agentprime: Authentication bypassEvery new Authentication bypass Advisory and CVE.https://agentprime.io/CVE-2026-107492: Improper authentication in envoyhttps://agentprime.io/advisories/CVE-2026-107492/https://agentprime.io/advisories/CVE-2026-107492/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 06 Nov 2026 00:43:07 GMTCVEcriticalCVE-2026-110390: FlexNet Beacon Missing Authentication Vulnerabilityhttps://agentprime.io/advisories/CVE-2026-110390/https://agentprime.io/advisories/CVE-2026-110390/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 22:32:44 GMTCVECVE-2026-111493: Lack of authentication and authorization in the Images.ashx endpoint in MatchPointhttps://agentprime.io/advisories/CVE-2026-111493/https://agentprime.io/advisories/CVE-2026-111493/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 21:56:17 GMTCVECVE-2026-103020: OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versionshttps://agentprime.io/advisories/CVE-2026-103020/https://agentprime.io/advisories/CVE-2026-103020/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 20:05:26 GMTCVECVE-2026-116790: FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITYhttps://agentprime.io/advisories/CVE-2026-116790/https://agentprime.io/advisories/CVE-2026-116790/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 19:40:51 GMTCVEcriticalCVE-2026-123208: noname v1.11.2 through v1.11.6.1 Missing Authentication in Electron Local File Serverhttps://agentprime.io/advisories/CVE-2026-123208/https://agentprime.io/advisories/CVE-2026-123208/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:16:42 GMTCVECVE-2026-123206: EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:keyhttps://agentprime.io/advisories/CVE-2026-123206/https://agentprime.io/advisories/CVE-2026-123206/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:16:41 GMTCVECVE-2026-97847: Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authorityhttps://agentprime.io/advisories/CVE-2026-97847/https://agentprime.io/advisories/CVE-2026-97847/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:16:10 GMTCVECVE-2026-97175: Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeoverhttps://agentprime.io/advisories/CVE-2026-97175/https://agentprime.io/advisories/CVE-2026-97175/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:16:04 GMTCVECVE-2026-92855: Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possessionhttps://agentprime.io/advisories/CVE-2026-92855/https://agentprime.io/advisories/CVE-2026-92855/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:15:07 GMTCVECVE-2026-49407: OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unbounded memory growthhttps://agentprime.io/advisories/CVE-2026-49407/https://agentprime.io/advisories/CVE-2026-49407/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:46:35 GMTCVECVE-2026-49393: OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core controllers without the Bearer tokenhttps://agentprime.io/advisories/CVE-2026-49393/https://agentprime.io/advisories/CVE-2026-49393/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:34:55 GMTCVECVE-2026-49405: OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event datahttps://agentprime.io/advisories/CVE-2026-49405/https://agentprime.io/advisories/CVE-2026-49405/CVSS 6.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:33:23 GMTCVECVE-2026-121139: Rapid7 Metasploit Framework Web Service unauthenticated bootstrap window allows creation of an administrator account without authenticationhttps://agentprime.io/advisories/CVE-2026-121139/https://agentprime.io/advisories/CVE-2026-121139/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 15:24:48 GMTCVECVE-2026-119744: Cendio ThinLinc Improper Authentication via Web Accesshttps://agentprime.io/advisories/CVE-2026-119744/https://agentprime.io/advisories/CVE-2026-119744/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:50:42 GMTCVECVE-2026-123032: OpenBMB Internet of Agents WebSocket Connection Manager app.py ConnectionManager.connect missing authenticationhttps://agentprime.io/advisories/CVE-2026-123032/https://agentprime.io/advisories/CVE-2026-123032/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:15:09 GMTCVECVE-2026-73577: Apache OFBiz: Unauthenticated path-suffix view authorization bypasshttps://agentprime.io/advisories/CVE-2026-73577/https://agentprime.io/advisories/CVE-2026-73577/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:11:06 GMTCVECVE-2026-73578: Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impacthttps://agentprime.io/advisories/CVE-2026-73578/https://agentprime.io/advisories/CVE-2026-73578/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:10:39 GMTCVECVE-2026-82907: Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unboundhttps://agentprime.io/advisories/CVE-2026-82907/https://agentprime.io/advisories/CVE-2026-82907/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 14:04:07 GMTCVEcriticalCVE-2026-92887: Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operationhttps://agentprime.io/advisories/CVE-2026-92887/https://agentprime.io/advisories/CVE-2026-92887/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:45:53 GMTCVECVE-2026-123024: agentscope-ai AgentScope Agent Service deps.py get_current_user_id missing authenticationhttps://agentprime.io/advisories/CVE-2026-123024/https://agentprime.io/advisories/CVE-2026-123024/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:45:17 GMTCVECVE-2026-109928: Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeoverhttps://agentprime.io/advisories/CVE-2026-109928/https://agentprime.io/advisories/CVE-2026-109928/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:36:52 GMTCVECVE-2026-123033: Authentication bypass by spoofing in iXsystems TrueNAS SCALEhttps://agentprime.io/advisories/CVE-2026-123033/https://agentprime.io/advisories/CVE-2026-123033/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 06:58:31 GMTCVECVE-2026-123017: Authentication bypass by spoofing in GodotSteamhttps://agentprime.io/advisories/CVE-2026-123017/https://agentprime.io/advisories/CVE-2026-123017/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 06:17:04 GMTCVECVE-2026-122236: OpenHands Landing missing authenticationhttps://agentprime.io/advisories/CVE-2026-122236/https://agentprime.io/advisories/CVE-2026-122236/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 03:45:18 GMTCVECVE-2026-122049: Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authenticationhttps://agentprime.io/advisories/CVE-2026-122049/https://agentprime.io/advisories/CVE-2026-122049/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 23:15:11 GMTCVECVE-2026-54384: VitaFit Cloud API Authentication Bypass via POST /front/login/sns/https://agentprime.io/advisories/CVE-2026-54384/https://agentprime.io/advisories/CVE-2026-54384/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 22:23:39 GMTCVEcriticalCVE-2026-52848: GLPI: MFA bypasshttps://agentprime.io/advisories/CVE-2026-52848/https://agentprime.io/advisories/CVE-2026-52848/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 22:21:48 GMTCVEcriticalCVE-2026-54375: VitaFit Android < 2.8.1.0 Long-Lived Session Token Exposurehttps://agentprime.io/advisories/CVE-2026-54375/https://agentprime.io/advisories/CVE-2026-54375/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 21:54:23 GMTCVECVE-2026-102894: GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeoverhttps://agentprime.io/advisories/CVE-2026-102894/https://agentprime.io/advisories/CVE-2026-102894/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 21:18:29 GMTCVEcriticalCVE-2026-102895: GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated adminhttps://agentprime.io/advisories/CVE-2026-102895/https://agentprime.io/advisories/CVE-2026-102895/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 21:16:59 GMTCVEcriticalCVE-2026-104203: Traccar: Authentication bypass via path parameters exposes protected device mediahttps://agentprime.io/advisories/CVE-2026-104203/https://agentprime.io/advisories/CVE-2026-104203/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 20:47:02 GMTCVECVE-2026-102340: Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secretshttps://agentprime.io/advisories/CVE-2026-102340/https://agentprime.io/advisories/CVE-2026-102340/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 20:39:55 GMTCVECVE-2026-122138: BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypasshttps://agentprime.io/advisories/CVE-2026-122138/https://agentprime.io/advisories/CVE-2026-122138/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 20:36:55 GMTCVECVE-2026-122220: WPO365 LOGIN before 45.2 SAML Replay Protection Bypasshttps://agentprime.io/advisories/CVE-2026-122220/https://agentprime.io/advisories/CVE-2026-122220/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 20:09:07 GMTCVEcriticalCVE-2026-113373: Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Againhttps://agentprime.io/advisories/CVE-2026-113373/https://agentprime.io/advisories/CVE-2026-113373/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 20:01:19 GMTCVEcriticalCVE-2026-121933: Linksys E5350 Setup Wizard apply.cgi save_settings missing authenticationhttps://agentprime.io/advisories/CVE-2026-121933/https://agentprime.io/advisories/CVE-2026-121933/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 19:15:17 GMTCVEcriticalCVE-2026-82033: DeepSeek Harness Unauthenticated RPC Command Executionhttps://agentprime.io/advisories/CVE-2026-82033/https://agentprime.io/advisories/CVE-2026-82033/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 18:42:26 GMTCVECVE-2026-121926: yezhihao jt808-server Web Management API WebMvcConfig.addInterceptors missing authenticationhttps://agentprime.io/advisories/CVE-2026-121926/https://agentprime.io/advisories/CVE-2026-121926/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 17:00:16 GMTCVECVE-2026-119746: ProSoft ICX35 Login Lockout Bypass via Client-Side Cookieshttps://agentprime.io/advisories/CVE-2026-119746/https://agentprime.io/advisories/CVE-2026-119746/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 15:39:12 GMTCVECVE-2026-92704: SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process executionhttps://agentprime.io/advisories/CVE-2026-92704/https://agentprime.io/advisories/CVE-2026-92704/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 15:24:16 GMTCVECVE-2026-121639: WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Servicehttps://agentprime.io/advisories/CVE-2026-121639/https://agentprime.io/advisories/CVE-2026-121639/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 14:44:14 GMTCVEcriticalCVE-2026-121640: WatchGuard AuthPoint Gateway Capture-replay Allows Unauthorized Administrative Actionshttps://agentprime.io/advisories/CVE-2026-121640/https://agentprime.io/advisories/CVE-2026-121640/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 14:44:14 GMTCVEcriticalCVE-2026-119776: frr: ospf6d fails to enforce all OSPFv3 packets use IPv6 link-local addresseshttps://agentprime.io/advisories/CVE-2026-119776/https://agentprime.io/advisories/CVE-2026-119776/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 14:15:32 GMTCVECVE-2026-121939: Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linkinghttps://agentprime.io/advisories/CVE-2026-121939/https://agentprime.io/advisories/CVE-2026-121939/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 12:31:18 GMTCVEcriticalCVE-2026-118513: X509Authenticator and X509AuthenticationListener Read Escaped RFC 2253 Commas and Bare Slashes Inside a DN Value as RDN Boundaries: Incomplete Fix for CVE-2026-45063https://agentprime.io/advisories/PKSA-k1xt-28gt-fw9y/https://agentprime.io/advisories/PKSA-k1xt-28gt-fw9y/symfony/security-http >=2.0.0, <3.0.0 || >=3.0.0, <4.0.0 || >=4.0.0, <5.0.0 || >=5.0.0, <5.1.0 || >=5.1.0, <5.2.0 || >=5.2.0, <5.3.0 || >=5.3.0, <5.4.0 || >=5.4.0, <5.4.56 || >=6.0.0, <6.1.0 || >=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11, fixed in 3.0.0, 4.0.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.56, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.50, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.23, 8.1.0, 8.1.11. CVSS 7.7 (High). Published by Packagist. Not analysed by agentprime yet.Wed, 04 Nov 2026 10:45:07 GMTPackagistsymfony/security-httpCVE-2026-118513: X509Authenticator and X509AuthenticationListener Read Escaped RFC 2253 Commas and Bare Slashes Inside a DN Value as RDN Boundaries: Incomplete Fix for CVE-2026-45063https://agentprime.io/advisories/PKSA-8s76-qdyv-tvyf/https://agentprime.io/advisories/PKSA-8s76-qdyv-tvyf/symfony/symfony >=2.0.0, <3.0.0 || >=3.0.0, <4.0.0 || >=4.0.0, <5.0.0 || >=5.0.0, <5.1.0 || >=5.1.0, <5.2.0 || >=5.2.0, <5.3.0 || >=5.3.0, <5.4.0 || >=5.4.0, <5.4.56 || >=6.0.0, <6.1.0 || >=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11, fixed in 3.0.0, 4.0.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.56, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.50, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.23, 8.1.0, 8.1.11. CVSS 7.7 (High). Published by Packagist. Not analysed by agentprime yet.Wed, 04 Nov 2026 10:45:07 GMTPackagistsymfony/symfonyCVE-2026-57775: WordPress Simple Cloudflare Turnstile plugin <= 1.44.1 - Broken Authentication vulnerabilityhttps://agentprime.io/advisories/CVE-2026-57775/https://agentprime.io/advisories/CVE-2026-57775/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 08:00:16 GMTCVECVE-2026-121816: About Time Technologies｜Herowatch Mini - Missing Authenticationhttps://agentprime.io/advisories/CVE-2026-121816/https://agentprime.io/advisories/CVE-2026-121816/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 06:24:31 GMTCVECVE-2026-121615: Linksys E5600 Login mesh_login.cgi improper authenticationhttps://agentprime.io/advisories/CVE-2026-121615/https://agentprime.io/advisories/CVE-2026-121615/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 02:15:20 GMTCVEcritical