agentprime: CWE-180

CVE-2026-120638: CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect

Tue, 03 Nov 2026 23:40:27 GMT

Published by the CVE Program. Not analysed by agentprime yet.

Vite: `server.fs.deny` bypassed with queries

Thu, 29 Oct 2026 16:39:56 GMT

vite >=6.4.4, <6.4.5, fixed in 6.4.5. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

Fri, 23 Oct 2026 21:41:36 GMT

fast-uri <2.4.8 || >=3.0.0, <3.1.9 || >=4.0.0, <4.2.3, fixed in 2.4.8, 3.1.9, 4.2.3. CVSS 6.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-114622: baserCMS: Encoded path traversal bypass in the theme file API

Fri, 23 Oct 2026 13:41:33 GMT

CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-93630: Zimbra Collaboration Suite Email HTML Sanitizer Bypass via Hostname Canonicalization

Fri, 23 Oct 2026 13:21:39 GMT

CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-112003: ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete

Sun, 18 Oct 2026 11:38:27 GMT

CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded paths

Thu, 15 Oct 2026 20:15:17 GMT

@opennextjs/cloudflare >=0.3.0, <1.20.2, fixed in 1.20.2. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-110846: n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook

Wed, 14 Oct 2026 22:52:21 GMT

CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-93326: Crafted Git build source can bypass certain policy validation

Mon, 05 Oct 2026 20:13:27 GMT

CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-105050: PeaZip: PeaZip before 11.3.0, in a non-default configuration…

Fri, 02 Oct 2026 22:37:54 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

PyJWT: Non-canonical signature segments enable raw-token revocation bypass

Tue, 29 Sep 2026 23:17:55 GMT

pyjwt <2.14.0, fixed in 2.14.0. CVSS 4.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-100674: stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization

Sat, 26 Sep 2026 13:23:37 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-100547: OpenClaw before 2026.8.1 Authentication Bypass via File URL

Sat, 26 Sep 2026 02:18:43 GMT

CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-100230: input-leap Input Leap: Input Leap (aka input-leap) through 3.0.3…

Fri, 25 Sep 2026 15:31:52 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-97764: django-allauth: django-allauth before 65.19.4 does not have the expected limits on failed login attempts…

Fri, 25 Sep 2026 04:25:57 GMT

CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-95811: Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restri…

Fri, 25 Sep 2026 01:31:22 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-90813: cosmicstack-labs mercury-agent Shell Command Execution permissions.ts checkShellCommand validate before canonicalize

Mon, 14 Sep 2026 19:15:08 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-79300: SEP sesam before 5.2.0.24 mishandles User Authorization with MFA.

Sat, 12 Sep 2026 22:20:40 GMT

CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.

Ash.Type.CiString validates length and match constraints before case folding, allowing constraint bypass

Tue, 01 Sep 2026 03:21:47 GMT

ash >=1.29.0-rc0, <3.32.2, fixed in 3.32.2. CVSS 2.1 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-82481: The cohttp package before 6.3.0 for OCaml allows directory traversal.

Sat, 29 Aug 2026 14:43:52 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-76203: CSS sanitizer bypass in Pentestify report themes allows forced outbound requests

Wed, 19 Aug 2026 14:23:17 GMT

CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-72917: AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization

Mon, 10 Aug 2026 21:35:33 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Guzzle: Noncanonical host can bypass host-based checks

Mon, 03 Aug 2026 21:07:26 GMT

guzzlehttp/guzzle <7.15.2 || >=8.0.0, <8.0.1, fixed in 7.15.2, 8.0.1. CVSS 7.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Guzzle: Noncanonical cookie domain keeps subdomain scope

Mon, 03 Aug 2026 21:05:26 GMT

guzzlehttp/guzzle <7.15.2 || >=8.0.0, <8.0.1, fixed in 7.15.2, 8.0.1. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-62999: Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)

Fri, 31 Jul 2026 19:41:55 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths

Fri, 24 Jul 2026 16:43:44 GMT

@fastify/static <10.1.2, fixed in 10.1.2. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-15704: CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components

Fri, 24 Jul 2026 07:41:42 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

Thu, 23 Jul 2026 14:40:15 GMT

@auth/core >=0.1.0, <0.41.3, fixed in 0.41.3. CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

JupyterLab: PyPI extension blocklist package-name canonicalization bypass

Wed, 22 Jul 2026 23:14:27 GMT

jupyterlab >=4.5.0, <4.5.10 || >=4.6.0, <4.6.2, fixed in 4.5.10, 4.6.2. CVSS 6.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-52747: ModSecurity: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass

Fri, 10 Jul 2026 21:42:11 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-49984: Kestra: Path traversal in `LocalStorage` allows any authenticated user to read arbitrary server files via the execution file-download API (`\..\` bypasses the `..` guard)

Fri, 26 Jun 2026 20:55:44 GMT

CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-48721: Warp: Env-var prefixes can lead to denylisted command autoexecution

Wed, 24 Jun 2026 17:31:15 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring

Tue, 26 May 2026 23:38:37 GMT

@fedify/fedify <1.9.11 || >=1.10.0, <1.10.10 || >=2.0.0, <2.0.18 || >=2.1.0, <2.1.14 || >=2.2.0, <2.2.3, fixed in 1.9.11, 1.10.10, 2.0.18, 2.1.14, 2.2.3. CVSS 7.0 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git

Mon, 11 May 2026 14:48:12 GMT

github.com/go-git/go-git/v5 <5.19.0, fixed in 5.19.0. CVSS 7.0 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Wed, 08 Apr 2026 00:17:14 GMT

hono <4.12.12, fixed in 4.12.12. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Vite: `server.fs.deny` bypassed with queries

Mon, 06 Apr 2026 18:03:32 GMT

vite >=7.1.0, <7.3.2 || >=8.0.0, <8.0.5, fixed in 7.3.2, 8.0.5. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Rack:: Static header_rules bypass via URL-encoded paths

Thu, 02 Apr 2026 18:44:49 GMT

rack <2.2.23 || >=3.0.0.beta1, <3.1.21 || >=3.2.0, <3.2.6, fixed in 2.2.23, 3.1.21, 3.2.6. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-34475: varnish-software Varnish Cache: Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12…

Fri, 27 Mar 2026 19:40:28 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

OpenClaw has a workspace-only sandbox guard mismatch for @-prefixed absolute paths

Tue, 03 Mar 2026 22:11:54 GMT

openclaw <2026.2.24, fixed in 2026.2.24. CVSS 6.0 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport

Tue, 24 Feb 2026 20:39:08 GMT

github.com/caddyserver/caddy/v2 <2.11.1, fixed in 2.11.1. CVSS 8.9 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

FrankenPHP's unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FrankenPHP

Thu, 12 Feb 2026 15:29:36 GMT

github.com/dunglas/frankenphp <1.11.2, fixed in 1.11.2. CVSS 8.9 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-33194: NVIDIA DGX Spark: NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware…

Tue, 25 Nov 2025 17:59:27 GMT

CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-43716: A directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9.

Wed, 23 Apr 2025 00:00:00 GMT

CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Incorrect path canonicalization during Archive Extraction Leading to Arbitrary File Write

Sun, 16 Mar 2025 12:00:00 GMT

zip >=1.3.0, <2.3.0, fixed in 2.3.0. CVSS 7.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2024-28607: librasean IP-Utils: The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses…

Tue, 11 Mar 2025 00:00:00 GMT

CVSS 2.9 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2022-26137: A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked when the application processes requests or responses.

Wed, 20 Jul 2022 17:25:23 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2022-26136: A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps.

Wed, 20 Jul 2022 17:25:18 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.