# CWE-180.

Every Advisory and CVE whose sources give the weakness CWE-180, newest first.

## Records, newest first

- [CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect](https://agentprime.io/advisories/CVE-2026-120638.md)
  `CVE-2026-120638` · CVE record · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Open redirect, CWE-180
- [Vite: \`server.fs.deny\` bypassed with queries](https://agentprime.io/advisories/GHSA-8g5g-mxqh-grgj.md)
  `GHSA-8g5g-mxqh-grgj`, `CVE-2026-118662` · npm `vite`: affected `>=6.4.4, <6.4.5`, fixed in `6.4.5` · CVSS 6.9 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control, CWE-180
- [fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding](https://agentprime.io/advisories/GHSA-w74x-v6f9-j3xg.md)
  `GHSA-w74x-v6f9-j3xg`, `CVE-2026-110306` · npm `fast-uri`: affected `<2.4.8 || >=3.0.0, <3.1.9 || >=4.0.0, <4.2.3`, fixed in `2.4.8`, `3.1.9`, `4.2.3` · CVSS 6.1 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-172, CWE-180
- [baserCMS: Encoded path traversal bypass in the theme file API](https://agentprime.io/advisories/CVE-2026-114622.md)
  `CVE-2026-114622` · CVE record: baserproject basercms · CVSS 7.2 High · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal, CWE-180
- [Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization](https://agentprime.io/advisories/CVE-2026-93630.md)
  `CVE-2026-93630` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 4.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-180
- [ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete](https://agentprime.io/advisories/CVE-2026-112003.md)
  `CVE-2026-112003` · CVE record: ProjectSend ProjectSend · CVSS 6.0 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: CWE-180
- [OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths](https://agentprime.io/advisories/GHSA-2vc4-c4r6-p6v6.md)
  `GHSA-2vc4-c4r6-p6v6`, `CVE-2026-100409` · npm `@opennextjs/cloudflare`: affected `>=0.3.0, <1.20.2`, fixed in `1.20.2` · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-177, CWE-180
- [n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook](https://agentprime.io/advisories/CVE-2026-110846.md)
  `CVE-2026-110846` · CVE record: n8n-io n8n · CVSS 7.0 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-180
- [Crafted Git build source can bypass certain policy validation](https://agentprime.io/advisories/CVE-2026-93326.md)
  `CVE-2026-93326` · CVE record: moby BuildKit · CVSS 6.0 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-180
- [PeaZip: PeaZip before 11.3.0, in a non-default configuration…](https://agentprime.io/advisories/CVE-2026-105050.md)
  `CVE-2026-105050` · CVE record: PeaZip PeaZip · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-180
- [PyJWT: Non-canonical signature segments enable raw-token revocation bypass](https://agentprime.io/advisories/GHSA-hxm8-2xgr-2p9m.md)
  `GHSA-hxm8-2xgr-2p9m`, `CVE-2026-102269`, `PYSEC-2026-4147` · PyPI `pyjwt`: affected `<2.14.0`, fixed in `2.14.0` · CVSS 4.8 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-180
- [stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization](https://agentprime.io/advisories/CVE-2026-100674.md)
  `CVE-2026-100674` · CVE record: stoatchat stoatchat · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: CWE-180
- [OpenClaw before 2026.8.1 Authentication Bypass via File URL](https://agentprime.io/advisories/CVE-2026-100547.md)
  `CVE-2026-100547` · CVE record: OpenClaw OpenClaw · CVSS 6.8 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: CWE-180
- [input-leap Input Leap: Input Leap (aka input-leap) through 3.0.3…](https://agentprime.io/advisories/CVE-2026-100230.md)
  `CVE-2026-100230` · CVE record: input-leap Input Leap · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-180
- [django-allauth: django-allauth before 65.19.4 does not have the expected limits on failed login attempts…](https://agentprime.io/advisories/CVE-2026-97764.md)
  `CVE-2026-97764` · CVE record: allauth django-allauth · CVSS 3.7 Low · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-180
- [Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restri…](https://agentprime.io/advisories/CVE-2026-95811.md)
  `CVE-2026-95811` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control, CWE-180
- [cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalize](https://agentprime.io/advisories/CVE-2026-90813.md)
  `CVE-2026-90813` · CVE record: cosmicstack-labs mercury-agent · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-179, CWE-180
- [SEP sesam before 5.2.0.24 mishandles User Authorization with MFA.](https://agentprime.io/advisories/CVE-2026-79300.md)
  `CVE-2026-79300` · CVE record: SEP sesam · CVSS 3.5 Low · Not analysed yet · Published 12 Sept 2026 · Tags: CWE-180
- [Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass](https://agentprime.io/advisories/GHSA-gg9w-7593-hxg9.md)
  `GHSA-gg9w-7593-hxg9`, `CVE-2026-82736`, `EEF-CVE-2026-82736` · Hex `ash`: affected `>=1.29.0-rc0, <3.32.2`, fixed in `3.32.2` · CVSS 2.1 Low · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-180
- [The cohttp package before 6.3.0 for OCaml allows directory traversal.](https://agentprime.io/advisories/CVE-2026-82481.md)
  `CVE-2026-82481` · CVE record: mirage cohttp · CVSS 8.7 High · Not analysed yet · Published 29 Aug 2026 · Tags: CWE-180
- [CSS sanitizer bypass in Pentestify report themes allows forced outbound requests](https://agentprime.io/advisories/CVE-2026-76203.md)
  `CVE-2026-76203` · CVE record: maalfer Pentestify · CVSS 5.1 Medium · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-180
- [AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization](https://agentprime.io/advisories/CVE-2026-72917.md)
  `CVE-2026-72917` · CVE record: Mintplex-Labs anything-llm · CVSS 5.9 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: Authentication bypass, CWE-180
- [Guzzle: Noncanonical host can bypass host-based checks](https://agentprime.io/advisories/GHSA-v5mv-p594-2x33.md)
  `GHSA-v5mv-p594-2x33`, `CVE-2026-69246`, `PKSA-gcrk-3vtt-1r14` · Packagist `guzzlehttp/guzzle`: affected `<7.15.2 || >=8.0.0, <8.0.1`, fixed in `7.15.2`, `8.0.1` · CVSS 7.2 High · Not analysed yet · Published 3 Aug 2026 · Tags: Server-side request forgery (SSRF), CWE-180, CWE-436, CWE-941
- [Guzzle: Noncanonical cookie domain keeps subdomain scope](https://agentprime.io/advisories/GHSA-f7vp-7xgx-4w4r.md)
  `GHSA-f7vp-7xgx-4w4r`, `CVE-2026-69245`, `PKSA-cnw1-2ytm-cgr8` · Packagist `guzzlehttp/guzzle`: affected `<7.15.2 || >=8.0.0, <8.0.1`, fixed in `7.15.2`, `8.0.1` · CVSS 6.5 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: Authentication bypass, CWE-180, CWE-346
- [Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)](https://agentprime.io/advisories/CVE-2026-62999.md)
  `CVE-2026-62999` · CVE record: copier-org copier · CVSS 7.5 High · Not analysed yet · Published 31 Jul 2026 · Tags: Path traversal, CWE-180
- [@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths](https://agentprime.io/advisories/GHSA-8pvw-jcv7-9cmj.md)
  `GHSA-8pvw-jcv7-9cmj`, `CVE-2026-7120` · npm `@fastify/static`: affected `<10.1.2`, fixed in `10.1.2` · CVSS 5.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: CWE-180
- [CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components](https://agentprime.io/advisories/CVE-2026-15704.md)
  `CVE-2026-15704` · CVE record: Eclipse Foundation Eclipse BaSyx Go Components · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: Broken access control, CWE-180
- [Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass](https://agentprime.io/advisories/GHSA-7rqj-j65f-68wh.md)
  `GHSA-7rqj-j65f-68wh`, `CVE-2026-73420` · npm `@auth/core` and 1 more: affected `>=0.1.0, <0.41.3`, fixed in `0.41.3` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: CWE-180
- [JupyterLab: PyPI extension blocklist package-name canonicalization bypass](https://agentprime.io/advisories/GHSA-89vp-jrxv-24w8.md)
  `GHSA-89vp-jrxv-24w8`, `BIT-jupyterlab-2026-73416`, `CVE-2026-73416`, `PYSEC-2026-3670` · PyPI `jupyterlab`: affected `>=4.5.0, <4.5.10 || >=4.6.0, <4.6.2`, fixed in `4.5.10`, `4.6.2` · CVSS 6.1 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-178, CWE-180
- [ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass](https://agentprime.io/advisories/CVE-2026-52747.md)
  `CVE-2026-52747` · CVE record: owasp-modsecurity ModSecurity · CVSS 8.6 High · Not analysed yet · Published 10 Jul 2026 · Tags: CWE-180
- [Kestra: Path traversal in \`LocalStorage\` allows any authenticated user to read arbitrary server files via the execution file-download API (\`\\..\\\` bypasses the \`..\` guard)](https://agentprime.io/advisories/CVE-2026-49984.md)
  `CVE-2026-49984` · CVE record: kestra-io kestra · CVSS 7.7 High · Not analysed yet · Published 26 Jun 2026 · Tags: Path traversal, Information disclosure, CWE-180
- [Warp: Env-var prefixes can lead to denylisted command autoexecution](https://agentprime.io/advisories/CVE-2026-48721.md)
  `CVE-2026-48721` · CVE record: warpdotdev warp · CVSS 8.6 High · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-180, CWE-693
- [Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring](https://agentprime.io/advisories/GHSA-9rfg-v8g9-9367.md)
  `GHSA-9rfg-v8g9-9367`, `CVE-2026-42462` · npm `@fedify/fedify`: affected `<1.9.11 || >=1.10.0, <1.10.10 || >=2.0.0, <2.0.18 || >=2.1.0, <2.1.14 || >=2.2.0, <2.2.3`, fixed in `1.9.11`, `1.10.10`, `2.0.18`, `2.1.14`, `2.2.3` · CVSS 7.0 High · Not analysed yet · Published 26 May 2026 · Tags: Weak cryptography or TLS, CWE-180, CWE-436, CWE-1289
- [go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git](https://agentprime.io/advisories/GHSA-389r-gv7p-r3rp.md)
  `GHSA-389r-gv7p-r3rp`, `CVE-2026-45022`, `GO-2026-5074` · Go `github.com/go-git/go-git/v5` and 1 more: affected `<5.19.0`, fixed in `5.19.0` · CVSS 7.0 High · Not analysed yet · Published 11 May 2026 · Tags: CWE-180, CWE-345
- [Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses](https://agentprime.io/advisories/GHSA-xpcf-pg52-r92g.md)
  `GHSA-xpcf-pg52-r92g`, `CVE-2026-39409` · npm `hono`: affected `<4.12.12`, fixed in `4.12.12` · CVSS 6.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-180
- [Vite: \`server.fs.deny\` bypassed with queries](https://agentprime.io/advisories/GHSA-v2wj-q39q-566r.md)
  `GHSA-v2wj-q39q-566r`, `CVE-2026-39364` · npm `vite`: affected `>=7.1.0, <7.3.2 || >=8.0.0, <8.0.5`, fixed in `7.3.2`, `8.0.5` · CVSS 8.2 High · Not analysed yet · Published 6 Apr 2026 · Tags: Broken access control, CWE-180, CWE-472
- [Rack:: Static header_rules bypass via URL-encoded paths](https://agentprime.io/advisories/GHSA-q4qf-9j86-f5mh.md)
  `GHSA-q4qf-9j86-f5mh`, `CVE-2026-34786` · RubyGems `rack`: affected `<2.2.23 || >=3.0.0.beta1, <3.1.21 || >=3.2.0, <3.2.6`, fixed in `2.2.23`, `3.1.21`, `3.2.6` · CVSS 5.3 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-180
- [varnish-software Varnish Cache: Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12…](https://agentprime.io/advisories/CVE-2026-34475.md)
  `CVE-2026-34475` · CVE record: varnish-software Varnish Cache · CVSS 5.4 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: CWE-180
- [OpenClaw has a workspace-only sandbox guard mismatch for @-prefixed absolute paths](https://agentprime.io/advisories/GHSA-27cr-4p5m-74rj.md)
  `GHSA-27cr-4p5m-74rj`, `CVE-2026-32033` · npm `openclaw`: affected `<2026.2.24`, fixed in `2026.2.24` · CVSS 6.0 Medium · Not analysed yet · Published 3 Mar 2026 · Tags: Path traversal, CWE-180
- [Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport](https://agentprime.io/advisories/GHSA-5r3v-vc8m-m96g.md)
  `GHSA-5r3v-vc8m-m96g`, `CVE-2026-27590`, `GO-2026-4536` · Go `github.com/caddyserver/caddy/v2`: affected `<2.11.1`, fixed in `2.11.1` · CVSS 8.9 High · Not analysed yet · Published 24 Feb 2026 · Tags: CWE-20, CWE-180
- [FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP](https://agentprime.io/advisories/GHSA-g966-83w7-6w38.md)
  `GHSA-g966-83w7-6w38`, `CVE-2026-24895`, `GO-2026-4486` · Go `github.com/dunglas/frankenphp`: affected `<1.11.2`, fixed in `1.11.2` · CVSS 8.9 High · Not analysed yet · Published 12 Feb 2026 · Tags: CWE-20, CWE-180
- [NVIDIA DGX Spark: NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware…](https://agentprime.io/advisories/CVE-2025-33194.md)
  `CVE-2025-33194` · CVE record: NVIDIA DGX Spark · CVSS 5.7 Medium · Not analysed yet · Published 25 Nov 2025 · Tags: CWE-180
- [A directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9.](https://agentprime.io/advisories/CVE-2025-43716.md)
  `CVE-2025-43716` · CVE record: Ivanti LANDesk Management Suite · CVSS 5.8 Medium · Not analysed yet · Published 23 Apr 2025 · Tags: CWE-180
- [Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write](https://agentprime.io/advisories/GHSA-94vh-gphv-8pm8.md)
  `GHSA-94vh-gphv-8pm8`, `CVE-2025-29787`, `RUSTSEC-2025-0168` · crates.io `zip`: affected `>=1.3.0, <2.3.0`, fixed in `2.3.0` · CVSS 7.3 High · Not analysed yet · Published 16 Mar 2025 · Tags: Path traversal, CWE-61, CWE-180
- [librasean IP-Utils: The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses…](https://agentprime.io/advisories/CVE-2024-28607.md)
  `CVE-2024-28607` · CVE record: librasean IP-Utils · CVSS 2.9 Low · Not analysed yet · Published 11 Mar 2025 · Tags: CWE-180
- [A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses.](https://agentprime.io/advisories/CVE-2022-26137.md)
  `CVE-2022-26137` · CVE record: Atlassian Bamboo Server and 4 more · CVSS 8.8 High · Not analysed yet · Published 20 Jul 2022 · Tags: CWE-180
- [A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps.](https://agentprime.io/advisories/CVE-2022-26136.md)
  `CVE-2022-26136` · CVE record: Atlassian Bamboo Server and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jul 2022 · Tags: CWE-180

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-180>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-180/>. Everything for agents: <https://agentprime.io/llms.txt>.