:09 GMTCVElxd allows Cross-guest volume hijack via DevLXD device patchhttps://agentprime.io/advisories/GHSA-hhf9-qw4v-72xp/https://agentprime.io/advisories/GHSA-hhf9-qw4v-72xp/github.com/canonical/lxd >=0.0.0-20250721152936-fe86ceb2c3fa, <0.0.0-20260626085133-7cb96ac80a6d, fixed in 0.0.0-20260626085133-7cb96ac80a6d. CVSS 8.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:40:59 GMTGogithub.com/canonical/lxdCVE-2026-102927: HedgeDoc: Missing validation of incoming permission values on changehttps://agentprime.io/advisories/CVE-2026-102927/https://agentprime.io/advisories/CVE-2026-102927/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:29:59 GMTCVECVE-2026-77439: Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpointshttps://agentprime.io/advisories/CVE-2026-77439/https://agentprime.io/advisories/CVE-2026-77439/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:25:59 GMTCVECVE-2026-104867: Immich calendar heatmap endpoint discloses cross-user activity through broken access controlhttps://agentprime.io/advisories/CVE-2026-104867/https://agentprime.io/advisories/CVE-2026-104867/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:03:59 GMTCVECVE-2026-54146: OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE primitive)https://agentprime.io/advisories/CVE-2026-54146/https://agentprime.io/advisories/CVE-2026-54146/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:41:31 GMTCVECVE-2026-54143: OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command executionhttps://agentprime.io/advisories/CVE-2026-54143/https://agentprime.io/advisories/CVE-2026-54143/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:40:23 GMTCVEcriticalCVE-2026-54141: OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`https://agentprime.io/advisories/CVE-2026-54141/https://agentprime.io/advisories/CVE-2026-54141/CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:35:41 GMTCVEcriticalCVE-2026-111253: Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transactionhttps://agentprime.io/advisories/CVE-2026-111253/https://agentprime.io/advisories/CVE-2026-111253/CVSS 6.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:30:05 GMTCVECVE-2026-54144: OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesturehttps://agentprime.io/advisories/CVE-2026-54144/https://agentprime.io/advisories/CVE-2026-54144/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:14:46 GMTCVECVE-2026-114232: Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource accesshttps://agentprime.io/advisories/CVE-2026-114232/https://agentprime.io/advisories/CVE-2026-114232/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:05:41 GMTCVECVE-2026-119751: Content Egg WordPress Plugin < 12.1.0 Unauthenticated Information Disclosure via render-blockshttps://agentprime.io/advisories/CVE-2026-119751/https://agentprime.io/advisories/CVE-2026-119751/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 15:35:43 GMTCVECVE-2026-122327: Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpointshttps://agentprime.io/advisories/CVE-2026-122327/https://agentprime.io/advisories/CVE-2026-122327/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 15:11:45 GMTCVECVE-2026-122326: Chevereto before 4.5.8 Private Album Image Disclosure via get-album-contentshttps://agentprime.io/advisories/CVE-2026-122326/https://agentprime.io/advisories/CVE-2026-122326/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 15:11:44 GMTCVECVE-2026-122325: eventyay-exhibition through commit f68888e Cross-Event Attendee Data Disclosure via Lead Creation APIhttps://agentprime.io/advisories/CVE-2026-122325/https://agentprime.io/advisories/CVE-2026-122325/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 15:11:44 GMTCVECVE-2026-122324: SplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetailshttps://agentprime.io/advisories/CVE-2026-122324/https://agentprime.io/advisories/CVE-2026-122324/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 15:11:43 GMTCVECVE-2026-122317: SplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Queryhttps://agentprime.io/advisories/CVE-2026-122317/https://agentprime.io/advisories/CVE-2026-122317/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 15:11:42 GMTCVECVE-2026-73580: Apache OFBiz: Unauthenticated HR organization and employee disclosurehttps://agentprime.io/advisories/CVE-2026-73580/https://agentprime.io/advisories/CVE-2026-73580/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:10:09 GMTCVECVE-2026-76150: Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImagehttps://agentprime.io/advisories/CVE-2026-76150/https://agentprime.io/advisories/CVE-2026-76150/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:09:10 GMTCVECVE-2026-81734: Apache OFBiz: Missing authorization - catalog quick-admin product writeshttps://agentprime.io/advisories/CVE-2026-81734/https://agentprime.io/advisories/CVE-2026-81734/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:08:40 GMTCVECVE-2026-76152: Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate serviceshttps://agentprime.io/advisories/CVE-2026-76152/https://agentprime.io/advisories/CVE-2026-76152/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:08:12 GMTCVECVE-2026-81744: Apache OFBiz: Authorization bypass - self-grant content OWNERhttps://agentprime.io/advisories/CVE-2026-81744/https://agentprime.io/advisories/CVE-2026-81744/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:07:49 GMTCVE