# CWE-1220.

Every Advisory and CVE whose sources give the weakness CWE-1220, newest first.

## Records, newest first

- [Immich calendar heatmap endpoint discloses cross-user activity through broken access control](https://agentprime.io/advisories/CVE-2026-104867.md)
  `CVE-2026-104867` · CVE record: immich-app immich · CVSS 4.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control, CWE-1220
- [Improper access control vulnerability](https://agentprime.io/advisories/CVE-2026-77779.md)
  `CVE-2026-77779` · CVE record: Zohocorp ManageEngine Key Manager Plus · CVSS 7.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-1220
- [Improper access control vulnerability](https://agentprime.io/advisories/CVE-2026-77778.md)
  `CVE-2026-77778` · CVE record: Zohocorp ManageEngine Key Manager Plus · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-1220
- [Improper access control vulnerability](https://agentprime.io/advisories/CVE-2026-77777.md)
  `CVE-2026-77777` · CVE record: Zohocorp ManageEngine Key Manager Plus · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-1220
- [Gitea limited-visibility profile disclosure with public-only tokens](https://agentprime.io/advisories/CVE-2026-119627.md)
  `CVE-2026-119627` · CVE record: Gitea Gitea · No CVSS score · Not analysed yet · Published 1 Nov 2026 · Tags: CWE-1220
- [Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes](https://agentprime.io/advisories/CVE-2026-57202.md)
  `CVE-2026-57202` · CVE record: asterisk asterisk and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Privilege escalation, CWE-1220
- [Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-167](https://agentprime.io/advisories/CVE-2026-96372.md)
  `CVE-2026-96372` · CVE record: Drupal Webform · CVSS 5.4 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-1220
- [Cross-organization user modification and deletion via the SCIM API in Grafana Enterprise](https://agentprime.io/advisories/CVE-2026-92539.md)
  `CVE-2026-92539` · CVE record: Grafana Grafana Enterprise · CVSS 6.7 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control, CWE-1220
- [Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching](https://agentprime.io/advisories/CVE-2026-85316.md)
  `CVE-2026-85316` · CVE record: Apache Software Foundation Apache Camel · CVSS 4.8 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-1220
- [phpMyFAQ 4.2.0-alpha before 4.2.0-beta Missing Authorization via deleteGroup API](https://agentprime.io/advisories/CVE-2026-111885.md)
  `CVE-2026-111885` · CVE record: thorsten phpMyFAQ · CVSS 7.0 High · Not analysed yet · Published 17 Oct 2026 · Tags: CWE-1220
- [Credential Disclosure in P4 Search Configuration API](https://agentprime.io/advisories/CVE-2026-103509.md)
  `CVE-2026-103509` · CVE record: Perforce P4 (Helix core) · CVSS 8.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-1220
- [Gitea private attachment disclosure through repository mismatch](https://agentprime.io/advisories/CVE-2026-78433.md)
  `CVE-2026-78433` · CVE record: Gitea Gitea · CVSS 5.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control, CWE-1220
- [Windows Mobile Device Management Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-70216.md)
  `CVE-2026-70216` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-1220
- [Windows Server Update Service Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83499.md)
  `CVE-2026-83499` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-1220
- [Windows Server Update Service Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-81969.md)
  `CVE-2026-81969` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-1220
- [Windows StateRepository API Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-70218.md)
  `CVE-2026-70218` · CVE record: Microsoft Windows 11 Version 24H2 and 3 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control, CWE-1220
- [Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs](https://agentprime.io/advisories/CVE-2026-93294.md)
  `CVE-2026-93294` · CVE record: Grafana Grafana Enterprise and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control, CWE-441, CWE-1220
- [Insufficient Granularity of Access Control in GitLab](https://agentprime.io/advisories/CVE-2026-14210.md)
  `CVE-2026-14210` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-1220
- [Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle](https://agentprime.io/advisories/GHSA-7qr8-wrvq-566q.md)
  `GHSA-7qr8-wrvq-566q`, `CVE-2026-86338`, `EEF-CVE-2026-86338` · Hex `ash`: affected `>=2.11.0-rc.0, <3.33.4`, fixed in `3.33.4` · CVSS 6.0 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-1220
- [Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center](https://agentprime.io/advisories/CVE-2026-86830.md)
  `CVE-2026-86830` · CVE record: AWS iam-identity-center-team · CVSS 8.6 High · Not analysed yet · Published 14 Sept 2026 · Tags: Privilege escalation, CWE-1220
- [SQL Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-77480.md)
  `CVE-2026-77480` · CVE record: Microsoft Microsoft SQL Server 2017 (CU 31) and 4 more · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-1220
- [Microsoft SQL Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-66814.md)
  `CVE-2026-66814` · CVE record: Microsoft Microsoft SQL Server 2017 (CU 31) and 4 more · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-1220
- [Windows Connected User Experiences and Telemetry Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-69267.md)
  `CVE-2026-69267` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-1220
- [AshLua eval read operations can read field-policy-protected fields via aggregates](https://agentprime.io/advisories/GHSA-5whv-8rcp-x33j.md)
  `GHSA-5whv-8rcp-x33j`, `CVE-2026-78216`, `EEF-CVE-2026-78216` · Hex `ash_lua`: affected `>=0.1.0, <0.2.2`, fixed in `0.2.2` · CVSS 6.0 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-1220
- [AshAi aggregate tool can read field-policy-protected fields](https://agentprime.io/advisories/GHSA-v5rw-36x5-r5vx.md)
  `GHSA-v5rw-36x5-r5vx`, `CVE-2026-78230`, `EEF-CVE-2026-78230` · Hex `ash_ai`: affected `>=0.1.0, <1.0.3`, fixed in `1.0.3` · CVSS 6.0 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-1220
- [HP Support Assistant – Potential Escalation of Privilege](https://agentprime.io/advisories/CVE-2026-15431.md)
  `CVE-2026-15431` · CVE record: HP Inc. HP Support Assistant · CVSS 7.3 High · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-1220
- [docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems](https://agentprime.io/advisories/CVE-2026-78122.md)
  `CVE-2026-78122` · CVE record: Tecnativa docker-socket-proxy · CVSS 8.3 High · Not analysed yet · Published 22 Aug 2026 · Tags: CWE-1220
- [Control protections bypass in BeyondTrust Endpoint Privilege Management (Windows deployment) support utility](https://agentprime.io/advisories/CVE-2026-40145.md)
  `CVE-2026-40145` · CVE record: BeyondTrust Endpoint Privilege Management (Windows deployment) · CVSS 7.1 High · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-1220
- [The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's \`team_name\` was accepted by t...](https://agentprime.io/advisories/PYSEC-2026-3714.md)
  `PYSEC-2026-3714`, `CVE-2026-68868` · PyPI `apache-airflow-providers-google`: affected `<22.3.0`, fixed in `22.3.0` · CVSS 6.5 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: CWE-1220
- [Windows User-Mode Power Service (UMPS) Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-62721.md)
  `CVE-2026-62721` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-1220
- [Intel(R) Xeon(R) 6 Scalable processors with Intel(R) TDX…: Insufficient granularity of access control in some subsystem for some Intel(R) Xeon(R) 6…](https://agentprime.io/advisories/CVE-2025-31938.md)
  `CVE-2025-31938` · CVE record: Intel(R) Xeon(R) 6 Scalable processors with Intel(R) TDX may allow an information disclosure. Authorized adversary with an authenticated user combined with a high complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (none) and availability (none) impacts. · CVSS 4.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-1220
- [389-ds-base: 389-ds-base: heap-buffer-overflow in rdn_av_swap on quoted multivalued rdn](https://agentprime.io/advisories/CVE-2026-16560.md)
  `CVE-2026-16560` · CVE record: Red Hat Red Hat Directory Server 11 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-1220
- [Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles](https://agentprime.io/advisories/CVE-2026-16106.md)
  `CVE-2026-16106` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.9 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Broken access control, CWE-1220
- [Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2](https://agentprime.io/advisories/CVE-2026-16108.md)
  `CVE-2026-16108` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: Information disclosure, CWE-1220
- [Windows Event Logging Service Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-50502.md)
  `CVE-2026-50502` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 8.0 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-1220
- [Windows Filtering Platform Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-50405.md)
  `CVE-2026-50405` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-1220
- [Surface Broker SDMA Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-48581.md)
  `CVE-2026-48581` · CVE record: Microsoft Microsoft Surface Go and 4 more · CVSS 7.8 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-1220
- [Active Directory Federation Services Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-56155.md)
  `CVE-2026-56155` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-1220
- [Microsoft Exchange Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-55006.md)
  `CVE-2026-55006` · CVE record: Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 and 3 more · CVSS 7.8 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-1220
- [Windows StateRepository API Server file Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-49170.md)
  `CVE-2026-49170` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.8 High · Not analysed yet · Published 14 Jul 2026 · Tags: Broken access control, CWE-1220
- [Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter](https://agentprime.io/advisories/CVE-2026-14615.md)
  `CVE-2026-14615` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 3 more · CVSS 4.3 Medium · Not analysed yet · Published 3 Jul 2026 · Tags: CWE-1220
- [Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission](https://agentprime.io/advisories/CVE-2026-14613.md)
  `CVE-2026-14613` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 3 Jul 2026 · Tags: Broken access control, CWE-1220
- [Keycloak: Information disclosure due to user profile permission bypass](https://agentprime.io/advisories/GHSA-6g26-7cx5-mrrg.md)
  `GHSA-6g26-7cx5-mrrg`, `CVE-2026-9088` · Maven `org.keycloak:keycloak-services`: affected `<26.7.0`, fixed in `26.7.0` · CVSS 2.7 Low · Not analysed yet · Published 5 Jun 2026 · Tags: CWE-1220
- [Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user space application to map sensitive SMN (System Management Network) apertures lead…](https://agentprime.io/advisories/CVE-2021-46747.md)
  `CVE-2021-46747` · CVE record: AMD AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics and 4 more · CVSS 7.1 High · Not analysed yet · Published 1 Jun 2026 · Tags: CWE-1220
- [MLflow allows unauthorized access to multipart upload endpoints when the \`--serve-artifacts\` mode is enabled](https://agentprime.io/advisories/GHSA-8c7q-86fq-vvmh.md)
  `GHSA-8c7q-86fq-vvmh`, `BIT-mlflow-2026-2651`, `CVE-2026-2651`, `PYSEC-2026-2220` · PyPI `mlflow`: affected `<3.10.0`, fixed in `3.10.0` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 May 2026 · Tags: Broken access control, CWE-1220
- [Keycloak Account Resources user lookup contains broken access control](https://agentprime.io/advisories/GHSA-933f-rg6j-f46p.md)
  `GHSA-933f-rg6j-f46p`, `BIT-keycloak-2026-37981`, `CVE-2026-37981` · Maven `org.keycloak:keycloak-services`: affected `<26.4.12 || >=26.5.0, <26.6.2`, fixed in `26.4.12`, `26.6.2` · CVSS 4.3 Medium · Not analysed yet · Published 19 May 2026 · Tags: CWE-1220
- [Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resu…](https://agentprime.io/advisories/CVE-2025-54518.md)
  `CVE-2025-54518` · CVE record: AMD AMD EPYC™ 7002 Series Processors and 4 more · CVSS 7.3 High · Not analysed yet · Published 15 May 2026 · Tags: CWE-1189, CWE-1220
- [Improper Input Validation in the AMD RAID driver could allow an attacker to point to an arbitrary memory location potentially resulting in privilege escalation and arbitrary code execution.](https://agentprime.io/advisories/CVE-2024-21962.md)
  `CVE-2024-21962` · CVE record: AMD AMD EPYC™ 4005 Series Processors and 4 more · CVSS 8.6 High · Not analysed yet · Published 15 May 2026 · Tags: CWE-1220
- [Microsoft Office Click-To-Run Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-35436.md)
  `CVE-2026-35436` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 3 more · CVSS 8.8 High · Not analysed yet · Published 12 May 2026 · Tags: CWE-1220
- [Microsoft SharePoint Server Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-40365.md)
  `CVE-2026-40365` · CVE record: Microsoft Microsoft SharePoint Enterprise Server 2016 and 2 more · CVSS 8.8 High · Not analysed yet · Published 12 May 2026 · Tags: CWE-1220
- [Spring Cloud Config has an Authorization Bypass Through User-Controlled Key](https://agentprime.io/advisories/GHSA-2mh5-3cw6-hrrq.md)
  `GHSA-2mh5-3cw6-hrrq`, `CVE-2026-40981` · Maven `org.springframework.cloud:spring-cloud-config-server`: affected `>=3.1.0, <=3.1.13 || >=4.1.0, <=4.1.9 || >=4.2.0, <=4.2.6 || >=4.3.0, <4.3.3 || >=5.0.0, <5.0.3`, fixed in `4.3.3`, `5.0.3` · CVSS 7.5 High · Not analysed yet · Published 7 May 2026 · Tags: Broken access control, CWE-1220
- [Kata Container has CopyFile Policy Subversion via Symlinks](https://agentprime.io/advisories/GHSA-q49m-57vm-c8cc.md)
  `GHSA-q49m-57vm-c8cc`, `CVE-2026-41326`, `GO-2026-5563` · Go `github.com/kata-containers/kata-containers`: affected `<0.0.0-20260422180503-1b9e49eb2763`, fixed in `0.0.0-20260422180503-1b9e49eb2763` · CVSS 8.2 High · Not analysed yet · Published 4 May 2026 · Tags: CWE-61, CWE-1220
- [OpenClaw: Agent gateway config mutations could change protected operator settings](https://agentprime.io/advisories/GHSA-7jm2-g593-4qrc.md)
  `GHSA-7jm2-g593-4qrc`, `CVE-2026-45001` · npm `openclaw`: affected `<2026.4.20`, fixed in `2026.4.20` · CVSS 6.0 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Broken access control, CWE-1220
- [Apache Airflow's asset dependency graph did not restrict nodes by the viewer's DAG read permissions](https://agentprime.io/advisories/GHSA-w7rc-q6cm-f5gm.md)
  `GHSA-w7rc-q6cm-f5gm`, `BIT-airflow-2026-40690`, `CVE-2026-40690`, `PYSEC-2026-2356` · PyPI `apache-airflow`: affected `<3.2.1rc1`, fixed in `3.2.1rc1` · CVSS 4.3 Medium · Not analysed yet · Published 24 Apr 2026 · Tags: CWE-1220
- [Apache Airflow's authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance record](https://agentprime.io/advisories/GHSA-p3v3-229h-mc63.md)
  `GHSA-p3v3-229h-mc63`, `BIT-airflow-2026-38743`, `CVE-2026-38743`, `PYSEC-2026-2351` · PyPI `apache-airflow`: affected `<3.2.1rc1`, fixed in `3.2.1rc1` · CVSS 4.3 Medium · Not analysed yet · Published 24 Apr 2026 · Tags: CWE-1220
- [CVE-2026-6356](https://agentprime.io/advisories/CVE-2026-6356.md)
  `CVE-2026-6356` · CVE record: Augmentt Augmentt · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-1220
- [Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys](https://agentprime.io/advisories/GHSA-47wq-cj9q-wpmp.md)
  `GHSA-47wq-cj9q-wpmp` · npm `@paperclipai/server`: affected `<2026.416.0`, fixed in `2026.416.0` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2026 · Tags: Broken access control, CWE-1220
- [Argocd-image-updater: argocd image updater: cross-namespace privilege escalation via insufficient namespace validation](https://agentprime.io/advisories/CVE-2026-6388.md)
  `CVE-2026-6388` · CVE record: Red Hat Red Hat OpenShift GitOps · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Apr 2026 · Tags: CWE-1220
- [Microsoft Defender Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-33825.md)
  `CVE-2026-33825` · CVE record: Microsoft Microsoft Defender Antimalware Platform · CVSS 7.8 High · Critical (KEV) · In CISA KEV, ransomware · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-1220
- [Insufficient granularity of access control for Remote Connector Servers in client mode](https://agentprime.io/advisories/CVE-2025-20628.md)
  `CVE-2025-20628` · CVE record: Ping Identity PingIDM · CVSS 6.9 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-1220

Older: <https://agentprime.io/advisories/tag/cwe-1220.md?cursor=WyIyMDI2LTA0LTA3VDIyOjMzOjA1LjM1NjAwMFoiLCJDVkUtMjAyNS0yMDYyOCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1220>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1220/>. Everything for agents: <https://agentprime.io/llms.txt>.