agentprime: CWE-116

CVE-2026-102345: Zammad: Stored XSS in ticket article rendering in the new Vue-based interface

Wed, 04 Nov 2026 18:59:57 GMT

CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-120647: CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename

Tue, 03 Nov 2026 23:41:05 GMT

Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-120644: CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values

Tue, 03 Nov 2026 23:40:51 GMT

Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-63471: fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator

Tue, 03 Nov 2026 19:18:44 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-63469: fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict

Tue, 03 Nov 2026 19:15:54 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-63470: fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring

Tue, 03 Nov 2026 19:13:47 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels

Tue, 03 Nov 2026 17:51:30 GMT

@enspirit/elo <1.0.1, fixed in 1.0.1. CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2024-12139: Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks

Mon, 02 Nov 2026 17:34:20 GMT

CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-83559: Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal

Sun, 01 Nov 2026 22:19:47 GMT

CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-63346: Refitter: C# source injection through OpenAPI header parameter names

Fri, 30 Oct 2026 22:17:02 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-63344: Refitter: C# source injection through OpenAPI content-type map keys

Fri, 30 Oct 2026 22:15:27 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-104368: Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field

Fri, 30 Oct 2026 04:32:43 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

Seroval: Script injection through RegExp sources in serialized output

Wed, 28 Oct 2026 21:17:31 GMT

seroval <1.0.0 || >=1.5.5, <1.6.10, fixed in 1.0.0, 1.6.10. CVSS 4.7 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list

Wed, 28 Oct 2026 21:06:34 GMT

@intlify/core >=9.0.0-beta.10, <11.4.14 || >=12.0.0-alpha.1, <12.0.0-alpha.5, fixed in 11.4.14, 12.0.0-alpha.5. CVSS 2.1 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages

Wed, 28 Oct 2026 21:06:24 GMT

@intlify/core >=11.1.10, <11.4.14 || >=12.0.0-alpha.4, <12.0.0-alpha.5, fixed in 11.4.14, 12.0.0-alpha.5. CVSS 7.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content

Tue, 27 Oct 2026 15:32:45 GMT

flexible-graphrag >=0.6.0, <0.8.2, fixed in 0.8.2. CVSS 7.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Satori-generated SVG has improper escaping

Tue, 27 Oct 2026 14:46:43 GMT

satori >=0.0.27, <0.33.5, fixed in 0.33.5. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-110910: qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection

Tue, 27 Oct 2026 06:42:42 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-116815: OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts

Mon, 26 Oct 2026 23:05:44 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

Fri, 23 Oct 2026 21:36:40 GMT

fast-uri <2.4.8 || >=3.0.0, <3.1.9 || >=4.0.0, <4.2.3, fixed in 2.4.8, 3.1.9, 4.2.3. CVSS 3.7 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-55442: Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection

Fri, 23 Oct 2026 14:14:26 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Vitest: Code injection via unauthenticated manual mock registration

Wed, 21 Oct 2026 19:54:26 GMT

@vitest/mocker >=2.1.0-beta.7, <4.1.12 || >=5.0.0-beta.1, <5.0.3, fixed in 4.1.12, 5.0.3. CVSS 4.7 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-113870: Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing

Wed, 21 Oct 2026 18:04:30 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

virtualenv bash activate runs commands from an environment name with a backslash before $

Wed, 21 Oct 2026 16:49:01 GMT

virtualenv <21.14.7, fixed in 21.14.7. CVSS 7.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST

Wed, 21 Oct 2026 16:46:23 GMT

virtualenv <21.14.4, fixed in 21.14.4. CVSS 7.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote

Wed, 21 Oct 2026 16:39:58 GMT

virtualenv <21.14.2, fixed in 21.14.2. CVSS 7.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-14556: HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer

Wed, 21 Oct 2026 08:38:59 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-113867: Stanza injection in XMPP chat

Tue, 20 Oct 2026 19:14:55 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

ApostropheCMS: CAPTCHA response token not URL-encoded

Tue, 20 Oct 2026 18:05:35 GMT

@apostrophecms/form <1.5.5, fixed in 1.5.5. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML

Mon, 19 Oct 2026 17:01:20 GMT

mercury >=3.0.0, <3.2.11, fixed in 3.2.11. CVSS 6.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-110757: Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine

Fri, 16 Oct 2026 22:07:56 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-110756: Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print

Fri, 16 Oct 2026 22:07:37 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

swoosh has email-derived URL path injection in Microsoft Graph endpoint

Fri, 16 Oct 2026 19:22:31 GMT

swoosh >=1.12.0, <1.26.3, fixed in 1.26.3. CVSS 2.1 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-18516: Improper Encoding or Escaping of Output in Crafty Controller

Fri, 16 Oct 2026 13:37:55 GMT

CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Vitess vttablet /twopcz reflected XSS

Thu, 15 Oct 2026 20:16:29 GMT

vitess.io/vitess <0.23.5 || >=0.24.0, <0.24.2, fixed in 0.23.5, 0.24.2. CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

unstructured: Stored XSS via unescaped HTML generation

Thu, 15 Oct 2026 20:16:18 GMT

unstructured <0.24.1, fixed in 0.24.1. CVSS 6.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-110592: BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template

Wed, 14 Oct 2026 14:16:37 GMT

CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-105429: NetBird client SSH config Match line injection via peer FQDN or hostname allows local command execution

Wed, 14 Oct 2026 04:33:44 GMT

CVSS 8.9 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-102235: Visual Studio Code Remote Code Execution Vulnerability

Tue, 13 Oct 2026 18:59:27 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-93693: Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller

Mon, 12 Oct 2026 12:48:53 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Contao: Cross-site scripting in the comments bundle

Fri, 09 Oct 2026 20:53:50 GMT

contao/comments-bundle >=4.0.0, <5.3.50 || >=5.4.0-RC1, <5.7.12, fixed in 5.3.50, 5.7.12. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-107823: MariaDB: privilege escalation via incorrect view frm parsing

Fri, 09 Oct 2026 17:30:36 GMT

CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-107393: FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header

Thu, 08 Oct 2026 19:52:23 GMT

CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source

Thu, 08 Oct 2026 19:36:29 GMT

praisonai <4.6.78, fixed in 4.6.78. CVSS 8.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates

Thu, 08 Oct 2026 17:52:37 GMT

handlebars >=4.0.0, <4.7.10, fixed in 4.7.10. CVSS 4.7 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

Wed, 07 Oct 2026 20:43:58 GMT

praisonai <4.6.78, fixed in 4.6.78. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained

Wed, 07 Oct 2026 16:16:03 GMT

@quasar/app-vite <3.3.0, fixed in 3.3.0. CVSS 8.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()

Wed, 07 Oct 2026 16:14:22 GMT

quasar <2.22.0, fixed in 2.22.0. CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-105244: Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content

Tue, 06 Oct 2026 19:52:31 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation

Tue, 06 Oct 2026 15:32:53 GMT

openapi-python-client <0.29.1, fixed in 0.29.1. CVSS 8.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.