agentprime: CWE-1289

CVE-2026-116870: In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently.

Tue, 27 Oct 2026 10:28:11 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-116197: Contrast 1.21.0 before 1.25.0 Credential Leak via imagepuller Wildcard Registry Selection

Sun, 25 Oct 2026 13:20:30 GMT

CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-114348: webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint

Thu, 22 Oct 2026 09:38:37 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Handlebars: JavaScript Injection via Own Property Check Bypass

Thu, 08 Oct 2026 17:52:26 GMT

handlebars >=3.0.0, <4.7.10, fixed in 4.7.10. CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv6 zone identifiers

Thu, 08 Oct 2026 16:48:06 GMT

pydantic-ai >=1.56.0, <1.107.6 || >=2.0.0b1, <2.44.0, fixed in 1.107.6, 2.44.0. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-107288: Pydantic AI: web_fetch_tool blocked_domains bypass via a hostname the resolver normalizes differently

Thu, 08 Oct 2026 15:18:40 GMT

CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-102478: Octopus Deploy Octopus Server: In affected versions of Octopus Server…

Wed, 07 Oct 2026 01:17:54 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-105048: Zilliz Attu: The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to…

Fri, 02 Oct 2026 22:08:31 GMT

CVSS 4.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-100255: JetBrains TeamCity: In JetBrains TeamCity before 2026.2, 2026.1.4…

Wed, 30 Sep 2026 15:17:46 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-97196: WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability

Wed, 30 Sep 2026 06:55:06 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-101015: Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input

Mon, 28 Sep 2026 08:30:08 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-86831: Improper validation of pod identifier uniqueness in aws-network-policy-agent in Amazon EKS

Wed, 16 Sep 2026 19:49:49 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot

Wed, 16 Sep 2026 08:24:40 GMT

mpp >=0.2.0, <0.16.2, fixed in 0.16.2. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-89049: Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent

Thu, 10 Sep 2026 18:34:48 GMT

CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-76977: Clickjacking vulnerability in SAPUI5(Frame Options Allowlist)

Tue, 08 Sep 2026 00:13:17 GMT

CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-74994: inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

Tue, 01 Sep 2026 14:45:57 GMT

CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-19953: URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep

Mon, 31 Aug 2026 17:29:42 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-60074: Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check

Thu, 30 Jul 2026 13:42:03 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-47729: Squid: Memory disclosure in FTP gateway

Thu, 16 Jul 2026 16:13:19 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Contrast's Imagepuller registryFor uses unanchored suffix matching, leaking auth credentials and trusted CA configuration to sibling-domain registries

Wed, 01 Jul 2026 18:43:55 GMT

github.com/edgelesssys/contrast <1.21.0, fixed in 1.21.0. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-50090: Aqara OAuth redirect_uri validation bypass

Fri, 12 Jun 2026 15:02:13 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Hono: IP Restriction bypasses static deny rules for non-canonical IPv6

Thu, 04 Jun 2026 18:00:22 GMT

hono <4.12.21, fixed in 4.12.21. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-49942: Net::CIDR::Set versions through 0.20 for Perl did not validate network masks

Thu, 04 Jun 2026 16:07:42 GMT

CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-49940: Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks

Thu, 04 Jun 2026 16:07:01 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Thu, 04 Jun 2026 13:15:17 GMT

starlette <1.0.1, fixed in 1.0.1. CVSS 6.5 (Medium). Critical: In CISA’s KEV catalogue since 2 Sept 2026: it is known to be exploited. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form

Thu, 28 May 2026 19:52:36 GMT

symfony/polyfill >=1.17.1, <1.38.1, fixed in 1.38.1. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

Tue, 26 May 2026 23:38:37 GMT

@fedify/fedify <1.9.11 || >=1.10.0, <1.10.10 || >=2.0.0, <2.0.18 || >=2.1.0, <2.1.14 || >=2.2.0, <2.2.3, fixed in 1.9.11, 1.10.10, 2.0.18, 2.1.14, 2.2.3. CVSS 7.0 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Fri, 22 May 2026 02:46:43 GMT

golang.org/x/net <0.55.0, fixed in 0.55.0. CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by OSV. Not analysed by agentprime yet.

CVE-2026-45191: Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP ACL bypass

Sun, 10 May 2026 20:15:53 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-45190: Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass

Sun, 10 May 2026 20:15:24 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

webauthn-rs-core/webauthn-authenticator-rs: Origin validation mismatch possible when subdomains are allowed

Wed, 06 May 2026 23:31:27 GMT

webauthn-authenticator-rs <0.5.5 || >=0.6.0-dev, <0.6.1-dev, fixed in 0.5.5, 0.6.1-dev. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode

Wed, 22 Apr 2026 17:32:54 GMT

dompurify >=1.0.10, <3.4.0, fixed in 3.4.0. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

@node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes

Thu, 16 Apr 2026 21:09:50 GMT

@node-oauth/oauth2-server <5.3.0, fixed in 5.3.0. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type Header

Wed, 15 Apr 2026 19:24:41 GMT

fastify >=5.3.2, <5.8.5, fixed in 5.8.5. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

Thu, 09 Apr 2026 17:32:19 GMT

axios <0.31.0 || >=1.0.0, <1.15.0, fixed in 0.31.0, 1.15.0. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

mercure has Topic Selector Cache Key Collision

Wed, 08 Apr 2026 19:53:20 GMT

github.com/dunglas/mercure <0.22.0, fixed in 0.22.0. CVSS 7.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

Tue, 07 Apr 2026 22:53:49 GMT

stdlib >=1.26.0-0, <1.26.2, fixed in 1.26.2. CVSS 7.5 (High). Published by OSV. Not analysed by agentprime yet.

CVE-2026-34080: xdg-dbus-proxy has an eavesdrop filter bypass allowing message interception

Tue, 07 Apr 2026 20:57:57 GMT

CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)

Fri, 03 Apr 2026 04:07:09 GMT

fast-jwt >=0.0.1, <6.2.0, fixed in 6.2.0. CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-22569: Incorrect startup configuration in ZCC

Tue, 31 Mar 2026 14:54:57 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

OpenFGA has an Authorization Bypass through cached keys

Thu, 26 Mar 2026 17:21:50 GMT

github.com/openfga/openfga <1.13.1, fixed in 1.13.1. CVSS 5.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-33515: Squid has issues in ICP message handling

Thu, 26 Mar 2026 00:13:51 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Ory Oathkeeper has an authentication bypass by cache key confusion

Fri, 20 Mar 2026 20:51:07 GMT

github.com/ory/oathkeeper <0.40.10-0.20260320084801-198a2bc82a99, fixed in 0.40.10-0.20260320084801-198a2bc82a99. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-3563: Devolutions PowerShell Universal: Improper input validation in the apps and endpoints configuration in PowerShell Universal…

Tue, 17 Mar 2026 19:15:37 GMT

CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Parse Dashboard Has a Cache Key Collision that Leaks Master Key to Read-Only Sessions

Wed, 25 Feb 2026 19:00:07 GMT

parse-dashboard >=7.3.0-alpha.42, <9.0.0-alpha.8, fixed in 9.0.0-alpha.8. CVSS 7.0 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-1094: Improper Validation of Unsafe Equivalence in Input in GitLab

Wed, 11 Feb 2026 11:04:35 GMT

CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

`idna` accepts Punycode labels that do not produce any non-ASCII when decoded

Mon, 09 Dec 2024 20:41:10 GMT

idna <1.0.0, fixed in 1.0.0. CVSS 5.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2024-45179: An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01.

Wed, 09 Oct 2024 00:00:00 GMT

CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

AngularJS allows attackers to bypass common image source restrictions

Mon, 09 Sep 2024 15:30:41 GMT

angular >=1.3.0-rc.4, <=1.8.3, no fixed version yet. CVSS 4.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2024-45308: MySQL & free URL mode allows to hide existing notes in hedgedoc

Mon, 02 Sep 2024 16:40:31 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.