# CWE-1188.

Every Advisory and CVE whose sources give the weakness CWE-1188, newest first.

## Records, newest first (an older page)

- [phpMyFAQ: Default Empty API Token Authentication Bypass](https://agentprime.io/advisories/GHSA-gp95-j463-vv28.md)
  `GHSA-gp95-j463-vv28`, `CVE-2026-35672`, `PKSA-jk8b-rmby-gztg`, `PKSA-xr26-9czp-vbgk` · Packagist `phpmyfaq/phpmyfaq` and 1 more: affected `<4.1.3`, fixed in `4.1.3` · CVSS 8.7 High · Not analysed yet · Published 20 May 2026 · Tags: CWE-1188
- [Algernon: Auto-refresh SSE event server binds to all interfaces by default on Linux/macOS](https://agentprime.io/advisories/GHSA-gj84-924c-48fx.md)
  `GHSA-gj84-924c-48fx`, `CVE-2026-46430`, `GO-2026-5401` · Go `github.com/xyproto/algernon`: affected `<1.17.7`, fixed in `1.17.7` · CVSS 4.3 Medium · Not analysed yet · Published 20 May 2026 · Tags: Information disclosure, CWE-1188
- [Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: \* and no authentication](https://agentprime.io/advisories/GHSA-9v4j-7g44-qcqw.md)
  `GHSA-9v4j-7g44-qcqw`, `GO-2026-5300` · Go `github.com/xyproto/algernon`: affected `<1.17.7`, fixed in `1.17.7` · CVSS 5.3 Medium · Not analysed yet · Published 19 May 2026 · Tags: Information disclosure, Authentication bypass, CWE-942, CWE-1188
- [Algernon: Single-file mode unconditionally enables debug mode](https://agentprime.io/advisories/GHSA-fwqx-8365-9983.md)
  `GHSA-fwqx-8365-9983`, `CVE-2026-45728`, `GO-2026-5385` · Go `github.com/xyproto/algernon`: affected `<1.17.7`, fixed in `1.17.7` · CVSS 7.5 High · Not analysed yet · Published 19 May 2026 · Tags: Information disclosure, CWE-489, CWE-540, CWE-1188
- [Auth Proxy IPv6 whitelist bypass](https://agentprime.io/advisories/CVE-2026-33376.md)
  `CVE-2026-33376` · CVE record: Grafana Grafana OSS · CVSS 7.4 High · Not analysed yet · Published 13 May 2026 · Tags: CWE-1188
- [AntSword: Incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection](https://agentprime.io/advisories/CVE-2026-43892.md)
  `CVE-2026-43892` · CVE record: AntSwordProject antSword · CVSS 8.8 High · Not analysed yet · Published 12 May 2026 · Tags: Cross-site scripting (XSS), Code injection, CWE-1188
- [Insecure Default Initialization in API Authentication leads to Authentication Bypass](https://agentprime.io/advisories/CVE-2026-30805.md)
  `CVE-2026-30805` · CVE record: Pandora FMS Pandora FMS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: CWE-1188
- [Initialization of a Resource with an Insecure Default vulnerability on EcoStruxure™ Panel Server](https://agentprime.io/advisories/CVE-2026-6866.md)
  `CVE-2026-6866` · CVE record: Schneider Electric EcoStruxure™ Panel Server · CVSS 8.2 High · Not analysed yet · Published 12 May 2026 · Tags: CWE-1188
- [Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in place.](https://agentprime.io/advisories/CVE-2026-27662.md)
  `CVE-2026-27662` · CVE record: Siemens SIMATIC HMI MTP1000 Unified Comfort Panel and 4 more · CVSS 7.0 High · Not analysed yet · Published 12 May 2026 · Tags: CWE-1188
- [PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution](https://agentprime.io/advisories/GHSA-6rmh-7xcm-cpxj.md)
  `GHSA-6rmh-7xcm-cpxj`, `CVE-2026-44338`, `PYSEC-2026-2904` · PyPI `praisonai`: affected `>=2.5.6, <4.6.34`, fixed in `4.6.34` · CVSS 7.3 High · Critical (CVSS 7+ and EPSS) · EPSS 0.33 · Not analysed yet · Published 11 May 2026 · Tags: Authentication bypass, Information disclosure, CWE-1188
- [SiYuan: Electron Renderer RCE via decodeURIComponent-driven tooltip XSS in aria-label sink (incomplete fix for CVE-2026-34585)](https://agentprime.io/advisories/GHSA-25rp-h46x-2hjm.md)
  `GHSA-25rp-h46x-2hjm`, `CVE-2026-44588`, `GO-2026-4993` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<=0.0.0-20260421031503-96dfe0bea474`, no fixed version yet · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 May 2026 · Tags: Cross-site scripting (XSS), CWE-116, CWE-1188
- [SiYuan Affected by Stored XSS via Attribute View Name to Electron Renderer RCE](https://agentprime.io/advisories/GHSA-2h64-c999-c9r6.md)
  `GHSA-2h64-c999-c9r6`, `CVE-2026-44670`, `GO-2026-4992` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260512140701-d7b77d945e0d`, fixed in `0.0.0-20260512140701-d7b77d945e0d` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 May 2026 · Tags: Cross-site scripting (XSS), Code injection, CWE-1188
- [Duplicate Advisory: OpenClaw: Feishu webhook and card-action validation now fail closed](https://agentprime.io/advisories/GHSA-cjg8-85gj-v9q2.md)
  `GHSA-cjg8-85gj-v9q2` · npm `openclaw`: affected `<2026.4.15`, fixed in `2026.4.15` · CVSS 9.8 Critical · Withdrawn · Not analysed yet · Published 6 May 2026 · Tags: CWE-1188
- [Vvveb < 1.0.8.2 Information Disclosure via Debug Exception Handler](https://agentprime.io/advisories/CVE-2026-41931.md)
  `CVE-2026-41931` · CVE record: givanz Vvveb · CVSS 6.9 Medium · Not analysed yet · Published 6 May 2026 · Tags: Information disclosure, CWE-1188
- [HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only](https://agentprime.io/advisories/CVE-2025-31974.md)
  `CVE-2025-31974` · CVE record: HCL Software BigFix Service Management (SM) · CVSS 3.9 Low · Not analysed yet · Published 6 May 2026 · Tags: CWE-1188
- [BridgeHead FileStore < 24A Apache Axis2 Default Credentials RCE](https://agentprime.io/advisories/CVE-2026-39920.md)
  `CVE-2026-39920` · CVE record: BridgeHead Software FileStore · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Apr 2026 · Tags: Hard-coded credentials, CWE-1188
- [New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud](https://agentprime.io/advisories/GHSA-xff3-5c9p-2mr4.md)
  `GHSA-xff3-5c9p-2mr4`, `CVE-2026-41432`, `GO-2026-5753` · Go `github.com/QuantumNous/new-api`: affected `<0.12.10`, fixed in `0.12.10` · CVSS 7.1 High · Not analysed yet · Published 24 Apr 2026 · Tags: Broken access control, CWE-345, CWE-1188
- [Insecure Default Configuration in P4 Server](https://agentprime.io/advisories/CVE-2026-6043.md)
  `CVE-2026-6043` · CVE record: Perforce Helix Core Server (P4D) · CVSS 8.8 High · Not analysed yet · Published 24 Apr 2026 · Tags: CWE-1188
- [Gitea has insecure default SSH settings](https://agentprime.io/advisories/GHSA-3m6q-h5gj-7mrw.md)
  `GHSA-3m6q-h5gj-7mrw`, `GO-2026-5091` · Go `code.gitea.io/gitea`: affected `<1.25.0`, fixed in `1.25.0` · CVSS 4.0, no score published · Not analysed yet · Published 22 Apr 2026 · Tags: Weak cryptography or TLS, CWE-1188
- [engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection](https://agentprime.io/advisories/GHSA-2r2p-4cgf-hv7h.md)
  `GHSA-2r2p-4cgf-hv7h` · npm `engramx`: affected `<2.0.2`, fixed in `2.0.2` · CVSS 4.0, no score published · Not analysed yet · Published 22 Apr 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF), CWE-942, CWE-1188
- [silex technology, Inc. SD-330AC: Initialization of a resource with an insecure default vulnerability exists in SD-330AC…](https://agentprime.io/advisories/CVE-2026-32965.md)
  `CVE-2026-32965` · CVE record: silex technology, Inc. SD-330AC and 1 more · CVSS 8.7 High · Not analysed yet · Published 20 Apr 2026 · Tags: CWE-1188
- [OpenClaw: Feishu webhook and card-action validation now fail closed](https://agentprime.io/advisories/GHSA-xh72-v6v9-mwhc.md)
  `GHSA-xh72-v6v9-mwhc`, `CVE-2026-44109` · npm `openclaw`: affected `<2026.4.15`, fixed in `2026.4.15` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Apr 2026 · Tags: Authentication bypass, CWE-1188
- [OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0](https://agentprime.io/advisories/GHSA-525j-hqq2-66r4.md)
  `GHSA-525j-hqq2-66r4`, `CVE-2026-43581` · npm `openclaw`: affected `<2026.4.10`, fixed in `2026.4.10` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Apr 2026 · Tags: Broken access control, CWE-1188, CWE-1327
- [OpenClaw: Browser SSRF policy default allowed private-network navigation](https://agentprime.io/advisories/GHSA-53vx-pmqw-863c.md)
  `GHSA-53vx-pmqw-863c`, `CVE-2026-43527` · npm `openclaw`: affected `<2026.4.14`, fixed in `2026.4.14` · CVSS 6.3 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Server-side request forgery (SSRF), CWE-1188
- [paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass](https://agentprime.io/advisories/GHSA-68qg-g8mg-6pr7.md)
  `GHSA-68qg-g8mg-6pr7`, `CVE-2026-41679` · npm `paperclipai` and 1 more: affected `<2026.410.0`, fixed in `2026.410.0` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.32 · Not analysed yet · Published 10 Apr 2026 · Tags: Authentication bypass, Broken access control, CWE-1188
- [Initialization of a resource with an insecure default in OpenPLC_V3](https://agentprime.io/advisories/CVE-2026-28205.md)
  `CVE-2026-28205` · CVE record: OpenPLC_V3 OpenPLC_V3 · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-1188
- [openclaw-claude-bridge: sandbox is not effective - \`--allowed-tools ""\` does not restrict available tools](https://agentprime.io/advisories/GHSA-7853-gqqm-vcwx.md)
  `GHSA-7853-gqqm-vcwx`, `CVE-2026-39398` · npm `openclaw-claude-bridge`: affected `<2.0.0`, fixed in `2.0.0` · No CVSS score · Not analysed yet · Published 8 Apr 2026 · Tags: Broken access control, CWE-1188
- [Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist](https://agentprime.io/advisories/GHSA-7r9j-r86q-7g45.md)
  `GHSA-7r9j-r86q-7g45`, `CVE-2026-31818` · npm `@budibase/backend-core`: affected `<3.33.4`, fixed in `3.33.4` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Apr 2026 · Tags: Server-side request forgery (SSRF), CWE-1188
- [Electron: Context Isolation bypass via contextBridge VideoFrame transfer](https://agentprime.io/advisories/GHSA-jfqg-hf23-qpw2.md)
  `GHSA-jfqg-hf23-qpw2`, `CVE-2026-34780` · npm `electron`: affected `>=39.0.0-alpha.1, <39.8.0 || >=40.0.0-alpha.1, <40.7.0 || >=41.0.0-alpha.1, <41.0.0-beta.8`, fixed in `39.8.0`, `40.7.0`, `41.0.0-beta.8` · CVSS 8.4 High · Not analysed yet · Published 3 Apr 2026 · Tags: Information disclosure, CWE-501, CWE-1188
- [DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost](https://agentprime.io/advisories/GHSA-xw59-hvm2-8pj6.md)
  `GHSA-xw59-hvm2-8pj6`, `CVE-2026-34742`, `GO-2026-5771` · Go `github.com/modelcontextprotocol/go-sdk`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 7.6 High · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-1188
- [NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initialization of a resource with an insecure default.](https://agentprime.io/advisories/CVE-2026-24148.md)
  `CVE-2026-24148` · CVE record: NVIDIA Jetson Xavier Series and Jetson Orin Series · CVSS 8.3 High · Not analysed yet · Published 31 Mar 2026 · Tags: CWE-1188
- [Traefik has a Potential mTLS Bypass via Fragmented TLS ClientHello Causing Pre-SNI Sniff Fallback to Default Non-mTLS TLS Config in github.com/traefik/traefik](https://agentprime.io/advisories/GHSA-wvvq-wgcr-9q48.md)
  `GHSA-wvvq-wgcr-9q48`, `CVE-2026-32305`, `GO-2026-4793` · Go `github.com/traefik/traefik` and 2 more: affected `*`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 23 Mar 2026 · Tags: Authentication bypass, CWE-179, CWE-1188
- [Duplicate Advisory: OpenClaw has an improper sandbox configuration vulnerability](https://agentprime.io/advisories/GHSA-q94v-v6m9-jhq9.md)
  `GHSA-q94v-v6m9-jhq9` · npm `openclaw`: affected `*`, no fixed version yet · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 21 Mar 2026 · Tags: CWE-1188
- [FileRise: Default Encryption Key Enables Token Forgery and Config Decryption](https://agentprime.io/advisories/CVE-2026-33072.md)
  `CVE-2026-33072` · CVE record: error311 FileRise · CVSS 8.2 High · Not analysed yet · Published 20 Mar 2026 · Tags: Hard-coded credentials, CWE-1188
- [WWBN AVideo has predictable default admin credentials in official Docker deployment path](https://agentprime.io/advisories/CVE-2026-33037.md)
  `CVE-2026-33037` · CVE record: WWBN AVideo · CVSS 8.1 High · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-1188
- [AnythingLLM Permissable CORS policy](https://agentprime.io/advisories/CVE-2026-32617.md)
  `CVE-2026-32617` · CVE record: Mintplex-Labs anything-llm · CVSS 7.1 High · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-942, CWE-1188
- [Himmelblau unset domain configuration can allow any-tenant authentication at first login for remote deployments](https://agentprime.io/advisories/CVE-2026-31957.md)
  `CVE-2026-31957` · CVE record: himmelblau-idm himmelblau · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-1188
- [@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection](https://agentprime.io/advisories/GHSA-gv8f-wpm2-m5wr.md)
  `GHSA-gv8f-wpm2-m5wr`, `CVE-2026-31975` · npm `@siteboon/claude-code-ui`: affected `<1.25.0`, fixed in `1.25.0` · CVSS 8.7 High · Not analysed yet · Published 11 Mar 2026 · Tags: Command injection, Authentication bypass, CWE-1188
- [Mongoose Web Server 6.9 Denial of Service via Socket Connection](https://agentprime.io/advisories/CVE-2018-25193.md)
  `CVE-2018-25193` · CVE record: Cesanta Mongoose Web Server · CVSS 8.7 High · Not analysed yet · Published 6 Mar 2026 · Tags: CWE-1188
- [AMPPS 2.7 Denial of Service via Malformed Socket Connection](https://agentprime.io/advisories/CVE-2018-25169.md)
  `CVE-2018-25169` · CVE record: Ampps AMPPS · CVSS 8.7 High · Not analysed yet · Published 6 Mar 2026 · Tags: CWE-1188
- [Microsoft ACI Confidential Containers Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-26122.md)
  `CVE-2026-26122` · CVE record: Microsoft Microsoft ACI Confidential Containers · CVSS 6.5 Medium · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-1188
- [Unauthenticated RCE via SNMP Default Writable Community String](https://agentprime.io/advisories/CVE-2026-28775.md)
  `CVE-2026-28775` · CVE record: International Datacasting Corporation (IDC) SFX2100 Series SuperFlex SatelliteReceiver · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Mar 2026 · Tags: CWE-1188
- [OpenClaw: Chrome --no-sandbox disabled OS-level browser sandbox in sandbox browser container](https://agentprime.io/advisories/GHSA-43x4-g22p-3hrq.md)
  `GHSA-43x4-g22p-3hrq`, `CVE-2026-32046` · npm `openclaw`: affected `<2026.2.21`, fixed in `2026.2.21` · CVSS 4.8 Medium · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-693, CWE-1188
- [UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default credentials for the telnet service, possibly allowing a remote attacker to gain root access via a craf…](https://agentprime.io/advisories/CVE-2025-70998.md)
  `CVE-2025-70998` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Feb 2026 · Tags: CWE-1188
- [Beetel 777VR1 Telnet Service/SSH Service insecure default initialization of resource](https://agentprime.io/advisories/CVE-2026-2617.md)
  `CVE-2026-2617` · CVE record: Beetel 777VR1 · CVSS 5.3 Medium · Not analysed yet · Published 17 Feb 2026 · Tags: CWE-1188
- [Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise](https://agentprime.io/advisories/GHSA-7ppg-37fh-vcr6.md)
  `GHSA-7ppg-37fh-vcr6`, `BIT-milvus-2026-26190`, `CVE-2026-26190`, `GO-2026-4481` · Go `github.com/milvus-io/milvus`: affected `<2.5.27 || >=2.6.0, <2.6.10`, fixed in `2.5.27`, `2.6.10` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.39 · Not analysed yet · Published 11 Feb 2026 · Tags: Authentication bypass, CWE-749, CWE-1188
- [Advanced Country Blocker <= 2.3.1 - Unauthenticated Authorization Bypass via Insecure Default Secret Key](https://agentprime.io/advisories/CVE-2026-1675.md)
  `CVE-2026-1675` · CVE record: brstefanovic Advanced Country Blocker · CVSS 5.3 Medium · Not analysed yet · Published 7 Feb 2026 · Tags: CWE-1188
- [FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration](https://agentprime.io/advisories/GHSA-32cc-x95p-fxcg.md)
  `GHSA-32cc-x95p-fxcg`, `CVE-2026-25894` · npm `fuxa-server`: affected `<1.2.10`, fixed in `1.2.10` · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Feb 2026 · Tags: Hard-coded credentials, CWE-1188
- [FUXA contains an insecure default configuration vulnerability](https://agentprime.io/advisories/GHSA-r5m2-fqcf-qrf7.md)
  `GHSA-r5m2-fqcf-qrf7`, `CVE-2025-69970` · npm `fuxa-server`: affected `<=1.2.7`, no fixed version yet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Feb 2026 · Tags: Authentication bypass, CWE-1188
- [terraform-provider-proxmox has insecure sudo recommendation in the documentation](https://agentprime.io/advisories/GHSA-gwch-7m8v-7544.md)
  `GHSA-gwch-7m8v-7544`, `CVE-2026-25499`, `GO-2026-4395` · Go `github.com/bpg/terraform-provider-proxmox`: affected `<0.93.1`, fixed in `0.93.1` · CVSS 8.7 High · Not analysed yet · Published 2 Feb 2026 · Tags: Path traversal, CWE-1188
- [Unauthenticated SOAP API in dormakaba access manager](https://agentprime.io/advisories/CVE-2025-59097.md)
  `CVE-2025-59097` · CVE record: dormakaba Access Manager 92xx-k5 and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jan 2026 · Tags: Authentication bypass, CWE-1188
- [Unauthenticated SOAP API in dormakaba Kaba exos 9300](https://agentprime.io/advisories/CVE-2025-59090.md)
  `CVE-2025-59090` · CVE record: dormakaba Kaba exos 9300 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jan 2026 · Tags: Authentication bypass, CWE-1188
- [Harvest May Expose OS Default SSH Login Password Via SUSE Virtualization Interactive Installer in github.com/harvester/harvester-installer](https://agentprime.io/advisories/GHSA-6g8q-hp2j-gvwv.md)
  `GHSA-6g8q-hp2j-gvwv`, `CVE-2025-62877`, `GO-2026-4281` · Go `github.com/harvester/harvester-installer`: affected `>=1.5.0 || >=1.6.0`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jan 2026 · Tags: CWE-1188
- [Stored Cross-site Scripting (XSS) in Kentico Xperience 13](https://agentprime.io/advisories/CVE-2025-5591.md)
  `CVE-2025-5591` · CVE record: Kentico Kentico Xperience · CVSS 7.7 High · Not analysed yet · Published 5 Jan 2026 · Tags: Cross-site scripting (XSS), CWE-1188
- [Authentication Bypass in fosrl/pangolin v1.6.2 and before allows attackers to access Pangolin resource via Insecure Default Configuration](https://agentprime.io/advisories/CVE-2025-56332.md)
  `CVE-2025-56332` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Dec 2025 · Tags: CWE-1188
- [Initialization of a Resource with an Insecure Default in YAOOK](https://agentprime.io/advisories/CVE-2025-14758.md)
  `CVE-2025-14758` · CVE record: ALASCA YAOOK · CVSS 6.5 Medium · Not analysed yet · Published 16 Dec 2025 · Tags: CWE-1188
- [Misskey has a login rate limit bypass via spoofed X-Forwarded-For header](https://agentprime.io/advisories/GHSA-wwrj-3hvj-prpm.md)
  `GHSA-wwrj-3hvj-prpm`, `CVE-2025-66482` · npm `misskey-js`: affected `>=2025.9.1, <2025.12.0-alpha.2`, fixed in `2025.12.0-alpha.2` · CVSS 6.9 Medium · Not analysed yet · Published 15 Dec 2025 · Tags: Authentication bypass, CWE-1188
- [Japan Total System Co.,Ltd. GroupSession Free edition: In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1…](https://agentprime.io/advisories/CVE-2025-64781.md)
  `CVE-2025-64781` · CVE record: Japan Total System Co.,Ltd. GroupSession Free edition and 2 more · CVSS 5.1 Medium · Not analysed yet · Published 12 Dec 2025 · Tags: CWE-1188
- [In findAvailRecognizer of VoiceInteractionManagerService.java, there is a possible way to become the default speech recognizer app due to an insecure default value.](https://agentprime.io/advisories/CVE-2025-48629.md)
  `CVE-2025-48629` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-1188
- [In DefaultTransitionHandler.java, there is a possible way to enable a tapjacking attack due to a insecure default.](https://agentprime.io/advisories/CVE-2025-48621.md)
  `CVE-2025-48621` · CVE record: Google Android · CVSS 7.3 High · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-1188

Newest: <https://agentprime.io/advisories/tag/cwe-1188.md>
Older: <https://agentprime.io/advisories/tag/cwe-1188.md?cursor=WyIyMDI1LTEyLTA4VDE2OjU3OjM4LjI4MTAwMFoiLCJDVkUtMjAyNS00ODYyMSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1188&cursor=WyIyMDI2LTA1LTIxVDE5OjMzOjMyLjAwMDAwMFoiLCJHSFNBLTl4cTktMzZ3NS1xNzk2Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1188/?cursor=WyIyMDI2LTA1LTIxVDE5OjMzOjMyLjAwMDAwMFoiLCJHSFNBLTl4cTktMzZ3NS1xNzk2Il0>. Everything for agents: <https://agentprime.io/llms.txt>.