# CWE-1188.

Every Advisory and CVE whose sources give the weakness CWE-1188, newest first.

## Records, newest first (an older page)

- [KGUARD DVR unauthenticated remote command execution vulnerability](https://agentprime.io/advisories/CVE-2026-87827.md)
  `CVE-2026-87827` · CVE record: KGUARD KGUARD_firmware · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-1188
- [Information disclosure in Eclipse Foundation Eclipse aeriOS](https://agentprime.io/advisories/CVE-2026-86464.md)
  `CVE-2026-86464` · CVE record: Eclipse Foundation Eclipse aeriOS · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Information disclosure, Authentication bypass, Hard-coded credentials, CWE-1188
- [NLTK: Default ENFORCE=False Disables All pathsec Security Controls](https://agentprime.io/advisories/GHSA-p3m8-78j2-g5p3.md)
  `GHSA-p3m8-78j2-g5p3`, `CVE-2026-62388`, `PYSEC-2026-3722` · PyPI `nltk`: affected `<3.10.0`, fixed in `3.10.0` · CVSS 8.7 High · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-1188
- [Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via \`endpoints/payments/search.php\`](https://agentprime.io/advisories/CVE-2026-77348.md)
  `CVE-2026-77348` · CVE record: ellite Wallos · CVSS 8.2 High · Not analysed yet · Published 31 Aug 2026 · Tags: Server-side request forgery (SSRF), CWE-441, CWE-1188
- [oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs](https://agentprime.io/advisories/CVE-2026-53507.md)
  `CVE-2026-53507` · CVE record: oasdiff oasdiff-action · CVSS 8.3 High · Not analysed yet · Published 31 Aug 2026 · Tags: Information disclosure, Server-side request forgery (SSRF), CWE-1188
- [Eval Injection in google/langfun via default lf.query protocol](https://agentprime.io/advisories/CVE-2026-75062.md)
  `CVE-2026-75062` · CVE record: Google langfun · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Code injection, CWE-1188
- [mcp-shell has a Secure Mode Allowlist Bypass via Default \`/bin/bash\` Executable](https://agentprime.io/advisories/GHSA-3x77-wg38-92r3.md)
  `GHSA-3x77-wg38-92r3`, `CVE-2026-55581`, `GO-2026-6290` · Go `github.com/sonirico/mcp-shell`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 8.4 High · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection, CWE-183, CWE-1188
- [rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php](https://agentprime.io/advisories/CVE-2026-77915.md)
  `CVE-2026-77915` · CVE record: rconfig rconfig · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Authentication bypass, CWE-1188
- [Duplicate Advisory: \[CWE-1188\] Default ENFORCE=False Disables All pathsec Security Controls](https://agentprime.io/advisories/GHSA-8vh5-mgjj-w6hg.md)
  `GHSA-8vh5-mgjj-w6hg` · PyPI `nltk`: affected `<=3.9.4`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 22 Aug 2026 · Tags: CWE-1188
- [Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant](https://agentprime.io/advisories/CVE-2026-75926.md)
  `CVE-2026-75926` · CVE record: gohugoio hugo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-1188
- [OpenAM Insecure SSO Cookie Initialization](https://agentprime.io/advisories/GHSA-fpmh-vx4h-xc33.md)
  `GHSA-fpmh-vx4h-xc33`, `CVE-2026-53660` · Maven `org.openidentityplatform.openam:openam-core`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 7.4 High · Not analysed yet · Published 14 Aug 2026 · Tags: CWE-1004, CWE-1188, CWE-1275
- [CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 contains a default TPM PCR policy that fails to consider the system boot state.](https://agentprime.io/advisories/CVE-2025-59321.md)
  `CVE-2025-59321` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Aug 2026 · Tags: CWE-1188
- [Npcap driver installed without administrator-only access restriction on Windows in Arc before v2.7.0](https://agentprime.io/advisories/CVE-2026-33921.md)
  `CVE-2026-33921` · CVE record: Nozomi Networks Arc · CVSS 4.8 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-1188
- [Sharp Corporation Network Scanner Tool Lite: Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation…](https://agentprime.io/advisories/CVE-2026-62416.md)
  `CVE-2026-62416` · CVE record: Sharp Corporation Network Scanner Tool Lite and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-1188
- [Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication feature disabled in the initial configuration.](https://agentprime.io/advisories/CVE-2026-63563.md)
  `CVE-2026-63563` · CVE record: Sharp Corporation Sharp MFPs and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-1188
- [VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-16504.md)
  `CVE-2026-16504` · CVE record: VPS.org Zulip template · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Jul 2026 · Tags: Hard-coded credentials, CWE-1188, CWE-1393
- [VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-16503.md)
  `CVE-2026-16503` · CVE record: VPS.org Supabase template · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-1188, CWE-1327, CWE-1393
- [Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Console](https://agentprime.io/advisories/CVE-2026-67208.md)
  `CVE-2026-67208` · CVE record: somta Juggle · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jul 2026 · Tags: Authentication bypass, CWE-1188
- [Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing](https://agentprime.io/advisories/GHSA-xr9x-r78c-5hrm.md)
  `GHSA-xr9x-r78c-5hrm`, `CVE-2026-66066` · RubyGems `activestorage`: affected `<7.2.3.2 || >=8.0.0.beta1, <8.0.5.1 || >=8.1.0.beta1, <8.1.3.1`, fixed in `7.2.3.2`, `8.0.5.1`, `8.1.3.1` · CVSS 9.5 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.30 · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-1188
- [Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1](https://agentprime.io/advisories/CVE-2026-65881.md)
  `CVE-2026-65881` · CVE record: joomdle.com Joomdle component for Joomla · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: Information disclosure, CWE-1188
- [MCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server](https://agentprime.io/advisories/CVE-2026-9680.md)
  `CVE-2026-9680` · CVE record: Alibaba Alibaba Cloud RDS OpenAPI MCP Server · CVSS 5.8 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: CWE-1188
- [Privacy/configuration issue when adding local data in views through 'unbound-control'](https://agentprime.io/advisories/CVE-2026-55708.md)
  `CVE-2026-55708` · CVE record: NLnet Labs Unbound · CVSS 3.1 Low · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-1188
- [Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2](https://agentprime.io/advisories/CVE-2026-62415.md)
  `CVE-2026-62415` · CVE record: joomdonation.com Membership Pro extension for Joomla · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-1188
- [Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0](https://agentprime.io/advisories/CVE-2026-60024.md)
  `CVE-2026-60024` · CVE record: joomdonation.com Events Booking extension for Joomla · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-1188
- [Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover](https://agentprime.io/advisories/GHSA-jr9p-4h4j-6c58.md)
  `GHSA-jr9p-4h4j-6c58`, `CVE-2026-52824`, `PKSA-rg27-2yxz-ng1q` · Packagist `kimai/kimai`: affected `<2.58.0`, fixed in `2.58.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-1188
- [Argo CD Helm Chart < 10.0.0 Missing Network Policy RCE](https://agentprime.io/advisories/CVE-2026-62185.md)
  `CVE-2026-62185` · CVE record: argoproj argo-helm · CVSS 8.6 High · Not analysed yet · Published 13 Jul 2026 · Tags: CWE-1188
- [Duplicate Advisory: PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats](https://agentprime.io/advisories/GHSA-5r2q-3wg3-57m2.md)
  `GHSA-5r2q-3wg3-57m2` · PyPI `praisonai`: affected `<=4.6.77`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 11 Jul 2026 · Tags: CWE-1188
- [SiYuan: Stored XSS to RCE via attribute-view cell rendering in genAVValueHTML()](https://agentprime.io/advisories/GHSA-5xfx-xj4h-5p7r.md)
  `GHSA-5xfx-xj4h-5p7r`, `CVE-2026-54158`, `GO-2026-5957` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260628153353-2d5d72223df4`, fixed in `0.0.0-20260628153353-2d5d72223df4` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jul 2026 · Tags: Cross-site scripting (XSS), CWE-1188
- [SiYuan: Stored XSS to RCE via CSS-snippet \<style> breakout in renderSnippet()](https://agentprime.io/advisories/GHSA-mvjr-vv3c-w4qv.md)
  `GHSA-mvjr-vv3c-w4qv`, `CVE-2026-54067`, `GO-2026-5963` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260628153353-2d5d72223df4`, fixed in `0.0.0-20260628153353-2d5d72223df4` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jul 2026 · Tags: Cross-site scripting (XSS), CWE-1188
- [SiYuan: Path Traversal via Double URL Encoding in /assets/\*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894](https://agentprime.io/advisories/GHSA-p4m3-mgmm-c664.md)
  `GHSA-p4m3-mgmm-c664`, `CVE-2026-54066`, `GO-2026-5964` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260628153353-2d5d72223df4`, fixed in `0.0.0-20260628153353-2d5d72223df4` · CVSS 7.5 High · Not analysed yet · Published 10 Jul 2026 · Tags: Path traversal, CWE-1188
- [Siemens CPCI85 Central Processing/Communication: A vulnerability has been identified in CPCI85 Central Processing/Communication (All…](https://agentprime.io/advisories/CVE-2026-54800.md)
  `CVE-2026-54800` · CVE record: Siemens CPCI85 Central Processing/Communication and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: CWE-1188
- [Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default](https://agentprime.io/advisories/GHSA-9h47-pqcx-hjr4.md)
  `GHSA-9h47-pqcx-hjr4`, `CVE-2026-67336` · npm `better-auth`: affected `<1.6.11`, fixed in `1.6.11` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jul 2026 · Tags: Weak cryptography or TLS, CWE-757, CWE-1188
- [Sssd: sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation](https://agentprime.io/advisories/CVE-2026-14474.md)
  `CVE-2026-14474` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.8 High · Not analysed yet · Published 7 Jul 2026 · Tags: CWE-1188
- [Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint](https://agentprime.io/advisories/CVE-2026-56285.md)
  `CVE-2026-56285` · CVE record: zedeus nitter · CVSS 7.7 High · Not analysed yet · Published 29 Jun 2026 · Tags: Server-side request forgery (SSRF), CWE-1188
- [nono-py vulnerable to authorization bypass / policy confusion](https://agentprime.io/advisories/GHSA-9j7f-3r4p-pwh6.md)
  `GHSA-9j7f-3r4p-pwh6` · PyPI `nono-py`: affected `<0.11.0`, fixed in `0.11.0` · CVSS 5.2 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-1188
- [OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default \`SECRET_KEY_BASE=OVERWRITE_ME\` and \`cookies_serializer = :marshal\`](https://agentprime.io/advisories/CVE-2026-46386.md)
  `CVE-2026-46386` · CVE record: opf openproject · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Insecure deserialization, Hard-coded credentials, CWE-1188, CWE-1392
- [OpenAM Authentication Bypass via MSISDN LDAP Injection](https://agentprime.io/advisories/GHSA-xq73-fvmr-jvmm.md)
  `GHSA-xq73-fvmr-jvmm`, `CVE-2026-46619` · Maven `org.openidentityplatform.openam:openam-auth-msisdn`: affected `<16.1.1`, fixed in `16.1.1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Other injection, CWE-1188
- [MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies](https://agentprime.io/advisories/GHSA-2f33-pr97-265q.md)
  `GHSA-2f33-pr97-265q`, `CVE-2026-48509` · NuGet `MessagePack`: affected `<2.5.301 || >=3.0, <3.1.7`, fixed in `2.5.301`, `3.1.7` · CVSS 6.3 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-1188
- [MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows](https://agentprime.io/advisories/GHSA-382j-8mxh-c7x2.md)
  `GHSA-382j-8mxh-c7x2`, `CVE-2026-48502` · NuGet `MessagePack`: affected `>=3.0, <3.1.7`, fixed in `3.1.7` · CVSS 8.2 High · Not analysed yet · Published 25 Jun 2026 · Tags: Memory corruption, Denial of service, Code injection, Insecure deserialization
- [Appsmith: Caddy admin API exposed without authentication](https://agentprime.io/advisories/CVE-2026-55454.md)
  `CVE-2026-55454` · CVE record: appsmithorg appsmith · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-749, CWE-1188
- [Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)](https://agentprime.io/advisories/GHSA-v52w-28xh-v562.md)
  `GHSA-v52w-28xh-v562` · npm `kozou` and 3 more: affected `<1.8.1`, fixed in `1.8.1` · CVSS 4.0, no score published · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service, CWE-272, CWE-346, CWE-1188
- [Microsoft Visual Studio Code CoPilot Chat Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-50519.md)
  `CVE-2026-50519` · CVE record: Microsoft GitHub Copilot Chat · CVSS 6.5 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-1188
- [praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery](https://agentprime.io/advisories/GHSA-cwj8-7gp2-ggcw.md)
  `GHSA-cwj8-7gp2-ggcw`, `CVE-2026-57147`, `PYSEC-2026-3524` · PyPI `praisonai-platform`: affected `<0.1.6`, fixed in `0.1.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Hard-coded credentials, CWE-1188
- [praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)](https://agentprime.io/advisories/GHSA-f38v-77qj-h4jq.md)
  `GHSA-f38v-77qj-h4jq`, `CVE-2026-57148`, `PYSEC-2026-3525` · PyPI `praisonai-platform`: affected `<0.1.6`, fixed in `0.1.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Authentication bypass, Hard-coded credentials, CWE-1188
- [npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call](https://agentprime.io/advisories/GHSA-j4f3-55x4-r6q2.md)
  `GHSA-j4f3-55x4-r6q2`, `CVE-2026-57139` · npm `praisonai`: affected `>=1.5.0, <1.7.2`, fixed in `1.7.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Authentication bypass, Broken access control, CWE-1188
- [praisonai: recipe serve auth middleware silently disables itself when no secret is set](https://agentprime.io/advisories/GHSA-j4hj-7hfh-g2f4.md)
  `GHSA-j4hj-7hfh-g2f4`, `CVE-2026-57127`, `PYSEC-2026-3513` · PyPI `praisonai`: affected `<4.6.59`, fixed in `4.6.59` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2026 · Tags: Authentication bypass, CWE-1188
- [Insecure Default Domain Allowlist in Splunk AI Toolkit](https://agentprime.io/advisories/CVE-2026-20265.md)
  `CVE-2026-20265` · CVE record: Splunk Splunk AI Toolkit · CVSS 4.3 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: CWE-1188
- [In PostWipeData of recovery_ui.cpp, there is a possible data persistence issue after a factory reset due to a logic error in the code.](https://agentprime.io/advisories/CVE-2026-0134.md)
  `CVE-2026-0134` · CVE record: Google Android · CVSS 4.0 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-1188
- [Use of a non-secure protocol as the default FTP configuration in Canon EOS Network Setting Tool Version 1.5.0 or earlier](https://agentprime.io/advisories/CVE-2026-9262.md)
  `CVE-2026-9262` · CVE record: Canon Inc. EOS Network Setting Tool for Windows and 1 more · CVSS 7.1 High · Not analysed yet · Published 15 Jun 2026 · Tags: CWE-1188
- [MISP automation endpoints may be exposed to CSRF when Sec-Fetch-Site protection is disabled by default](https://agentprime.io/advisories/CVE-2026-54359.md)
  `CVE-2026-54359` · CVE record: misp misp · CVSS 7.1 High · Not analysed yet · Published 12 Jun 2026 · Tags: Cross-site request forgery (CSRF), CWE-1188
- [Spring Web Services: Wss4jSecurityInterceptor disables WS-I BSP validation by default](https://agentprime.io/advisories/GHSA-gg9r-wr4p-w63h.md)
  `GHSA-gg9r-wr4p-w63h`, `CVE-2026-40994` · Maven `org.springframework.ws:spring-ws-security`: affected `>=5.0.0, <5.0.2 || >=4.1.0, <4.1.4 || >=4.0.0, <=4.0.18 || >=3.1.0, <=3.1.8`, fixed in `5.0.2`, `4.1.4` · CVSS 8.2 High · Not analysed yet · Published 11 Jun 2026 · Tags: CWE-1188
- [Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size](https://agentprime.io/advisories/GHSA-c2rx-5r8w-8xr2.md)
  `GHSA-c2rx-5r8w-8xr2`, `CVE-2026-44892` · Maven `io.netty:netty-codec-http3`: affected `>=4.2.0.Final, <4.2.15.Final`, fixed in `4.2.15.Final` · CVSS 7.5 High · Not analysed yet · Published 8 Jun 2026 · Tags: Denial of service, CWE-1188
- [DbGate: Unauthenticated Remote Code Execution via JSON Script Runner](https://agentprime.io/advisories/GHSA-8v3q-9vmx-36vc.md)
  `GHSA-8v3q-9vmx-36vc`, `CVE-2026-47668` · npm `dbgate-serve`: affected `<7.1.9`, fixed in `7.1.9` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Jun 2026 · Tags: Code injection, CWE-20, CWE-1188
- [Mercusys AC12G (EU) V1 with firmware AC12G(EU)\_V1_200909 contains hardcoded WiFi driver credentials including a RADIUS shared secret, WPS test key, and default PSK embedded in the production firmware…](https://agentprime.io/advisories/CVE-2026-36616.md)
  `CVE-2026-36616` · CVE record · CVSS 5.9 Medium · Not analysed yet · Published 3 Jun 2026 · Tags: Hard-coded credentials, CWE-1188
- [Mercusys AC12G (EU) V1 with firmware AC12G(EU)\_V1_200909 enables WPS 2.0 by default with a weak lockout policy (60-second lockout after 10 attempts).](https://agentprime.io/advisories/CVE-2026-36612.md)
  `CVE-2026-36612` · CVE record · CVSS 6.4 Medium · Not analysed yet · Published 3 Jun 2026 · Tags: Authentication bypass, CWE-1188
- [Apache Solr has hardcoded credentials in the Basic Authentication setup tool](https://agentprime.io/advisories/GHSA-qhr7-h655-pw6r.md)
  `GHSA-qhr7-h655-pw6r`, `BIT-solr-2026-44825`, `CVE-2026-44825` · Maven `org.apache.solr:solr-core`: affected `>=9.4.0, <=9.10.1`, no fixed version yet · CVSS 8.1 High · Not analysed yet · Published 1 Jun 2026 · Tags: Hard-coded credentials, CWE-1188
- [PraisonAI \`deploy --type api\` emits a Flask server with authentication disabled by default](https://agentprime.io/advisories/GHSA-8444-4fhq-fxpq.md)
  `GHSA-8444-4fhq-fxpq`, `CVE-2026-47393`, `PYSEC-2026-465` · PyPI `praisonai`: affected `<4.6.40`, fixed in `4.6.40` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2026 · Tags: Authentication bypass, CWE-1188
- [Initialization of a resource with an insecure default in XCharge C6](https://agentprime.io/advisories/CVE-2026-9039.md)
  `CVE-2026-9039` · CVE record: XCharge C6 · CVSS 8.6 High · Not analysed yet · Published 28 May 2026 · Tags: CWE-1188
- [NVIDIA Display Driver for Linux contains a vulnerability in the Multi-Instance GPU (MIG) partition management, where an insecure default initialization of memory subsystem routing resources could lea…](https://agentprime.io/advisories/CVE-2026-24197.md)
  `CVE-2026-24197` · CVE record: NVIDIA GeForce and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 26 May 2026 · Tags: CWE-1188
- [lmdeploy: Hardcoded trust_remote_code=True is an implicit unsafe remote-code load path with no user opt-out](https://agentprime.io/advisories/GHSA-9xq9-36w5-q796.md)
  `GHSA-9xq9-36w5-q796`, `CVE-2026-46517`, `PYSEC-2026-2608` · PyPI `lmdeploy`: affected `<0.13.0`, fixed in `0.13.0` · CVSS 7.8 High · Not analysed yet · Published 21 May 2026 · Tags: Code injection, Broken access control, CWE-1188

Newest: <https://agentprime.io/advisories/tag/cwe-1188.md>
Older: <https://agentprime.io/advisories/tag/cwe-1188.md?cursor=WyIyMDI2LTA1LTIxVDE5OjMzOjMyLjAwMDAwMFoiLCJHSFNBLTl4cTktMzZ3NS1xNzk2Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1188&cursor=WyIyMDI2LTA5LTExVDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNi03OTM5NCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1188/?cursor=WyIyMDI2LTA5LTExVDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNi03OTM5NCJd>. Everything for agents: <https://agentprime.io/llms.txt>.