agentprime: CWE-1395

CVE-2026-115946: XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder

Sat, 31 Oct 2026 23:49:36 GMT

Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-117611: Trust of compromised eMudhra root CA in bundled CA stores

Thu, 29 Oct 2026 09:32:57 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()

Thu, 22 Oct 2026 17:01:08 GMT

pillow >=11.1.0, <13.0.0, fixed in 13.0.0. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

Thu, 22 Oct 2026 15:52:53 GMT

next >=10.0.0, <15.5.28 || >=16.0.0, <16.4.1, fixed in 15.5.28, 16.4.1. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Ghost: Remote Code Execution via Bookmark Card Images

Wed, 07 Oct 2026 20:43:08 GMT

ghost >=6.56.0, <6.67.0, fixed in 6.67.0. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

sharp : Vulnerability in librsvg dependency CVE-2026-96889

Tue, 06 Oct 2026 13:43:57 GMT

sharp <0.35.5, fixed in 0.35.5. CVSS 8.9 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Next.js: Remote Code Execution in next/og ImageResponse

Wed, 30 Sep 2026 14:48:30 GMT

next >=16.2.0, <16.3.6, fixed in 16.3.6. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-100242: DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)

Tue, 29 Sep 2026 16:40:18 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-90455: Dependency on vulnerable third-party component in Malcolm

Fri, 11 Sep 2026 21:51:59 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

Tue, 08 Sep 2026 21:21:12 GMT

next >=10.0.0, <15.5.24 || >=16.0.0, <16.3.3, fixed in 15.5.24, 16.3.3. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-69713: Windows Secure Boot Security Feature Bypass Vulnerability

Tue, 08 Sep 2026 17:16:30 GMT

CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-58235: Use of Vulnerable Third-Party Component in SAP NetWeaver AS Java (Adobe Document Services)

Tue, 11 Aug 2026 00:12:27 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193

Wed, 29 Jul 2026 16:11:45 GMT

matrix-commander <=8.0.6, no fixed version yet. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-58586: Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp

Fri, 24 Jul 2026 15:02:22 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-16634: TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99

Fri, 24 Jul 2026 09:14:58 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-60455: Oracle Corporation Oracle Platform Security for Java: Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion…

Wed, 22 Jul 2026 22:24:27 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

Tue, 21 Jul 2026 22:07:17 GMT

sharp <0.35.0, fixed in 0.35.0. CVSS 8.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-55789: Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providers

Fri, 10 Jul 2026 19:55:37 GMT

CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

Gogs: XSS in .ipynb files renderer due to outdated notebookjs

Fri, 19 Jun 2026 21:42:52 GMT

gogs.io/gogs <0.14.3, fixed in 0.14.3. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL

Fri, 19 Jun 2026 16:35:09 GMT

github.com/opentofu/opentofu <1.11.10 || >=1.12.0-beta1, <1.12.3, fixed in 1.11.10, 1.12.3. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Vulnerable OpenSSL included in cryptography wheels

Mon, 15 Jun 2026 20:12:27 GMT

cryptography >=0.5.0, <48.0.1, fixed in 48.0.1. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-47906: Dreamweaver Desktop | Dependency on Vulnerable Third-Party Component (CWE-1395)

Tue, 09 Jun 2026 19:24:06 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-42206: HCL iReflection Use of Third party vulnerable and outdated components issue was detected in the web application.

Tue, 02 Jun 2026 15:57:18 GMT

CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-8993: Improper URL Handler Processing in D.Launcher 2 enables NTLM Credential Disclosure and SSRF attacks

Tue, 02 Jun 2026 11:13:40 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-31973: HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'

Wed, 20 May 2026 11:25:44 GMT

CVSS 4.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-11159: Hitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party Component

Wed, 13 May 2026 05:36:43 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-34652: Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)

Tue, 12 May 2026 19:50:29 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-34654: Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)

Tue, 12 May 2026 19:50:24 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2022-4988: Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries

Mon, 11 May 2026 19:04:40 GMT

CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-59851: HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability

Wed, 06 May 2026 10:24:54 GMT

CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)

Fri, 24 Apr 2026 20:41:51 GMT

@excalidraw/excalidraw >=0.18.0, <0.18.1, fixed in 0.18.1. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-15638: Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt

Tue, 21 Apr 2026 15:34:18 GMT

CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses

Tue, 14 Apr 2026 23:34:08 GMT

github.com/opentofu/opentofu <1.11.6, fixed in 1.11.6. CVSS 3.1 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions

Thu, 02 Apr 2026 18:36:10 GMT

@lightdash/cli >=0.1800.0, <0.2695.1, fixed in 0.2695.1. CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Axios npm Supply Chain Incident Impacting @usebruno/cli

Thu, 02 Apr 2026 18:34:04 GMT

@usebruno/cli <3.2.1, fixed in 3.2.1. CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')

Wed, 01 Apr 2026 23:58:50 GMT

mcp-handler <1.1.0, fixed in 1.1.0. CVSS 7.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

EnhancedLinq.Async is Vulnerable to Denial of Service via Transitive Dependency Microsoft.Bcl.Memory

Wed, 01 Apr 2026 23:57:06 GMT

EnhancedLinq.Async >=1.0.0-beta.1, <1.0.0-beta.3, fixed in 1.0.0-beta.3. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2024-14031: Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library

Tue, 31 Mar 2026 11:31:28 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-14030: Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library

Tue, 31 Mar 2026 11:31:08 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-4176: Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib

Sun, 29 Mar 2026 20:50:51 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186)

Sun, 29 Mar 2026 15:37:28 GMT

github.com/traefik/traefik/v2 <2.11.42, fixed in 2.11.42. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Postiz App has a High-Severity SSRF Vulnerability via Next.js

Fri, 27 Mar 2026 15:46:53 GMT

postiz <=2.0.12, no fixed version yet. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

C2C CI utils is vulnerable to DoS via pyasn dependency (CVE-2026-30922)

Thu, 26 Mar 2026 22:27:12 GMT

c2cciutils <1.1.66, fixed in 1.1.66. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution

Thu, 26 Mar 2026 17:22:53 GMT

com.splunk:splunk-otel-javaagent <2.26.1, fixed in 2.26.1. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing

Tue, 24 Mar 2026 19:10:38 GMT

fido2-lib <3.5.8, fixed in 3.5.8. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

skia-python vendors vulnerable libfreetype because of pinned cibuildwheel version

Thu, 19 Mar 2026 18:10:25 GMT

skia-python <144.0.post1, fixed in 144.0.post1. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

Thu, 19 Mar 2026 12:44:07 GMT

github.com/modelcontextprotocol/go-sdk <1.4.1, fixed in 1.4.1. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121

Wed, 18 Mar 2026 12:59:01 GMT

github.com/argoproj-labs/terraform-provider-argocd <1.2.3-0.20260316182343-b3364f3f32e7, fixed in 1.2.3-0.20260316182343-b3364f3f32e7. CVSS 4.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-23654: GitHub: Zero Shot SCFoundation Remote Code Execution Vulnerability

Tue, 10 Mar 2026 17:05:15 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-3257: UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library

Thu, 05 Mar 2026 01:35:12 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.