# CWE-1287.

Every Advisory and CVE whose sources give the weakness CWE-1287, newest first.

## Records, newest first

- [Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured](https://agentprime.io/advisories/CVE-2026-110985.md)
  `CVE-2026-110985` · CVE record: Apache Software Foundation Apache Kafka · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Weak cryptography or TLS, CWE-345, CWE-636, CWE-1287
- [GitPython command wrappers omit unsafe protocol and option checks](https://agentprime.io/advisories/GHSA-w8jc-g24h-crhw.md)
  `GHSA-w8jc-g24h-crhw`, `CVE-2026-110857` · PyPI `gitpython`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 7.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-1287
- [Laravel TokenGuard authentication bypass through non-string API credentials](https://agentprime.io/advisories/GHSA-f9x3-7vq9-cph6.md)
  `GHSA-f9x3-7vq9-cph6`, `CVE-2026-114509`, `PKSA-b41t-wbzk-9q51` · Packagist `laravel/framework`: affected `<12.68.0 || >=13.0.0, <13.29.0`, fixed in `12.68.0`, `13.29.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, CWE-1287
- [OpenStack Ironic: OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g…](https://agentprime.io/advisories/CVE-2026-90458.md)
  `CVE-2026-90458` · CVE record: OpenStack Ironic · CVSS 5.4 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-1287
- [.NET Framework Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-97801.md)
  `CVE-2026-97801` · CVE record: Microsoft Microsoft .NET Framework 3.5 and 4 more · CVSS 7.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-1287
- [Microsoft Office SharePoint Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-96044.md)
  `CVE-2026-96044` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Privilege escalation, CWE-1287
- [Dell Secure Connect Gateway (SCG) Policy Manager: Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16…](https://agentprime.io/advisories/CVE-2026-78016.md)
  `CVE-2026-78016` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 3.1 Low · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-1287
- [fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array](https://agentprime.io/advisories/GHSA-5hjw-83fp-phq9.md)
  `GHSA-5hjw-83fp-phq9`, `CVE-2026-107723` · npm `fast-jwt`: affected `<6.3.0`, fixed in `6.3.0` · CVSS 8.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-1287
- [PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats](https://agentprime.io/advisories/GHSA-fj8f-m44g-c479.md)
  `GHSA-fj8f-m44g-c479`, `CVE-2026-61439`, `PYSEC-2026-4255` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 8.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-116, CWE-693, CWE-1188, CWE-1287
- [Mis-typed WebAssembly tag imports can lead to GC heap corruption](https://agentprime.io/advisories/GHSA-cfhf-m2cr-62wj.md)
  `GHSA-cfhf-m2cr-62wj`, `CVE-2026-115383`, `RUSTSEC-2026-0325` · crates.io `wasmtime`: affected `>=47.0.0, <48.0.4 || >=49.0.0, <49.0.2`, fixed in `48.0.4`, `49.0.2` · CVSS 5.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-1287
- [ICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option walkers past the packet or into a permane…](https://agentprime.io/advisories/CVE-2026-102714.md)
  `CVE-2026-102714` · CVE record: Eclipse Foundation Eclipse ThreadX NetX Duo · CVSS 7.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption, Denial of service, CWE-1287
- [CVE-2026-94570](https://agentprime.io/advisories/CVE-2026-94570.md)
  `CVE-2026-94570` · CVE record: SGLang SGLang · CVSS 5.9 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-1287
- [Mattermost Desktop App plugin popout scheme validation bypass](https://agentprime.io/advisories/CVE-2026-75588.md)
  `CVE-2026-75588` · CVE record: Mattermost Mattermost · CVSS 2.6 Low · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-1287
- [Siemens WTV676-HB6035 Web Interface: A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions <…](https://agentprime.io/advisories/CVE-2026-89207.md)
  `CVE-2026-89207` · CVE record: Siemens WTV676-HB6035 Web Interface and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-1287
- [Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value](https://agentprime.io/advisories/GHSA-v39v-59xw-j98g.md)
  `GHSA-v39v-59xw-j98g`, `CVE-2026-87012`, `PYSEC-2026-4126` · PyPI `open-webui`: affected `>=0.9.0, <0.11.1`, fixed in `0.11.1` · CVSS 4.3 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: CWE-754, CWE-1287
- [Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths](https://agentprime.io/advisories/CVE-2026-86287.md)
  `CVE-2026-86287` · CVE record · CVSS 7.5 High · Not analysed yet · Published 7 Sept 2026 · Tags: CWE-1287
- [yast2-users: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute](https://agentprime.io/advisories/CVE-2026-59680.md)
  `CVE-2026-59680` · CVE record: SUSE yast2-users · CVSS 8.6 High · Not analysed yet · Published 1 Sept 2026 · Tags: Command injection, CWE-1287
- [Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion](https://agentprime.io/advisories/GHSA-2mmm-gc86-7jgg.md)
  `GHSA-2mmm-gc86-7jgg`, `CVE-2026-82741`, `EEF-CVE-2026-82741` · Hex `ash`: affected `>=2.14.18, <3.32.2`, fixed in `3.32.2` · CVSS 2.1 Low · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-1287
- [graphql-go: github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a…](https://agentprime.io/advisories/CVE-2026-80051.md)
  `CVE-2026-80051` · CVE record: graphql-go project graphql-go · CVSS 5.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-1287
- [Cri-o: cri-o: unvalidated image env var causes daemon crash](https://agentprime.io/advisories/CVE-2026-17113.md)
  `CVE-2026-17113` · CVE record: Red Hat Red Hat OpenShift Container Platform 4 · CVSS 6.0 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-1287
- [An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation.](https://agentprime.io/advisories/CVE-2026-5304.md)
  `CVE-2026-5304` · CVE record: Axis Communications AB AXIS OS · CVSS 5.7 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-1287
- [Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API](https://agentprime.io/advisories/CVE-2026-18830.md)
  `CVE-2026-18830` · CVE record: AWS Amazon Bedrock AgentCore harness · CVSS 8.6 High · Not analysed yet · Published 4 Aug 2026 · Tags: CWE-1287
- [XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup](https://agentprime.io/advisories/CVE-2026-9390.md)
  `CVE-2026-9390` · CVE record: TIMLEGGE XML::Sig · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Aug 2026 · Tags: Other injection, CWE-1287
- [In geniezone, there is a possible escalation of privilege due to a missing permission check.](https://agentprime.io/advisories/CVE-2026-20498.md)
  `CVE-2026-20498` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 6.0 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-1287
- [OTP Bypass in Magarsus' IDM-MFA](https://agentprime.io/advisories/CVE-2026-4773.md)
  `CVE-2026-4773` · CVE record: Magarsus Consulting Ltd. Co. IDM-MFA · CVSS 8.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-1287
- [Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability](https://agentprime.io/advisories/GHSA-w7cw-xp7h-6j5j.md)
  `GHSA-w7cw-xp7h-6j5j`, `BIT-dotnet-2026-50524`, `BIT-dotnet-sdk-2026-50524`, `CVE-2026-50524` · NuGet `Microsoft.NetCore.App.Runtime.linux-arm` and 11 more: affected `>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.29`, `9.0.18`, `10.0.10` · CVSS 7.5 High · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-1287
- [Microsoft Word Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-55124.md)
  `CVE-2026-55124` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-20, CWE-1287
- [YesWiki: SQL injection via the \`recentchanges\` action \`period\` argument leads to arbitrary DB read](https://agentprime.io/advisories/GHSA-89v6-j5x6-cmj3.md)
  `GHSA-89v6-j5x6-cmj3`, `CVE-2026-52763`, `PKSA-qtt4-qmsv-g7gm` · Packagist `yeswiki/yeswiki`: affected `<4.6.6`, fixed in `4.6.6` · CVSS 6.5 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: SQL injection, CWE-1287
- [Keycloak: Unauthorized access via improper validation of encrypted SAML assertions](https://agentprime.io/advisories/GHSA-794g-x443-36f7.md)
  `GHSA-794g-x443-36f7`, `BIT-keycloak-2026-2092`, `CVE-2026-2092` · Maven `org.keycloak:keycloak-services`: affected `<=26.2.5 || >=26.3.0, <=26.4.7 || >=26.5.0, <26.5.5`, fixed in `26.5.5` · CVSS 7.7 High · Not analysed yet · Published 2 Jul 2026 · Tags: CWE-1287
- [Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated \`valuesFrom\` references in Helm Deployer](https://agentprime.io/advisories/GHSA-xr65-5cpm-g36x.md)
  `GHSA-xr65-5cpm-g36x`, `CVE-2026-44935`, `GO-2026-5877` · Go `github.com/rancher/fleet`: affected `>=0.12.0, <0.12.15 || >=0.13.0, <0.13.11 || >=0.14.0, <0.14.6 || >=0.15.0, <0.15.2`, fixed in `0.12.15`, `0.13.11`, `0.14.6`, `0.15.2` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: Broken access control, CWE-1287
- [vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels](https://agentprime.io/advisories/GHSA-7h4p-rffg-7823.md)
  `GHSA-7h4p-rffg-7823`, `CVE-2026-54235`, `PYSEC-2026-3405` · PyPI `vllm`: affected `>=0.8.5, <0.24.0`, fixed in `0.24.0` · CVSS 6.9 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: CWE-1287
- [Improper JSON Input Validation in WebSocket API Leads to Denial of Service](https://agentprime.io/advisories/CVE-2026-10825.md)
  `CVE-2026-10825` · CVE record: Moxa NPort 6000-G2 Series · CVSS 7.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-1287
- [Server crash via malformed binary diff passed to $\_internalApplyOplogUpdate.](https://agentprime.io/advisories/CVE-2026-9753.md)
  `CVE-2026-9753` · CVE record: MongoDB MongoDB Server · CVSS 7.2 High · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-1287
- [Authenticate command with specific mechanism parameter can trigger server crash](https://agentprime.io/advisories/CVE-2026-9742.md)
  `CVE-2026-9742` · CVE record: MongoDB MongoDB Server · CVSS 8.2 High · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-1287
- [Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking](https://agentprime.io/advisories/GHSA-3qp7-7mw8-wx86.md)
  `GHSA-3qp7-7mw8-wx86`, `CVE-2026-44249` · Maven `io.netty:netty-handler`: affected `>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final`, fixed in `4.2.15.Final`, `4.1.135.Final` · CVSS 8.1 High · Not analysed yet · Published 8 Jun 2026 · Tags: Broken access control, CWE-697, CWE-1287
- [Boost Serialization improper validation of specified type of input](https://agentprime.io/advisories/CVE-2026-11460.md)
  `CVE-2026-11460` · CVE record: Boost Serialization · CVSS 6.3 Medium · Not analysed yet · Published 7 Jun 2026 · Tags: CWE-20, CWE-1287
- [In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.](https://agentprime.io/advisories/CVE-2024-6858.md)
  `CVE-2024-6858` · CVE record: Arista Networks EOS · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-1287
- [Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection](https://agentprime.io/advisories/GHSA-3hrh-pfw6-9m5x.md)
  `GHSA-3hrh-pfw6-9m5x`, `CVE-2026-47675` · npm `hono`: affected `<4.12.21`, fixed in `4.12.21` · CVSS 4.3 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Other injection, CWE-1287
- [Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses](https://agentprime.io/advisories/CVE-2026-49941.md)
  `CVE-2026-49941` · CVE record: RRWO Net::CIDR::Set · CVSS 7.5 High · Not analysed yet · Published 4 Jun 2026 · Tags: Denial of service, CWE-1287
- [Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims](https://agentprime.io/advisories/GHSA-29fc-p6c4-24cg.md)
  `GHSA-29fc-p6c4-24cg`, `CVE-2026-45069`, `PKSA-7tp5-63ss-rycr`, `PKSA-jzjr-4n2h-knvd` · Packagist `symfony/security-http` and 1 more: affected `>=6.3.0, <6.4.40 || >=7.4.0, <7.4.12 || >=8.0.0, <8.0.12`, fixed in `6.4.40`, `7.4.12`, `8.0.12` · CVSS 8.8 High · Not analysed yet · Published 27 May 2026 · Tags: CWE-345, CWE-1287
- [Command injection via USB](https://agentprime.io/advisories/CVE-2026-40851.md)
  `CVE-2026-40851` · CVE record: MB connect line mbNET/mbNET.rokey and 3 more · CVSS 8.4 High · Not analysed yet · Published 27 May 2026 · Tags: CWE-1287
- [Mattermost doesn't validate user-supplied input in API request handlers](https://agentprime.io/advisories/GHSA-rmvv-8v8w-rf7x.md)
  `GHSA-rmvv-8v8w-rf7x`, `CVE-2026-4646`, `GO-2026-5833` · Go `github.com/mattermost/mattermost-plugin-github` and 1 more: affected `<1.0.1-0.20260330164815-c2840e980b3c`, fixed in `1.0.1-0.20260330164815-c2840e980b3c` · CVSS 4.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: CWE-1287
- [fraillt bitsery std_smart_ptr.h loadFromSharedState improper validation of specified type of input](https://agentprime.io/advisories/CVE-2026-9521.md)
  `CVE-2026-9521` · CVE record: fraillt bitsery · CVSS 6.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: CWE-20, CWE-1287
- [Concrete CMS: OAuth 2.0 Authorization-Code Handler Bypasses Account Status](https://agentprime.io/advisories/GHSA-f54h-78c9-c24h.md)
  `GHSA-f54h-78c9-c24h`, `CVE-2026-7887`, `PKSA-td7z-y5jc-79yq` · Packagist `concrete5/concrete5`: affected `<9.5.1`, fixed in `9.5.1` · CVSS 2.3 Low · Not analysed yet · Published 22 May 2026 · Tags: CWE-1287
- [Invalid handling of CLASS != IN](https://agentprime.io/advisories/CVE-2026-5946.md)
  `CVE-2026-5946` · CVE record: ISC BIND 9 · CVSS 7.5 High · Not analysed yet · Published 20 May 2026 · Tags: Memory corruption, Denial of service, CWE-20, CWE-754
- [An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation.](https://agentprime.io/advisories/CVE-2026-0802.md)
  `CVE-2026-0802` · CVE record: Axis Communications AB AXIS OS · CVSS 6.0 Medium · Not analysed yet · Published 12 May 2026 · Tags: CWE-1287
- [NEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV) decoder.](https://agentprime.io/advisories/CVE-2026-29645.md)
  `CVE-2026-29645` · CVE record · CVSS 7.5 High · Not analysed yet · Published 20 Apr 2026 · Tags: Memory corruption, CWE-1287
- [Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header](https://agentprime.io/advisories/GHSA-247c-9743-5963.md)
  `GHSA-247c-9743-5963`, `CVE-2025-32442`, `CVE-2026-33806`, `GHSA-mg2h-6x62-wpwc` · npm `fastify`: affected `>=5.3.2, <5.8.5`, fixed in `5.8.5` · CVSS 7.5 High · Not analysed yet · Published 15 Apr 2026 · Tags: CWE-1287, CWE-1289
- [TSPortal: Any user can forge self-deletion requests for any account](https://agentprime.io/advisories/GHSA-gfhq-7499-f3f2.md)
  `GHSA-gfhq-7499-f3f2`, `CVE-2026-29788`, `PKSA-95py-dkb3-3t1y` · Packagist `miraheze/ts-portal`: affected `<30`, fixed in `30` · CVSS 8.4 High · Not analysed yet · Published 27 Mar 2026 · Tags: CWE-283, CWE-1287
- [jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs](https://agentprime.io/advisories/GHSA-8g7p-jf3g-gxcp.md)
  `GHSA-8g7p-jf3g-gxcp`, `CVE-2026-4598` · npm `jsrsasign`: affected `<11.1.1`, fixed in `11.1.1` · CVSS 8.7 High · Not analysed yet · Published 23 Mar 2026 · Tags: Denial of service, CWE-1287
- [SpotAuditor 5.2.6 Name Field Denial of Service](https://agentprime.io/advisories/CVE-2019-25596.md)
  `CVE-2019-25596` · CVE record: Nsauditor SpotAuditor · CVSS 6.9 Medium · Not analysed yet · Published 22 Mar 2026 · Tags: CWE-1287
- [Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions](https://agentprime.io/advisories/GHSA-wmxr-6j5f-838p.md)
  `GHSA-wmxr-6j5f-838p` · Maven `org.keycloak:keycloak-saml-adapter-core` and 2 more: affected `<26.2.14 || >=26.3.0, <26.4.10 || >=26.5.0, <26.5.5`, fixed in `26.2.14`, `26.4.10`, `26.5.5` · CVSS 7.7 High · Withdrawn · Not analysed yet · Published 18 Mar 2026 · Tags: CWE-1287
- [DoS in Calls plugin via malformed msgpack in websocket request.](https://agentprime.io/advisories/CVE-2026-2454.md)
  `CVE-2026-2454` · CVE record: Mattermost Mattermost · CVSS 5.8 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-1287
- [Mattermost fails to properly validate User-Agent header tokens](https://agentprime.io/advisories/GHSA-2v3w-6g35-5f9v.md)
  `GHSA-2v3w-6g35-5f9v`, `CVE-2026-25783`, `GO-2026-4725` · Go `github.com/mattermost/mattermost-server` and 1 more: affected `<5.3.2-0.20260129181235-1346cf529aef || >=10.11.0-rc1, <10.11.11 || >=11.2.0-rc1, <11.2.3 || >=11.3.0-rc1, <11.3.1`, fixed in `5.3.2-0.20260129181235-1346cf529aef`, `10.11.11`, `11.2.3`, `11.3.1` · CVSS 4.3 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-1287
- [Cisco IOS XR Software Multi-Instance Intermediate System-to-Intermediate System Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-20074.md)
  `CVE-2026-20074` · CVE record: Cisco Cisco IOS XR Software · CVSS 7.4 High · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-1287
- [SQL Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-26115.md)
  `CVE-2026-26115` · CVE record: Microsoft Microsoft SQL Server 2016 Service Pack 3 (GDR) and 4 more · CVSS 8.8 High · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-1287
- [Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-25179.md)
  `CVE-2026-25179` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.0 High · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-1287
- [PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code](https://agentprime.io/advisories/CVE-2026-2004.md)
  `CVE-2026-2004` · CVE record: PostgreSQL · CVSS 8.8 High · Not analysed yet · Published 12 Feb 2026 · Tags: CWE-1287
- [PostgreSQL oidvector discloses a few bytes of memory](https://agentprime.io/advisories/CVE-2026-2003.md)
  `CVE-2026-2003` · CVE record: PostgreSQL · CVSS 4.3 Medium · Not analysed yet · Published 12 Feb 2026 · Tags: CWE-1287
- [Axios is Vulnerable to Denial of Service via \_\_proto\_\_ Key in mergeConfig](https://agentprime.io/advisories/GHSA-43fc-jf86-j433.md)
  `GHSA-43fc-jf86-j433`, `CVE-2026-25639` · npm `axios`: affected `<0.30.3 || >=1.0.0, <1.13.5`, fixed in `0.30.3`, `1.13.5` · CVSS 7.5 High · Not analysed yet · Published 9 Feb 2026 · Tags: Prototype pollution, CWE-754, CWE-1287

Older: <https://agentprime.io/advisories/tag/cwe-1287.md?cursor=WyIyMDI2LTAyLTA5VDE3OjQ2OjE0LjAwMDAwMFoiLCJHSFNBLTQzZmMtamY4Ni1qNDMzIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1287>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1287/>. Everything for agents: <https://agentprime.io/llms.txt>.