agentprime: CWE-1287

CVE-2026-110985: Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured

Wed, 28 Oct 2026 16:37:45 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

GitPython command wrappers omit unsafe protocol and option checks

Tue, 27 Oct 2026 15:26:43 GMT

gitpython <3.2.0, fixed in 3.2.0. CVSS 7.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Laravel TokenGuard authentication bypass through non-string API credentials

Fri, 23 Oct 2026 21:50:27 GMT

laravel/framework <12.68.0 || >=13.0.0, <13.29.0, fixed in 12.68.0, 13.29.0. CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-90458: OpenStack Ironic: OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g…

Fri, 23 Oct 2026 03:50:48 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-97801: .NET Framework Tampering Vulnerability

Tue, 13 Oct 2026 19:01:45 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-96044: Microsoft Office SharePoint Elevation of Privilege Vulnerability

Tue, 13 Oct 2026 19:01:15 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-78016: Dell Secure Connect Gateway (SCG) Policy Manager: Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16…

Fri, 09 Oct 2026 08:34:18 GMT

CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.

fast-jwt : Silent claim-validator bypass when JWT payload is a JSON array

Thu, 08 Oct 2026 22:01:58 GMT

fast-jwt <6.3.0, fixed in 6.3.0. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

Wed, 07 Oct 2026 20:43:58 GMT

praisonai <4.6.78, fixed in 4.6.78. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Mis-typed WebAssembly tag imports can lead to GC heap corruption

Fri, 02 Oct 2026 12:00:00 GMT

wasmtime >=47.0.0, <48.0.4 || >=49.0.0, <49.0.2, fixed in 48.0.4, 49.0.2. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-102714: ICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option walkers past the packet or into a permane…

Tue, 29 Sep 2026 17:41:28 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-94570: CVE-2026-94570

Tue, 22 Sep 2026 14:15:00 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-75588: Mattermost Desktop App plugin popout scheme validation bypass

Thu, 17 Sep 2026 15:09:40 GMT

CVSS 2.6 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-89207: Siemens WTV676-HB6035 Web Interface: A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions <…

Wed, 16 Sep 2026 07:59:08 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value

Thu, 10 Sep 2026 22:42:48 GMT

open-webui >=0.9.0, <0.11.1, fixed in 0.11.1. CVSS 4.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-86287: Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths

Mon, 07 Sep 2026 18:25:37 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-59680: yast2-users: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute

Tue, 01 Sep 2026 09:20:45 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

Ash.Type.Union with :map_with_tag does not force the tag on dump, enabling tag confusion

Tue, 01 Sep 2026 03:33:03 GMT

ash >=2.14.18, <3.32.2, fixed in 3.32.2. CVSS 2.1 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-80051: graphql-go: github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a…

Tue, 25 Aug 2026 17:55:57 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-17113: Cri-o: cri-o: unvalidated image env var causes daemon crash

Mon, 24 Aug 2026 21:22:49 GMT

CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-5304: An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation.

Tue, 11 Aug 2026 05:47:49 GMT

CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-18830: Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API

Tue, 04 Aug 2026 17:42:20 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-9390: XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup

Mon, 03 Aug 2026 13:09:40 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-20498: In geniezone, there is a possible escalation of privilege due to a missing permission check.

Mon, 03 Aug 2026 02:06:06 GMT

CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-4773: OTP Bypass in Magarsus' IDM-MFA

Wed, 22 Jul 2026 12:08:20 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability

Mon, 20 Jul 2026 22:47:26 GMT

Microsoft.NetCore.App.Runtime.linux-arm >=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10, fixed in 8.0.29, 9.0.18, 10.0.10. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-55124: Microsoft Word Information Disclosure Vulnerability

Tue, 14 Jul 2026 17:08:47 GMT

CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read

Thu, 09 Jul 2026 20:54:46 GMT

yeswiki/yeswiki <4.6.6, fixed in 4.6.6. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Thu, 02 Jul 2026 20:42:23 GMT

org.keycloak:keycloak-services <=26.2.5 || >=26.3.0, <=26.4.7 || >=26.5.0, <26.5.5, fixed in 26.5.5. CVSS 7.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in Helm Deployer

Wed, 01 Jul 2026 20:45:39 GMT

github.com/rancher/fleet >=0.12.0, <0.12.15 || >=0.13.0, <0.13.11 || >=0.14.0, <0.14.6 || >=0.15.0, <0.15.2, fixed in 0.12.15, 0.13.11, 0.14.6, 0.15.2. CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

Wed, 17 Jun 2026 14:02:22 GMT

vllm >=0.8.5, <0.24.0, fixed in 0.24.0. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-10825: Improper JSON Input Validation in WebSocket API Leads to Denial of Service

Tue, 16 Jun 2026 08:51:57 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-9753: Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.

Tue, 09 Jun 2026 22:30:57 GMT

CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-9742: Authenticate command with specific mechanism parameter can trigger server crash

Tue, 09 Jun 2026 21:57:46 GMT

CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

Mon, 08 Jun 2026 19:00:33 GMT

io.netty:netty-handler >=4.2.0.Final, <4.2.15.Final || <4.1.135.Final, fixed in 4.2.15.Final, 4.1.135.Final. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-11460: Boost Serialization improper validation of specified type of input

Sun, 07 Jun 2026 19:30:10 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-6858: In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.

Thu, 04 Jun 2026 21:51:08 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection

Thu, 04 Jun 2026 17:59:25 GMT

hono <4.12.21, fixed in 4.12.21. CVSS 4.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-49941: Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses

Thu, 04 Jun 2026 16:07:20 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

Wed, 27 May 2026 21:03:36 GMT

symfony/security-http >=6.3.0, <6.4.40 || >=7.4.0, <7.4.12 || >=8.0.0, <8.0.12, fixed in 6.4.40, 7.4.12, 8.0.12. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-40851: Command injection via USB

Wed, 27 May 2026 08:06:21 GMT

CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

Mattermost doesn't validate user-supplied input in API request handlers

Tue, 26 May 2026 13:30:15 GMT

github.com/mattermost/mattermost-plugin-github <1.0.1-0.20260330164815-c2840e980b3c, fixed in 1.0.1-0.20260330164815-c2840e980b3c. CVSS 4.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-9521: fraillt bitsery std_smart_ptr.h loadFromSharedState improper validation of specified type of input

Tue, 26 May 2026 02:00:15 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Concrete CMS: OAuth 2.0 Authorization-Code Handler Bypasses Account Status

Fri, 22 May 2026 00:31:16 GMT

concrete5/concrete5 <9.5.1, fixed in 9.5.1. CVSS 2.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-5946: Invalid handling of CLASS != IN

Wed, 20 May 2026 13:10:03 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-0802: An ACAP configuration file lacked sufficient input validation, which could allow command injection and potentially lead to privilege escalation.

Tue, 12 May 2026 05:44:59 GMT

CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-29645: NEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV) decoder.

Mon, 20 Apr 2026 00:00:00 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header

Wed, 15 Apr 2026 19:24:41 GMT

fastify >=5.3.2, <5.8.5, fixed in 5.8.5. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

TSPortal: Any user can forge self-deletion requests for any account

Fri, 27 Mar 2026 15:37:10 GMT

miraheze/ts-portal <30, fixed in 30. CVSS 8.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs

Mon, 23 Mar 2026 06:30:29 GMT

jsrsasign <11.1.1, fixed in 11.1.1. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.