# Authentication bypass.

Getting in without valid credentials: missing or broken authentication, sessions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '\_acf_objects' Object Identifier](https://agentprime.io/advisories/CVE-2026-75816.md)
  `CVE-2026-75816` · CVE record: shabti Frontend Admin by DynamiApps · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Sept 2026 · Tags: Authentication bypass
- [HivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator](https://agentprime.io/advisories/CVE-2026-18056.md)
  `CVE-2026-18056` · CVE record: hivepress HivePress Authentication · CVSS 7.5 High · Not analysed yet · Published 6 Sept 2026 · Tags: Authentication bypass
- [Kernel memory disclosure and denial of service in MikroTik RouterOS btest service](https://agentprime.io/advisories/CVE-2026-67277.md)
  `CVE-2026-67277` · CVE record: Mikrotik RouterOS · CVSS 8.8 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 5 Sept 2026 · Tags: Authentication bypass
- [Grav API Plugin before 1.0.20 Authentication Bypass via Host Header](https://agentprime.io/advisories/CVE-2026-86196.md)
  `CVE-2026-86196` · CVE record: getgrav grav-plugin-api · CVSS 8.7 High · Not analysed yet · Published 5 Sept 2026 · Tags: Authentication bypass
- [AVideo API Rate Limit Bypass via Bot User-Agent Header](https://agentprime.io/advisories/CVE-2026-86186.md)
  `CVE-2026-86186` · CVE record: WWBN AVideo · CVSS 6.3 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: Authentication bypass
- [Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route](https://agentprime.io/advisories/CVE-2026-86184.md)
  `CVE-2026-86184` · CVE record: laradashboard laradashboard · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Authentication bypass
- [AutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command Server](https://agentprime.io/advisories/CVE-2026-86124.md)
  `CVE-2026-86124` · CVE record: HKUDS AutoAgent · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Authentication bypass
- [Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control](https://agentprime.io/advisories/CVE-2026-86121.md)
  `CVE-2026-86121` · CVE record: trycua cua-computer-server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Authentication bypass
- [Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching](https://agentprime.io/advisories/CVE-2026-86117.md)
  `CVE-2026-86117` · CVE record: coollabsio coolify · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Authentication bypass
- [RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation](https://agentprime.io/advisories/CVE-2026-77826.md)
  `CVE-2026-77826` · CVE record: Unknown RegistrationMagic · CVSS 8.8 High · Not analysed yet · Published 5 Sept 2026 · Tags: Authentication bypass
- [MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery](https://agentprime.io/advisories/CVE-2026-13447.md)
  `CVE-2026-13447` · CVE record: inspireui MStore API – Create Native Android & iOS Apps On The Cloud · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Authentication bypass
- [TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop](https://agentprime.io/advisories/GHSA-7q9c-hpx7-9cwm.md)
  `GHSA-7q9c-hpx7-9cwm` · npm `@typespec/spector`: affected `<0.1.0-alpha.27`, fixed in `0.1.0-alpha.27` · CVSS 7.5 High · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation](https://agentprime.io/advisories/GHSA-rh53-xvx2-j327.md)
  `GHSA-rh53-xvx2-j327`, `CVE-2026-73842`, `GO-2026-6428` · Go `github.com/openchoreo/openchoreo`: affected `<1.0.3 || >=1.1.0, <1.1.3 || >=1.2.0-rc.1, <1.2.0`, fixed in `1.0.3`, `1.1.3`, `1.2.0` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Privilege escalation, Authentication bypass, Broken access control
- [ramon-victor freegpt-webui Backend Conversation API backend.py \_conversation missing authentication](https://agentprime.io/advisories/CVE-2026-85702.md)
  `CVE-2026-85702` · CVE record: ramon-victor freegpt-webui · CVSS 6.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [ramon-victor freegpt-webui Authentication Check \_\_init\_\_.py ChatCompletion.create missing authentication](https://agentprime.io/advisories/CVE-2026-85701.md)
  `CVE-2026-85701` · CVE record: ramon-victor freegpt-webui · CVSS 6.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [jofpin trape Admin Endpoint sockets.py join_room missing authentication](https://agentprime.io/advisories/CVE-2026-85637.md)
  `CVE-2026-85637` · CVE record: jofpin trape · CVSS 6.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [Frappe CRM: Authentication Bypass via Logged Invitation Keys in crm/api](https://agentprime.io/advisories/CVE-2026-53761.md)
  `CVE-2026-53761` · CVE record: frappe crm · CVSS 8.2 High · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [jofpin trape Login Endpoint stats.py missing authentication](https://agentprime.io/advisories/CVE-2026-85636.md)
  `CVE-2026-85636` · CVE record: jofpin trape · CVSS 6.9 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [Nango < 0.71.6 Missing Authentication RCE via runner tRPC server](https://agentprime.io/advisories/CVE-2026-9317.md)
  `CVE-2026-9317` · CVE record: NangoHQ nango · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [SolidInvoice's user invitation tokens have no expiry, allowing indefinite unauthorized company access via leaked or old invitation links](https://agentprime.io/advisories/CVE-2026-61608.md)
  `CVE-2026-61608` · CVE record: SolidInvoice SolidInvoice · CVSS 6.8 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [IBM i is Affected By An Improper Authentication Vulnerability in Network Authentication Service \[\]](https://agentprime.io/advisories/CVE-2026-16892.md)
  `CVE-2026-16892` · CVE record: IBM i · CVSS 5.4 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [IBM i is Affected By Denial of Service Vulnerabilities in NFS \[, \]](https://agentprime.io/advisories/CVE-2026-17057.md)
  `CVE-2026-17057` · CVE record: IBM i · CVSS 6.5 Medium · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA \[, \]](https://agentprime.io/advisories/CVE-2026-18221.md)
  `CVE-2026-18221` · CVE record: IBM i · CVSS 8.1 High · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [FastChat Unauthenticated Worker Registration SSRF and Model Spoofing](https://agentprime.io/advisories/CVE-2026-85695.md)
  `CVE-2026-85695` · CVE record: lm-sys FastChat · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer](https://agentprime.io/advisories/CVE-2026-85688.md)
  `CVE-2026-85688` · CVE record: TEN-framework ten-framework · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [QAnything 2.0.0 Unauthenticated Cross-User File Disclosure](https://agentprime.io/advisories/CVE-2026-85671.md)
  `CVE-2026-85671` · CVE record: netease-youdao QAnything · CVSS 8.7 High · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [xiaobei through 5.5.2 Unauthenticated Webhook Message Injection](https://agentprime.io/advisories/CVE-2026-85667.md)
  `CVE-2026-85667` · CVE record: TeamWiseFlow xiaobei · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch](https://agentprime.io/advisories/CVE-2026-85663.md)
  `CVE-2026-85663` · CVE record: aimhubio aim · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [Traefik v3.7 Authentication Bypass via TLS Option Conflict](https://agentprime.io/advisories/CVE-2026-85596.md)
  `CVE-2026-85596` · CVE record: traefik traefik · CVSS 8.2 High · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth](https://agentprime.io/advisories/CVE-2026-85595.md)
  `CVE-2026-85595` · CVE record: traefik traefik · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in ASUS Control Center Enterprise (ACC)](https://agentprime.io/advisories/CVE-2026-75754.md)
  `CVE-2026-75754` · CVE record: ASUS Control Center Enterprise (ACC) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass, Hard-coded credentials, Server-side request forgery (SSRF)
- [No authentication exists in the MQTT service of Trueview 6.0.23.4.](https://agentprime.io/advisories/CVE-2026-79391.md)
  `CVE-2026-79391` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port.](https://agentprime.io/advisories/CVE-2026-75430.md)
  `CVE-2026-75430` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer](https://agentprime.io/advisories/CVE-2026-75429.md)
  `CVE-2026-75429` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component.](https://agentprime.io/advisories/CVE-2026-75171.md)
  `CVE-2026-75171` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [Microsoft Entra ID Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-62916.md)
  `CVE-2026-62916` · CVE record: Microsoft Microsoft Entra · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [Azure AI Language Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-70352.md)
  `CVE-2026-70352` · CVE record: Microsoft Azure AI Language Authoring · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [MOOS core-moos through 10.4.0 MOOSDB Message Source Spoofing via Wire Identity](https://agentprime.io/advisories/CVE-2026-85432.md)
  `CVE-2026-85432` · CVE record: themoos core-moos · CVSS 8.8 High · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write](https://agentprime.io/advisories/CVE-2026-85428.md)
  `CVE-2026-85428` · CVE record: themoos core-moos · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [MOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB_CLEAR](https://agentprime.io/advisories/CVE-2026-85424.md)
  `CVE-2026-85424` · CVE record: themoos core-moos · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy](https://agentprime.io/advisories/GHSA-3mp7-4rh5-jrv9.md)
  `GHSA-3mp7-4rh5-jrv9`, `CVE-2026-72809`, `GO-2026-6386` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260723031701-9c16e9851f0b`, fixed in `0.0.0-20260723031701-9c16e9851f0b` · CVSS 7.1 High · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading\*Transaction / getBacklinkDoc (publish mode)](https://agentprime.io/advisories/GHSA-7j72-f6wg-cxw6.md)
  `GHSA-7j72-f6wg-cxw6`, `CVE-2026-68584`, `GO-2026-6382` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260721020826-2d069dce84a2`, fixed in `0.0.0-20260721020826-2d069dce84a2` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [Claude Code Templates: Unauthenticated OS command injection (RCE) in Claude Code Studio server (--studio)](https://agentprime.io/advisories/GHSA-79wm-x847-7cvg.md)
  `GHSA-79wm-x847-7cvg`, `CVE-2026-73222` · npm `claude-code-templates`: affected `<1.29.4`, fixed in `1.29.4` · CVSS 8.8 High · Not analysed yet · Published 3 Sept 2026 · Tags: Command injection, Authentication bypass, Cross-site request forgery (CSRF)
- [WordPress Really Simple SSL plugin <= 9.8.0 - 2FA Bypass vulnerability](https://agentprime.io/advisories/CVE-2026-84777.md)
  `CVE-2026-84777` · CVE record: Really Simple Plugins Really Simple SSL · CVSS 7.4 High · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [WordPress FluentBooking Pro plugin <= 2.2.1 - Bypass Vulnerability vulnerability](https://agentprime.io/advisories/CVE-2026-84766.md)
  `CVE-2026-84766` · CVE record: WP Manage Ninja FluentBooking Pro · CVSS 5.9 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [WordPress Pre-Orders for WooCommerce plugin <= 2.3 - Bypass Vulnerability vulnerability](https://agentprime.io/advisories/CVE-2026-84849.md)
  `CVE-2026-84849` · CVE record: brightvesseldev Pre-Orders for WooCommerce · CVSS 6.5 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking](https://agentprime.io/advisories/CVE-2026-85238.md)
  `CVE-2026-85238` · CVE record: misp misp · CVSS 7.6 High · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [ColdFusion | Improper Authentication (CWE-287)](https://agentprime.io/advisories/CVE-2026-83961.md)
  `CVE-2026-83961` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 7.1 High · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass](https://agentprime.io/advisories/CVE-2026-85237.md)
  `CVE-2026-85237` · CVE record: misp misp · CVSS 8.6 High · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [Rancher: SAML Assertion Replay](https://agentprime.io/advisories/CVE-2026-75034.md)
  `CVE-2026-75034` · CVE record: SUSE Rancher · CVSS 7.4 High · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [Improper certificate validation in Eclipse Foundation Eclipse Arrowhead](https://agentprime.io/advisories/CVE-2026-82180.md)
  `CVE-2026-82180` · CVE record: Eclipse Foundation Eclipse Arrowhead · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [NSEC wraparound detection trusted an unvalidated SOA record](https://agentprime.io/advisories/GHSA-qw83-5pm2-ggp5.md)
  `GHSA-qw83-5pm2-ggp5`, `CVE-2026-123587`, `RUSTSEC-2026-0508` · crates.io `hickory-net`: affected `>=0.26.0, <0.26.2`, fixed in `0.26.2` · CVSS 8.9 High · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [NSEC3 owner names not checked against the zone in DNSSEC validation (hickory-proto)](https://agentprime.io/advisories/GHSA-p2jv-r3m3-7wf4.md)
  `GHSA-p2jv-r3m3-7wf4`, `CVE-2026-123580`, `RUSTSEC-2026-0505`, `RUSTSEC-2026-0509` · crates.io `hickory-proto`: affected `>=0.0.0-0, <0.26.0-beta.1`, fixed in `0.26.0-beta.1` · CVSS 8.7 High · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [Mandatory MFA bypass before enrollment](https://agentprime.io/advisories/CVE-2026-84831.md)
  `CVE-2026-84831` · CVE record: SEPPmail AG SEPPmail Secure Email Gateway (SEG) · CVSS 7.7 High · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting thems…](https://agentprime.io/advisories/CVE-2026-9854.md)
  `CVE-2026-9854` · CVE record: Hitachi Energy MicroSCADA SYS600 · CVSS 8.5 High · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated t…](https://agentprime.io/advisories/CVE-2026-9853.md)
  `CVE-2026-9853` · CVE record: Hitachi Energy MicroSCADA SYS600 · CVSS 8.5 High · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)](https://agentprime.io/advisories/GHSA-c5f6-2rm9-2w8g.md)
  `GHSA-c5f6-2rm9-2w8g`, `CVE-2026-73840`, `GO-2026-6360` · Go `github.com/openchoreo/openchoreo`: affected `<1.0.3 || >=1.1.0, <1.1.3 || >=1.2.0-rc.1, <1.2.0-rc.2`, fixed in `1.0.3`, `1.1.3`, `1.2.0-rc.2` · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass, CWE-345
- [OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs](https://agentprime.io/advisories/GHSA-qh9r-j7rp-4x2m.md)
  `GHSA-qh9r-j7rp-4x2m`, `CVE-2026-73843`, `GO-2026-6362` · Go `github.com/openchoreo/openchoreo`: affected `<1.0.2 || >=1.1.0, <1.1.2`, fixed in `1.0.2`, `1.1.2` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass, Information disclosure, Broken access control
- [Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends](https://agentprime.io/advisories/GHSA-9468-v6mj-fppw.md)
  `GHSA-9468-v6mj-fppw`, `CVE-2026-71485`, `GO-2026-6490` · Go `github.com/centrifugal/centrifugo`: affected `<6.9.0`, fixed in `6.9.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge](https://agentprime.io/advisories/GHSA-7mgc-c7pq-3rr3.md)
  `GHSA-7mgc-c7pq-3rr3`, `CVE-2026-62232`, `CVE-2026-62669`, `PKSA-p6yn-thc9-dbs3` · Packagist `getgrav/grav`: affected `<2.0.4`, fixed in `2.0.4` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass, Broken access control

Newest: <https://agentprime.io/advisories/tag/auth-bypass.md>
Older: <https://agentprime.io/advisories/tag/auth-bypass.md?cursor=WyIyMDI2LTA5LTAyVDIyOjAxOjI1LjAwMDAwMFoiLCJHSFNBLTdtZ2MtYzdwcS0zcnIzIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=auth-bypass&cursor=WyIyMDI2LTA5LTA2VDExOjIwOjExLjc1OTAwMFoiLCJDVkUtMjAyNi04NjI0MiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/auth-bypass/?cursor=WyIyMDI2LTA5LTA2VDExOjIwOjExLjc1OTAwMFoiLCJDVkUtMjAyNi04NjI0MiJd>. Everything for agents: <https://agentprime.io/llms.txt>.