# CWE-1395.

Every Advisory and CVE whose sources give the weakness CWE-1395, newest first.

## Records, newest first

- [XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder](https://agentprime.io/advisories/CVE-2026-115946.md)
  `CVE-2026-115946` · CVE record · No CVSS score · Not analysed yet · Published 31 Oct 2026 · Tags: CWE-1395
- [Trust of compromised eMudhra root CA in bundled CA stores](https://agentprime.io/advisories/CVE-2026-117611.md)
  `CVE-2026-117611` · CVE record: Checkmk GmbH Checkmk · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Weak cryptography or TLS, CWE-1395
- [Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()](https://agentprime.io/advisories/GHSA-78g4-xqwv-q3g8.md)
  `GHSA-78g4-xqwv-q3g8` · PyPI `pillow`: affected `>=11.1.0, <13.0.0`, fixed in `13.0.0` · CVSS 8.1 High · Not analysed yet · Published 22 Oct 2026 · Tags: Memory corruption, CWE-1395
- [Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used](https://agentprime.io/advisories/GHSA-2464-fhr4-w9xw.md)
  `GHSA-2464-fhr4-w9xw` · npm `next`: affected `>=10.0.0, <15.5.28 || >=16.0.0, <16.4.1`, fixed in `15.5.28`, `16.4.1` · CVSS 4.0, no score published · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-1395
- [Ghost: Remote Code Execution via Bookmark Card Images](https://agentprime.io/advisories/GHSA-788w-68h3-cvxp.md)
  `GHSA-788w-68h3-cvxp`, `BIT-ghost-2026-105642`, `CVE-2026-105642` · npm `ghost`: affected `>=6.56.0, <6.67.0`, fixed in `6.67.0` · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection, CWE-1395
- [sharp : Vulnerability in librsvg dependency CVE-2026-96889](https://agentprime.io/advisories/GHSA-wq5f-xc86-pv6w.md)
  `GHSA-wq5f-xc86-pv6w`, `CVE-2026-114111` · npm `sharp`: affected `<0.35.5`, fixed in `0.35.5` · CVSS 8.9 High · Not analysed yet · Published 6 Oct 2026 · Tags: Memory corruption, CWE-1395
- [Next.js: Remote Code Execution in next/og ImageResponse](https://agentprime.io/advisories/GHSA-vcvr-r3jv-pc5j.md)
  `GHSA-vcvr-r3jv-pc5j` · npm `next`: affected `>=16.2.0, <16.3.6`, fixed in `16.3.6` · CVSS 4.0, no score published · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-1395
- [DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)](https://agentprime.io/advisories/CVE-2026-100242.md)
  `CVE-2026-100242` · CVE record: Wikimedia Foundation Mediawiki - DataTransfer Extension · CVSS 7.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: Denial of service, CWE-1395
- [Dependency on vulnerable third-party component in Malcolm](https://agentprime.io/advisories/CVE-2026-90455.md)
  `CVE-2026-90455` · CVE record: CISA Malcolm · CVSS 6.3 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-1395
- [Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used](https://agentprime.io/advisories/GHSA-2xp9-vwfh-vxw4.md)
  `GHSA-2xp9-vwfh-vxw4` · npm `next`: affected `>=10.0.0, <15.5.24 || >=16.0.0, <16.3.3`, fixed in `15.5.24`, `16.3.3` · CVSS 4.0, no score published · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-1395
- [Windows Secure Boot Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-69713.md)
  `CVE-2026-69713` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 4.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-1395
- [Use of Vulnerable Third-Party Component in SAP NetWeaver AS Java (Adobe Document Services)](https://agentprime.io/advisories/CVE-2026-58235.md)
  `CVE-2026-58235` · CVE record: SAP_SE SAP NetWeaver AS Java (Adobe Document Services) · CVSS 6.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-1395
- [olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193](https://agentprime.io/advisories/GHSA-wchh-9x6h-7f6p.md)
  `GHSA-wchh-9x6h-7f6p` · PyPI `matrix-commander`: affected `<=8.0.6`, no fixed version yet · No CVSS score · Not analysed yet · Published 29 Jul 2026 · Tags: CWE-1395
- [Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp](https://agentprime.io/advisories/CVE-2026-58586.md)
  `CVE-2026-58586` · CVE record: ZAPAD Image::WebP · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: CWE-1395
- [TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99](https://agentprime.io/advisories/CVE-2026-16634.md)
  `CVE-2026-16634` · CVE record: FELIPE TOML::XS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: CWE-1104, CWE-1395
- [Oracle Corporation Oracle Platform Security for Java: Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion…](https://agentprime.io/advisories/CVE-2026-60455.md)
  `CVE-2026-60455` · CVE record: Oracle Corporation Oracle Platform Security for Java · CVSS 8.8 High · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-1395
- [sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591](https://agentprime.io/advisories/GHSA-f88m-g3jw-g9cj.md)
  `GHSA-f88m-g3jw-g9cj`, `CVE-2026-114113` · npm `sharp`: affected `<0.35.0`, fixed in `0.35.0` · CVSS 8.4 High · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-1395
- [Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providers](https://agentprime.io/advisories/CVE-2026-55789.md)
  `CVE-2026-55789` · CVE record: logto-io logto · CVSS 8.5 High · Not analysed yet · Published 10 Jul 2026 · Tags: Other injection, CWE-1395
- [Gogs: XSS in .ipynb files renderer due to outdated notebookjs](https://agentprime.io/advisories/GHSA-6vxv-wg6j-5qwp.md)
  `GHSA-6vxv-wg6j-5qwp`, `GO-2026-5193` · Go `gogs.io/gogs`: affected `<0.14.3`, fixed in `0.14.3` · CVSS 4.0, no score published · Not analysed yet · Published 19 Jun 2026 · Tags: Cross-site scripting (XSS), CWE-1395
- [OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL](https://agentprime.io/advisories/GHSA-q7j3-v8qv-22vq.md)
  `GHSA-q7j3-v8qv-22vq`, `GO-2026-5571` · Go `github.com/opentofu/opentofu`: affected `<1.11.10 || >=1.12.0-beta1, <1.12.3`, fixed in `1.11.10`, `1.12.3` · CVSS 7.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-1395
- [Vulnerable OpenSSL included in cryptography wheels](https://agentprime.io/advisories/GHSA-537c-gmf6-5ccf.md)
  `GHSA-537c-gmf6-5ccf` · PyPI `cryptography`: affected `>=0.5.0, <48.0.1`, fixed in `48.0.1` · CVSS 7.5 High · Not analysed yet · Published 15 Jun 2026 · Tags: Memory corruption, CWE-1395
- [Dreamweaver Desktop | Dependency on Vulnerable Third-Party Component (CWE-1395)](https://agentprime.io/advisories/CVE-2026-47906.md)
  `CVE-2026-47906` · CVE record: Adobe Dreamweaver Desktop · CVSS 8.6 High · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-1395
- [HCL iReflection Use of Third party vulnerable and outdated components issue was detected in the web application.](https://agentprime.io/advisories/CVE-2024-42206.md)
  `CVE-2024-42206` · CVE record: HCL iReflection · CVSS 3.1 Low · Not analysed yet · Published 2 Jun 2026 · Tags: CWE-1395
- [Improper URL Handler Processing in D.Launcher 2 enables NTLM Credential Disclosure and SSRF attacks](https://agentprime.io/advisories/CVE-2026-8993.md)
  `CVE-2026-8993` · CVE record: Ditec a.s. D.Launcher 2 · CVSS 6.5 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Other injection, Information disclosure, CWE-1395
- [HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'](https://agentprime.io/advisories/CVE-2025-31973.md)
  `CVE-2025-31973` · CVE record: HCL BigFix Service Management (SM) · CVSS 4.0 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-1395
- [Hitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party Component](https://agentprime.io/advisories/CVE-2025-11159.md)
  `CVE-2025-11159` · CVE record: Hitachi Vantara Pentaho Data Integration and Analytics · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2026 · Tags: CWE-1395
- [Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)](https://agentprime.io/advisories/CVE-2026-34652.md)
  `CVE-2026-34652` · CVE record: Adobe Adobe Commerce and 2 more · CVSS 7.5 High · Not analysed yet · Published 12 May 2026 · Tags: CWE-1395
- [Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)](https://agentprime.io/advisories/CVE-2026-34654.md)
  `CVE-2026-34654` · CVE record: Adobe Adobe Commerce and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 12 May 2026 · Tags: CWE-1395
- [Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries](https://agentprime.io/advisories/CVE-2022-4988.md)
  `CVE-2022-4988` · CVE record: KMX Alien::FreeImage · CVSS 7.3 High · Not analysed yet · Published 11 May 2026 · Tags: CWE-1395
- [HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability](https://agentprime.io/advisories/CVE-2025-59851.md)
  `CVE-2025-59851` · CVE record: HCL DFXAnalytics · CVSS 3.7 Low · Not analysed yet · Published 6 May 2026 · Tags: CWE-1395
- [Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)](https://agentprime.io/advisories/GHSA-39h7-pwv7-rc3x.md)
  `GHSA-39h7-pwv7-rc3x` · npm `@excalidraw/excalidraw` and 1 more: affected `>=0.18.0, <0.18.1`, fixed in `0.18.1` · No CVSS score · Not analysed yet · Published 24 Apr 2026 · Tags: Cross-site scripting (XSS), CWE-1395
- [Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt](https://agentprime.io/advisories/CVE-2025-15638.md)
  `CVE-2025-15638` · CVE record: ATRODO Net::Dropbear · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-1395
- [OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses](https://agentprime.io/advisories/GHSA-hw5x-4r37-72w7.md)
  `GHSA-hw5x-4r37-72w7`, `GO-2026-5441` · Go `github.com/opentofu/opentofu`: affected `<1.11.6`, fixed in `1.11.6` · CVSS 3.1 Low · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-1395
- [Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions](https://agentprime.io/advisories/GHSA-3hfp-gqgh-xc5g.md)
  `GHSA-3hfp-gqgh-xc5g` · npm `@lightdash/cli`: affected `>=0.1800.0, <0.2695.1`, fixed in `0.2695.1` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-508, CWE-1395
- [Axios npm Supply Chain Incident Impacting @usebruno/cli](https://agentprime.io/advisories/GHSA-658g-p7jg-wx5g.md)
  `GHSA-658g-p7jg-wx5g`, `CVE-2026-34841` · npm `@usebruno/cli`: affected `<3.2.1`, fixed in `3.2.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-494, CWE-506, CWE-1395
- [mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')](https://agentprime.io/advisories/GHSA-w2fm-25vw-vh7f.md)
  `GHSA-w2fm-25vw-vh7f` · npm `mcp-handler`: affected `<1.1.0`, fixed in `1.1.0` · CVSS 7.1 High · Not analysed yet · Published 1 Apr 2026 · Tags: Race condition, CWE-1395
- [EnhancedLinq.Async is Vulnerable to Denial of Service via Transitive Dependency Microsoft.Bcl.Memory](https://agentprime.io/advisories/GHSA-32wq-ppwg-3w4m.md)
  `GHSA-32wq-ppwg-3w4m` · NuGet `EnhancedLinq.Async`: affected `>=1.0.0-beta.1, <1.0.0-beta.3`, fixed in `1.0.0-beta.3` · CVSS 7.5 High · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-129, CWE-1395
- [Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library](https://agentprime.io/advisories/CVE-2024-14031.md)
  `CVE-2024-14031` · CVE record: YVES Sereal::Encoder · CVSS 8.1 High · Not analysed yet · Published 31 Mar 2026 · Tags: CWE-1395
- [Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library](https://agentprime.io/advisories/CVE-2024-14030.md)
  `CVE-2024-14030` · CVE record: YVES Sereal::Decoder · CVSS 8.1 High · Not analysed yet · Published 31 Mar 2026 · Tags: CWE-1395
- [Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib](https://agentprime.io/advisories/CVE-2026-4176.md)
  `CVE-2026-4176` · CVE record: SHAY perl · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Mar 2026 · Tags: CWE-1395
- [Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)](https://agentprime.io/advisories/GHSA-46wh-3698-f2cx.md)
  `GHSA-46wh-3698-f2cx`, `GO-2026-4897` · Go `github.com/traefik/traefik/v2` and 1 more: affected `<2.11.42`, fixed in `2.11.42` · CVSS 4.0, no score published · Not analysed yet · Published 29 Mar 2026 · Tags: Broken access control, CWE-1395
- [Postiz App has a High-Severity SSRF Vulnerability via Next.js](https://agentprime.io/advisories/GHSA-vj2p-7pgw-g2wf.md)
  `GHSA-vj2p-7pgw-g2wf` · npm `postiz`: affected `<=2.0.12`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 27 Mar 2026 · Tags: Server-side request forgery (SSRF), CWE-1395
- [C2C CI utils is vulnerable to DoS via pyasn dependency (CVE-2026-30922)](https://agentprime.io/advisories/GHSA-wcjx-v2wj-xg87.md)
  `GHSA-wcjx-v2wj-xg87` · PyPI `c2cciutils`: affected `<1.1.66`, fixed in `1.1.66` · CVSS 7.5 High · Not analysed yet · Published 26 Mar 2026 · Tags: Denial of service, CWE-1395
- [splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution](https://agentprime.io/advisories/GHSA-h8w2-rv57-vc6f.md)
  `GHSA-h8w2-rv57-vc6f` · Maven `com.splunk:splunk-otel-javaagent`: affected `<2.26.1`, fixed in `2.26.1` · CVSS 4.0, no score published · Not analysed yet · Published 26 Mar 2026 · Tags: Insecure deserialization, CWE-1395
- [fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing](https://agentprime.io/advisories/GHSA-g3qj-j598-cxmq.md)
  `GHSA-g3qj-j598-cxmq` · npm `fido2-lib`: affected `<3.5.8`, fixed in `3.5.8` · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption, CWE-126, CWE-1395
- [skia-python vendors vulnerable libfreetype because of pinned cibuildwheel version](https://agentprime.io/advisories/GHSA-2mhw-8qcg-gr96.md)
  `GHSA-2mhw-8qcg-gr96` · PyPI `skia-python`: affected `<144.0.post1`, fixed in `144.0.post1` · CVSS 8.1 High · Not analysed yet · Published 19 Mar 2026 · Tags: Memory corruption, CWE-1395
- [Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk](https://agentprime.io/advisories/GHSA-q382-vc8q-7jhj.md)
  `GHSA-q382-vc8q-7jhj`, `GO-2026-4770` · Go `github.com/modelcontextprotocol/go-sdk`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 4.0, no score published · Not analysed yet · Published 19 Mar 2026 · Tags: CWE-436, CWE-1395
- [Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121](https://agentprime.io/advisories/GHSA-594f-3595-c47v.md)
  `GHSA-594f-3595-c47v`, `GO-2026-4737` · Go `github.com/argoproj-labs/terraform-provider-argocd`: affected `<1.2.3-0.20260316182343-b3364f3f32e7`, fixed in `1.2.3-0.20260316182343-b3364f3f32e7` · CVSS 4.8 Medium · Not analysed yet · Published 18 Mar 2026 · Tags: Weak cryptography or TLS, CWE-1395
- [GitHub: Zero Shot SCFoundation Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-23654.md)
  `CVE-2026-23654` · CVE record: Microsoft GitHub Repo: Zero Shot scFoundation · CVSS 8.8 High · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-1395
- [UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library](https://agentprime.io/advisories/CVE-2026-3257.md)
  `CVE-2026-3257` · CVE record: TOKUHIROM UnQLite · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-1395
- [Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib](https://agentprime.io/advisories/CVE-2026-3381.md)
  `CVE-2026-3381` · CVE record: PMQS Compress::Raw::Zlib · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-1395
- [Traefik affected by TLS ClientAuth Bypass on HTTP/3](https://agentprime.io/advisories/GHSA-gv8r-9rw9-9697.md)
  `GHSA-gv8r-9rw9-9697`, `GO-2026-4530` · Go `github.com/traefik/traefik` and 2 more: affected `<=1.7.34`, no fixed version yet · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2026 · Tags: CWE-1395
- [Centrifugo v6.6.0 dependency vulnerabilities](https://agentprime.io/advisories/GHSA-j9wf-6r2x-hqmx.md)
  `GHSA-j9wf-6r2x-hqmx`, `GO-2026-4528` · Go `github.com/centrifugal/centrifugo/v6`: affected `<6.6.1`, fixed in `6.6.1` · No CVSS score · Not analysed yet · Published 19 Feb 2026 · Tags: CWE-1395
- [Gogs vulnerable to Stored XSS via Mermaid diagrams](https://agentprime.io/advisories/GHSA-26gq-grmh-6xm6.md)
  `GHSA-26gq-grmh-6xm6`, `GO-2026-4454` · Go `gogs.io/gogs`: affected `<0.13.4`, fixed in `0.13.4` · CVSS 7.3 High · Not analysed yet · Published 6 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-1395
- [FrankenPHP has delayed propagation of security fixes in upstream base images](https://agentprime.io/advisories/GHSA-x9p2-77v6-6vhf.md)
  `GHSA-x9p2-77v6-6vhf`, `GO-2026-4442` · Go `github.com/dunglas/frankenphp`: affected `<1.1.11`, fixed in `1.1.11` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Feb 2026 · Tags: CWE-1395
- [OpenTofu has High CPU usage in "tofu init" with maliciously-crafted module packages in .zip format](https://agentprime.io/advisories/GHSA-r92c-9c7f-3pj8.md)
  `GHSA-r92c-9c7f-3pj8`, `CVE-2026-74797`, `GO-2026-4352` · Go `github.com/opentofu/opentofu`: affected `<1.11.4`, fixed in `1.11.4` · CVSS 2.3 Low · Not analysed yet · Published 21 Jan 2026 · Tags: Denial of service, CWE-1395
- [HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability](https://agentprime.io/advisories/CVE-2026-0943.md)
  `CVE-2026-0943` · CVE record: JV HarfBuzz::Shaper · CVSS 7.5 High · Not analysed yet · Published 19 Jan 2026 · Tags: CWE-1395
- [Spectrum outdated java library in class-path](https://agentprime.io/advisories/CVE-2025-69275.md)
  `CVE-2025-69275` · CVE record: Broadcom DX NetOps Spectrum · CVSS 7.1 High · Not analysed yet · Published 12 Jan 2026 · Tags: CWE-1395
- [Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium](https://agentprime.io/advisories/CVE-2025-15444.md)
  `CVE-2025-15444` · CVE record: IAMB Crypt::Sodium::XS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jan 2026 · Tags: CWE-1395
- [Auth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency](https://agentprime.io/advisories/GHSA-vvg7-8rmq-92g7.md)
  `GHSA-vvg7-8rmq-92g7`, `PKSA-q26s-yhsm-92t7` · Packagist `auth0/wordpress`: affected `>=5.0.0-BETA0, <5.5.0`, fixed in `5.5.0` · CVSS 6.8 Medium · Not analysed yet · Published 17 Dec 2025 · Tags: Broken access control, CWE-1395

Older: <https://agentprime.io/advisories/tag/cwe-1395.md?cursor=WyIyMDI1LTEyLTE3VDIwOjU3OjA5LjAwMDAwMFoiLCJHSFNBLXZ2ZzctOHJtcS05Mmc3Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1395>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1395/>. Everything for agents: <https://agentprime.io/llms.txt>.