agentprime: CWE-1188Every new CWE-1188 Advisory and CVE.https://agentprime.io/CVE-2026-92887: Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operationhttps://agentprime.io/advisories/CVE-2026-92887/https://agentprime.io/advisories/CVE-2026-92887/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:45:53 GMTCVECVE-2026-122006: The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagi…https://agentprime.io/advisories/CVE-2026-122006/https://agentprime.io/advisories/CVE-2026-122006/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 14:12:17 GMTCVEcriticalCVE-2026-95860: node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissionshttps://agentprime.io/advisories/CVE-2026-95860/https://agentprime.io/advisories/CVE-2026-95860/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 20:11:38 GMTCVEcriticalCVE-2026-120091: Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service hosthttps://agentprime.io/advisories/CVE-2026-120091/https://agentprime.io/advisories/CVE-2026-120091/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 21:19:19 GMTCVECVE-2026-78192: WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index pagehttps://agentprime.io/advisories/CVE-2026-78192/https://agentprime.io/advisories/CVE-2026-78192/Published by the CVE Program. Not analysed by agentprime yet.Sat, 31 Oct 2026 14:34:49 GMTCVEAuthlib RFC 7592 examples omit registration-access-token client bindinghttps://agentprime.io/advisories/GHSA-c73q-w75p-j82v/https://agentprime.io/advisories/GHSA-c73q-w75p-j82v/authlib >=0.15, <1.9.1, fixed in 1.9.1. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 30 Oct 2026 23:09:04 GMTPyPIauthlibCVE-2026-116247: pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificatehttps://agentprime.io/advisories/CVE-2026-116247/https://agentprime.io/advisories/CVE-2026-116247/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:55:16 GMTCVECVE-2026-116244: pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentialshttps://agentprime.io/advisories/CVE-2026-116244/https://agentprime.io/advisories/CVE-2026-116244/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:55:15 GMTCVECVE-2026-116242: pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identityhttps://agentprime.io/advisories/CVE-2026-116242/https://agentprime.io/advisories/CVE-2026-116242/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:55:13 GMTCVECVE-2026-112255: Endpoint credential minting (insecure default allow-list)https://agentprime.io/advisories/CVE-2026-112255/https://agentprime.io/advisories/CVE-2026-112255/CVSS 2.9 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 15:30:55 GMTCVECVE-2026-118691: xianyu-auto-reply-fix through 2.0.7 Unauthenticated Message Sending via /send-messagehttps://agentprime.io/advisories/CVE-2026-118691/https://agentprime.io/advisories/CVE-2026-118691/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 21:11:18 GMTCVECVE-2026-116273: MIME::Parser versions before 5.521 for Perl set no limit on the number of message parts by default, allowing memory exhaustionhttps://agentprime.io/advisories/CVE-2026-116273/https://agentprime.io/advisories/CVE-2026-116273/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 17:34:44 GMTCVECVE-2026-110952: Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by defaulthttps://agentprime.io/advisories/CVE-2026-110952/https://agentprime.io/advisories/CVE-2026-110952/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 16:37:34 GMTCVEAuthlib: Default JWT bearer grant accepts assertions for the wrong audiencehttps://agentprime.io/advisories/GHSA-fch4-3c6x-j4gc/https://agentprime.io/advisories/GHSA-fch4-3c6x-j4gc/authlib <1.9.0, fixed in 1.9.0. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 27 Oct 2026 15:39:08 GMTPyPIauthlibCVE-2026-25784: bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysophttps://agentprime.io/advisories/CVE-2026-25784/https://agentprime.io/advisories/CVE-2026-25784/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 08:54:57 GMTCVEcriticalStorybook dev server vulnerable to code injection from the local networkhttps://agentprime.io/advisories/GHSA-px85-f4q5-jh77/https://agentprime.io/advisories/GHSA-px85-f4q5-jh77/storybook >=8.0.0, <8.6.19 || >=9.0.0, <9.1.21 || >=10.0.0, <10.6.2 || >=11.0.0-alpha.0, <11.0.0-alpha.6, fixed in 8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Thu, 22 Oct 2026 16:31:40 GMTnpmstorybook@storybook/addon-mcp@storybook/addon-vitest@storybook/core@storybook/core-server@storybook/experimental-addon-testCVE-2026-114123: D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internethttps://agentprime.io/advisories/CVE-2026-114123/https://agentprime.io/advisories/CVE-2026-114123/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 16:57:47 GMTCVECVE-2026-114397: Trudesk through 1.2.11 Missing Authentication on Debug Routeshttps://agentprime.io/advisories/CVE-2026-114397/https://agentprime.io/advisories/CVE-2026-114397/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 12:39:51 GMTCVEA2A Java SDK has a fail-open default task authorizationhttps://agentprime.io/advisories/GHSA-qw47-mcm5-934w/https://agentprime.io/advisories/GHSA-qw47-mcm5-934w/org.a2aproject.sdk:a2a-java-sdk-server-common <1.3.0.Final, fixed in 1.3.0.Final. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 20 Oct 2026 21:05:09 GMTMavenorg.a2aproject.sdk:a2a-java-sdk-server-commonCVE-2026-77936: Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Accesshttps://agentprime.io/advisories/CVE-2026-77936/https://agentprime.io/advisories/CVE-2026-77936/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 00:46:14 GMTCVEcriticalCVE-2026-77934: Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runnerhttps://agentprime.io/advisories/CVE-2026-77934/https://agentprime.io/advisories/CVE-2026-77934/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 00:46:12 GMTCVECVE-2026-109437: Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backendhttps://agentprime.io/advisories/CVE-2026-109437/https://agentprime.io/advisories/CVE-2026-109437/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 18:22:57 GMTCVEcriticalCVE-2026-108833: Apache Kylin: default startup profile miss security settingshttps://agentprime.io/advisories/CVE-2026-108833/https://agentprime.io/advisories/CVE-2026-108833/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 09:21:54 GMTCVECVE-2026-103091: Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)https://agentprime.io/advisories/CVE-2026-103091/https://agentprime.io/advisories/CVE-2026-103091/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 02:24:35 GMTCVEcriticalCVE-2026-77427: FileRise: Insecure default cryptographic key fallback in manual installshttps://agentprime.io/advisories/CVE-2026-77427/https://agentprime.io/advisories/CVE-2026-77427/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:32:55 GMTCVECVE-2026-110769: holaOS through 2026.822.1 Missing Authorization in Channel-Gateway Connectorshttps://agentprime.io/advisories/CVE-2026-110769/https://agentprime.io/advisories/CVE-2026-110769/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 18:47:52 GMTCVECVE-2026-110631: Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configurationhttps://agentprime.io/advisories/CVE-2026-110631/https://agentprime.io/advisories/CVE-2026-110631/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 14:17:05 GMTCVEcriticalCVE-2026-14765: Epic Games Unreal Engine Insecure Default URL Scheme Allowance in LaunchURLhttps://agentprime.io/advisories/CVE-2026-14765/https://agentprime.io/advisories/CVE-2026-14765/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 02:31:08 GMTCVECVE-2026-53709: MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgeryhttps://agentprime.io/advisories/CVE-2026-53709/https://agentprime.io/advisories/CVE-2026-53709/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 14:32:12 GMTCVEcriticalCVE-2026-89120: Missing authorization check in SAP ABAP Platformhttps://agentprime.io/advisories/CVE-2026-89120/https://agentprime.io/advisories/CVE-2026-89120/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 00:27:10 GMTCVECVE-2026-89105: Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integration-libraryhttps://agentprime.io/advisories/CVE-2026-89105/https://agentprime.io/advisories/CVE-2026-89105/CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 00:23:29 GMTCVECVE-2026-109569: sandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespacehttps://agentprime.io/advisories/CVE-2026-109569/https://agentprime.io/advisories/CVE-2026-109569/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 20:55:21 GMTCVEcriticalCVE-2026-78018: Dell Secure Connect Gateway (SCG) Policy Manager: Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16…https://agentprime.io/advisories/CVE-2026-78018/https://agentprime.io/advisories/CVE-2026-78018/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 09 Oct 2026 08:42:01 GMTCVECVE-2026-78013: Dell Secure Connect Gateway (SCG) Policy Manager: Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16…https://agentprime.io/advisories/CVE-2026-78013/https://agentprime.io/advisories/CVE-2026-78013/CVSS 5.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 09 Oct 2026 08:26:10 GMTCVECVE-2026-104078: Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypasshttps://agentprime.io/advisories/CVE-2026-104078/https://agentprime.io/advisories/CVE-2026-104078/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 08 Oct 2026 16:38:20 GMTCVECVE-2026-104077: Obsidian Desktop < 1.14.0 RCE via Slides Plugin Markdownhttps://agentprime.io/advisories/CVE-2026-104077/https://agentprime.io/advisories/CVE-2026-104077/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 08 Oct 2026 16:27:08 GMTCVECVE-2026-76276: Information Disclosure in the Discover Splunk Observability Cloud app through Splunk Web for Splunk Enterprisehttps://agentprime.io/advisories/CVE-2026-76276/https://agentprime.io/advisories/CVE-2026-76276/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 07 Oct 2026 20:46:35 GMTCVEPraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threatshttps://agentprime.io/advisories/GHSA-fj8f-m44g-c479/https://agentprime.io/advisories/GHSA-fj8f-m44g-c479/praisonai <4.6.78, fixed in 4.6.78. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Wed, 07 Oct 2026 20:43:58 GMTPyPIpraisonaiDocling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic enginehttps://agentprime.io/advisories/GHSA-x3q2-h9hx-4r4j/https://agentprime.io/advisories/GHSA-x3q2-h9hx-4r4j/docling >=2.94.0, <2.132.0, fixed in 2.132.0. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Wed, 07 Oct 2026 20:42:05 GMTPyPIdoclingdocling-slimCVE-2026-33586: Authenticated SMTP Sender Address Forgeryhttps://agentprime.io/advisories/CVE-2026-33586/https://agentprime.io/advisories/CVE-2026-33586/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 07 Oct 2026 15:00:14 GMTCVECVE-2026-103956: Missing authentication for critical function in Loom for AWShttps://agentprime.io/advisories/CVE-2026-103956/https://agentprime.io/advisories/CVE-2026-103956/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 19:06:06 GMTCVEcriticalCVE-2026-85086: Apache Thrift: Perl TLS client disables certificate verification by defaulthttps://agentprime.io/advisories/CVE-2026-85086/https://agentprime.io/advisories/CVE-2026-85086/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 11:34:00 GMTCVECVE-2026-85494: Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a pe…https://agentprime.io/advisories/CVE-2026-85494/https://agentprime.io/advisories/CVE-2026-85494/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 10:42:44 GMTCVECVE-2026-94634: Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by defaulthttps://agentprime.io/advisories/CVE-2026-94634/https://agentprime.io/advisories/CVE-2026-94634/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Oct 2026 10:11:20 GMTCVECVE-2026-71448: Johnson Controls EasyIO FS32: : Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO…https://agentprime.io/advisories/CVE-2026-71448/https://agentprime.io/advisories/CVE-2026-71448/CVSS 5.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 01 Oct 2026 21:15:22 GMTCVEvm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scriptshttps://agentprime.io/advisories/GHSA-jxxv-8r27-vm4p/https://agentprime.io/advisories/GHSA-jxxv-8r27-vm4p/vm2 <3.11.7, fixed in 3.11.7. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.Thu, 01 Oct 2026 15:40:45 GMTnpmvm2criticalCVE-2026-100260: JetBrains YouTrack: In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication…https://agentprime.io/advisories/CVE-2026-100260/https://agentprime.io/advisories/CVE-2026-100260/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 30 Sep 2026 15:17:48 GMTCVECVE-2026-100291: Initialization of a resource with an insecure default in Anjvision YSSD-RTMP-H5https://agentprime.io/advisories/CVE-2026-100291/https://agentprime.io/advisories/CVE-2026-100291/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 29 Sep 2026 19:34:23 GMTCVEcriticalElectron: <webview> can enable Node.js integration in Web Workers despite embedder restrictionshttps://agentprime.io/advisories/GHSA-9qh4-3jw8-366w/https://agentprime.io/advisories/GHSA-9qh4-3jw8-366w/electron <41.10.6 || >=42.0.0-alpha.1, <42.9.2 || >=43.0.0-alpha.1, <43.4.1 || >=44.0.0-alpha.1, <44.0.0-beta.5, fixed in 41.10.6, 42.9.2, 43.4.1, 44.0.0-beta.5. CVSS 8.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 29 Sep 2026 18:02:18 GMTnpmelectronCVE-2026-73596: Dell Secure Connect Gateway (SCG) Policy Manager: Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16…https://agentprime.io/advisories/CVE-2026-73596/https://agentprime.io/advisories/CVE-2026-73596/CVSS 3.8 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 29 Sep 2026 11:52:26 GMTCVE