# CWE-1188.

Every Advisory and CVE whose sources give the weakness CWE-1188, newest first.

## Records, newest first

- [Apache James: WebAdmin exposed without authentication on official Docker default](https://agentprime.io/advisories/CVE-2026-74756.md)
  `CVE-2026-74756` · CVE record: Apache Software Foundation Apache James · No CVSS score · Not analysed yet · Published 6 Nov 2026 · Tags: CWE-1188
- [Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation](https://agentprime.io/advisories/CVE-2026-92887.md)
  `CVE-2026-92887` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass, CWE-1188
- [The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagi…](https://agentprime.io/advisories/CVE-2026-122006.md)
  `CVE-2026-122006` · CVE record: rubyonrails Active Storage · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-1188
- [node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound \`DefaultRolePermissions](https://agentprime.io/advisories/CVE-2026-95860.md)
  `CVE-2026-95860` · CVE record: node-opcua node-opcua · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control, CWE-636, CWE-1188
- [Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host](https://agentprime.io/advisories/CVE-2026-120091.md)
  `CVE-2026-120091` · CVE record: Temporal Technologies, Inc. Temporal Server · CVSS 8.7 High · Not analysed yet · Published 2 Nov 2026 · Tags: Command injection, Broken access control, CWE-749, CWE-1188
- [WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page](https://agentprime.io/advisories/CVE-2026-78192.md)
  `CVE-2026-78192` · CVE record · CVSS 7.5 High · Not analysed yet · Published 31 Oct 2026 · Tags: CWE-540, CWE-1188
- [Authlib RFC 7592 examples omit registration-access-token client binding](https://agentprime.io/advisories/GHSA-c73q-w75p-j82v.md)
  `GHSA-c73q-w75p-j82v`, `CVE-2026-116672` · PyPI `authlib`: affected `>=0.15, <1.9.1`, fixed in `1.9.1` · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control, CWE-1188
- [pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate](https://agentprime.io/advisories/CVE-2026-116247.md)
  `CVE-2026-116247` · CVE record: pgadmin.org pgAdmin 4 · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Hard-coded credentials, CWE-1188
- [pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials](https://agentprime.io/advisories/CVE-2026-116244.md)
  `CVE-2026-116244` · CVE record: pgadmin.org pgAdmin 4 · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Hard-coded credentials, CWE-1188
- [pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity](https://agentprime.io/advisories/CVE-2026-116242.md)
  `CVE-2026-116242` · CVE record: pgadmin.org pgAdmin 4 · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Hard-coded credentials, CWE-1188
- [Endpoint credential minting (insecure default allow-list)](https://agentprime.io/advisories/CVE-2026-112255.md)
  `CVE-2026-112255` · CVE record: OpenText Advanced Authentication Server · CVSS 2.9 Low · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-1188
- [xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-message](https://agentprime.io/advisories/CVE-2026-118691.md)
  `CVE-2026-118691` · CVE record: GuDong2003 xianyu-auto-reply-fix · CVSS 6.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-1188
- [MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustion](https://agentprime.io/advisories/CVE-2026-116273.md)
  `CVE-2026-116273` · CVE record · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service, CWE-1188
- [Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default](https://agentprime.io/advisories/CVE-2026-110952.md)
  `CVE-2026-110952` · CVE record: Apache Software Foundation Apache Kafka · CVSS 5.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-345, CWE-1188
- [Authlib: Default JWT bearer grant accepts assertions for the wrong audience](https://agentprime.io/advisories/GHSA-fch4-3c6x-j4gc.md)
  `GHSA-fch4-3c6x-j4gc`, `CVE-2026-114618`, `PYSEC-2026-4358` · PyPI `authlib`: affected `<1.9.0`, fixed in `1.9.0` · CVSS 6.8 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Authentication bypass, CWE-1188
- [bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop](https://agentprime.io/advisories/CVE-2026-25784.md)
  `CVE-2026-25784` · CVE record: Hallo Welt! GmbH BlueSpice · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Privilege escalation, CWE-1188
- [Storybook dev server vulnerable to code injection from the local network](https://agentprime.io/advisories/GHSA-px85-f4q5-jh77.md)
  `GHSA-px85-f4q5-jh77`, `CVE-2026-114126` · npm `storybook` and 5 more: affected `>=8.0.0, <8.6.19 || >=9.0.0, <9.1.21 || >=10.0.0, <10.6.2 || >=11.0.0-alpha.0, <11.0.0-alpha.6`, fixed in `8.6.19`, `9.1.21`, `10.6.2`, `11.0.0-alpha.6` · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal, Code injection, Authentication bypass, CWE-1188
- [D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet](https://agentprime.io/advisories/CVE-2026-114123.md)
  `CVE-2026-114123` · CVE record: dynamics365ninja d365fo-mcp-server · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass, CWE-1188
- [Trudesk through 1.2.11 Missing Authentication on Debug Routes](https://agentprime.io/advisories/CVE-2026-114397.md)
  `CVE-2026-114397` · CVE record: polonel trudesk · CVSS 8.3 High · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-1188
- [A2A Java SDK has a fail-open default task authorization](https://agentprime.io/advisories/GHSA-qw47-mcm5-934w.md)
  `GHSA-qw47-mcm5-934w`, `CVE-2026-111764` · Maven `org.a2aproject.sdk:a2a-java-sdk-server-common`: affected `<1.3.0.Final`, fixed in `1.3.0.Final` · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control, CWE-1188
- [Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access](https://agentprime.io/advisories/CVE-2026-77936.md)
  `CVE-2026-77936` · CVE record: letta-ai letta · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-1188
- [Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner](https://agentprime.io/advisories/CVE-2026-77934.md)
  `CVE-2026-77934` · CVE record: coze-dev coze-studio · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-1188
- [Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend](https://agentprime.io/advisories/CVE-2026-109437.md)
  `CVE-2026-109437` · CVE record: CognicellAI Cognition · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass, CWE-1188
- [Apache Kylin: default startup profile miss security settings](https://agentprime.io/advisories/CVE-2026-108833.md)
  `CVE-2026-108833` · CVE record: Apache Software Foundation Apache Kylin · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-1188
- [Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)](https://agentprime.io/advisories/CVE-2026-103091.md)
  `CVE-2026-103091` · CVE record: Google SAM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, Authentication bypass, Broken access control, CWE-1188
- [FileRise: Insecure default cryptographic key fallback in manual installs](https://agentprime.io/advisories/CVE-2026-77427.md)
  `CVE-2026-77427` · CVE record: error311 FileRise · CVSS 5.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Hard-coded credentials, CWE-1188
- [holaOS through 2026.822.1 Missing Authorization in Channel-Gateway Connectors](https://agentprime.io/advisories/CVE-2026-110769.md)
  `CVE-2026-110769` · CVE record: holaboss-ai holaOS · CVSS 8.3 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1188
- [Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration](https://agentprime.io/advisories/CVE-2026-110631.md)
  `CVE-2026-110631` · CVE record: moghtech komodo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1188
- [Epic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURL](https://agentprime.io/advisories/CVE-2026-14765.md)
  `CVE-2026-14765` · CVE record: Epic Games Unreal Engine · CVSS 7.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1188
- [MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery](https://agentprime.io/advisories/CVE-2026-53709.md)
  `CVE-2026-53709` · CVE record: IBM mcp-context-forge · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass, Hard-coded credentials, CWE-1188
- [Missing authorization check in SAP ABAP Platform](https://agentprime.io/advisories/CVE-2026-89120.md)
  `CVE-2026-89120` · CVE record: SAP_SE SAP ABAP Platform · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-1188
- [Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integration-library](https://agentprime.io/advisories/CVE-2026-89105.md)
  `CVE-2026-89105` · CVE record: SAP_SE SAP/cloud-security-services-integration-library · CVSS 4.2 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-1188
- [sandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespace](https://agentprime.io/advisories/CVE-2026-109569.md)
  `CVE-2026-109569` · CVE record: Th0rgal sandboxed.sh · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-1188
- [Dell Secure Connect Gateway (SCG) Policy Manager: Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16…](https://agentprime.io/advisories/CVE-2026-78018.md)
  `CVE-2026-78018` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 6.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-1188
- [Dell Secure Connect Gateway (SCG) Policy Manager: Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16…](https://agentprime.io/advisories/CVE-2026-78013.md)
  `CVE-2026-78013` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 5.2 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-1188
- [Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass](https://agentprime.io/advisories/CVE-2026-104078.md)
  `CVE-2026-104078` · CVE record: Obsidian Obsidian Desktop · CVSS 8.4 High · Not analysed yet · Published 8 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-1188
- [Obsidian Desktop < 1.14.0 RCE via Slides Plugin Markdown](https://agentprime.io/advisories/CVE-2026-104077.md)
  `CVE-2026-104077` · CVE record: Obsidian Obsidian Desktop · CVSS 8.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-1188
- [Information Disclosure in the Discover Splunk Observability Cloud app through Splunk Web for Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76276.md)
  `CVE-2026-76276` · CVE record: Splunk Splunk Enterprise · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-1188
- [PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats](https://agentprime.io/advisories/GHSA-fj8f-m44g-c479.md)
  `GHSA-fj8f-m44g-c479`, `CVE-2026-61439`, `PYSEC-2026-4255` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 8.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-116, CWE-693, CWE-1188, CWE-1287
- [Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine](https://agentprime.io/advisories/GHSA-x3q2-h9hx-4r4j.md)
  `GHSA-x3q2-h9hx-4r4j`, `CVE-2026-105744`, `PYSEC-2026-4191`, `PYSEC-2026-4216` · PyPI `docling` and 1 more: affected `>=2.94.0, <2.132.0`, fixed in `2.132.0` · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal, CWE-1188
- [Authenticated SMTP Sender Address Forgery](https://agentprime.io/advisories/CVE-2026-33586.md)
  `CVE-2026-33586` · CVE record: OVHcloud OVHcloud · CVSS 6.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass, CWE-346, CWE-1188
- [Missing authentication for critical function in Loom for AWS](https://agentprime.io/advisories/CVE-2026-103956.md)
  `CVE-2026-103956` · CVE record: AWS loom · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Authentication bypass, CWE-1188
- [Apache Thrift: Perl TLS client disables certificate verification by default](https://agentprime.io/advisories/CVE-2026-85086.md)
  `CVE-2026-85086` · CVE record: Apache Software Foundation Apache Thrift · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Weak cryptography or TLS, CWE-1188
- [Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a pe…](https://agentprime.io/advisories/CVE-2026-85494.md)
  `CVE-2026-85494` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service, CWE-130, CWE-248, CWE-1188
- [Apache Thrift: Python \`TJSONProtocol\` has a string length limit that is off by default](https://agentprime.io/advisories/CVE-2026-94634.md)
  `CVE-2026-94634` · CVE record: Apache Software Foundation Apache Thrift · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Denial of service, CWE-1188
- [Johnson Controls EasyIO FS32: : Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO…](https://agentprime.io/advisories/CVE-2026-71448.md)
  `CVE-2026-71448` · CVE record: Johnson Controls EasyIO FS32 · CVSS 5.6 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-1188
- [vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts](https://agentprime.io/advisories/GHSA-jxxv-8r27-vm4p.md)
  `GHSA-jxxv-8r27-vm4p`, `CVE-2026-92950` · npm `vm2`: affected `<3.11.7`, fixed in `3.11.7` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-453, CWE-829, CWE-1188
- [JetBrains YouTrack: In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication…](https://agentprime.io/advisories/CVE-2026-100260.md)
  `CVE-2026-100260` · CVE record: JetBrains YouTrack · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-1188
- [Initialization of a resource with an insecure default in Anjvision YSSD-RTMP-H5](https://agentprime.io/advisories/CVE-2026-100291.md)
  `CVE-2026-100291` · CVE record: Anjvision YSSD-RTMP-H5 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-1188
- [Electron: \<webview> can enable Node.js integration in Web Workers despite embedder restrictions](https://agentprime.io/advisories/GHSA-9qh4-3jw8-366w.md)
  `GHSA-9qh4-3jw8-366w`, `CVE-2026-102676` · npm `electron`: affected `<41.10.6 || >=42.0.0-alpha.1, <42.9.2 || >=43.0.0-alpha.1, <43.4.1 || >=44.0.0-alpha.1, <44.0.0-beta.5`, fixed in `41.10.6`, `42.9.2`, `43.4.1`, `44.0.0-beta.5` · CVSS 8.3 High · Not analysed yet · Published 29 Sept 2026 · Tags: Privilege escalation, CWE-1188
- [Dell Secure Connect Gateway (SCG) Policy Manager: Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16…](https://agentprime.io/advisories/CVE-2026-73596.md)
  `CVE-2026-73596` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 3.8 Low · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-1188
- [Taskview Community Missing Authentication via OAuth Dynamic Client Registration](https://agentprime.io/advisories/CVE-2026-93354.md)
  `CVE-2026-93354` · CVE record: Gimanh taskview-community · CVSS 8.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-1188
- [SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret](https://agentprime.io/advisories/CVE-2026-97055.md)
  `CVE-2026-97055` · CVE record: SigNoz signoz · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-1188
- [Apache Tomcat Native: Insecure OpenSSL options enabled](https://agentprime.io/advisories/CVE-2026-86246.md)
  `CVE-2026-86246` · CVE record: Apache Software Foundation Apache Tomcat Native · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-1188
- [Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host](https://agentprime.io/advisories/CVE-2026-89139.md)
  `CVE-2026-89139` · CVE record: Temporal Technologies, Inc. Temporal Server · CVSS 8.7 High · Not analysed yet · Published 21 Sept 2026 · Tags: Command injection, CWE-749, CWE-1188
- [Obot: Server-Side Request Forgery via remote MCP server URL](https://agentprime.io/advisories/GHSA-jgh3-fggc-mcpm.md)
  `GHSA-jgh3-fggc-mcpm`, `CVE-2026-101064`, `GO-2026-6522` · Go `github.com/obot-platform/obot`: affected `<0.23.0`, fixed in `0.23.0` · CVSS 8.3 High · Not analysed yet · Published 18 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-1188
- [Grandstream GWN7660ELR < 1.0.27.6 Information Disclosure via SNMP Default Community String](https://agentprime.io/advisories/CVE-2026-93338.md)
  `CVE-2026-93338` · CVE record: Grandstream Networks GWN7660ELR · CVSS 6.9 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-1188
- [Caddy Proxy Manager: Registrations enabled by default allows creating users with "user" permission](https://agentprime.io/advisories/CVE-2026-54907.md)
  `CVE-2026-54907` · CVE record: fuomag9 caddy-proxy-manager · CVSS 5.3 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-1188
- [Nuxt OG Image has unauthenticated SSRF via \`fonts\[\].path\` URL parameter](https://agentprime.io/advisories/GHSA-q8hw-4fvp-9rwv.md)
  `GHSA-q8hw-4fvp-9rwv`, `CVE-2026-61793` · npm `nuxt-og-image`: affected `>=6.0.2, <6.7.0`, fixed in `6.7.0` · CVSS 6.9 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-20, CWE-441, CWE-749
- [nl.nl-portal:app has GraphiQL UI and GraphQL schema introspection enabled by default](https://agentprime.io/advisories/CVE-2026-49462.md)
  `CVE-2026-49462` · CVE record: nl-portal nl.nl-portal:app · CVSS 5.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: Information disclosure, CWE-1188

Older: <https://agentprime.io/advisories/tag/cwe-1188.md?cursor=WyIyMDI2LTA5LTExVDE5OjUzOjA0LjI5ODAwMFoiLCJDVkUtMjAyNi00OTQ2MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1188>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1188/>. Everything for agents: <https://agentprime.io/llms.txt>.