agentprime: CWE-183

vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

Wed, 28 Oct 2026 21:15:29 GMT

vllm <0.32.0, fixed in 0.32.0. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-117570: nmap-mcp through commit 3636afa Permissive NSE Script Allowlist in scan_vulnerabilities

Tue, 27 Oct 2026 13:08:02 GMT

CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-116339: iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist

Mon, 26 Oct 2026 14:30:18 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

pypdf: Unvalidated JPEG image data loading

Wed, 21 Oct 2026 19:58:10 GMT

pypdf <6.21.1, fixed in 6.21.1. CVSS 2.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Microsoft Security Advisory CVE-2026-96229 - .NET and Visual Studio Information Disclosure Vulnerability

Tue, 13 Oct 2026 20:46:25 GMT

Microsoft.WindowsDesktop.App.Runtime.win-arm64 >=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2, fixed in 8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-89106: Cross Site Scripting (XSS) vulnerability in SAPUI5

Tue, 13 Oct 2026 00:23:40 GMT

CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml

Wed, 07 Oct 2026 18:03:22 GMT

@backstage/plugin-techdocs-node <1.15.4, fixed in 1.15.4. CVSS 7.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-103687: rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklist

Thu, 01 Oct 2026 14:30:12 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-12974: Security Policy Bypass in Forcepoint Security Engine (NGFW)

Wed, 23 Sep 2026 13:27:22 GMT

CVSS 7.9 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-90808: HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist

Mon, 14 Sep 2026 18:00:10 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-54694: NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover

Wed, 09 Sep 2026 18:44:15 GMT

CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

mcp-shell has a Secure Mode Allowlist Bypass via Default `/bin/bash` Executable

Tue, 25 Aug 2026 15:41:30 GMT

github.com/sonirico/mcp-shell <0.6.0, fixed in 0.6.0. CVSS 8.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-63649: OpenVPN: The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through…

Fri, 14 Aug 2026 22:13:21 GMT

CVSS 4.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Duplicate Advisory: Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

Sat, 01 Aug 2026 15:30:27 GMT

axios >=1.0.0, no fixed version yet. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-67345: MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theft

Thu, 30 Jul 2026 14:39:13 GMT

CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-66005: Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding

Fri, 24 Jul 2026 14:57:33 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

Mon, 20 Jul 2026 22:20:18 GMT

axios >=0.31.0, <0.33.0 || >=1.15.0, <1.18.0, fixed in 0.33.0, 1.18.0. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-16129: princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist

Sat, 18 Jul 2026 17:00:09 GMT

CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-15625: nextlevelbuilder GoClaw exec_approval.go ExecApprovalManager.CheckCommand incomplete blacklist

Tue, 14 Jul 2026 02:00:09 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-59802: PasswordPusher < 2.8.1 - Redirect-Based XSS via data URI in URL Push Payload

Wed, 08 Jul 2026 19:42:07 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

PickleScan's pkgutil.resolve_name has a universal blocklist bypass

Mon, 29 Jun 2026 11:50:44 GMT

picklescan <1.0.4, fixed in 1.0.4. CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-50189: Appsmith: RCE via Supervisord XML-RPC Admin Interface Exposed via /supervisor Caddy Route

Wed, 24 Jun 2026 21:35:00 GMT

CVSS 8.9 (High). Published by the CVE Program. Not analysed by agentprime yet.

Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)

Mon, 22 Jun 2026 21:27:24 GMT

glances <4.5.5, fixed in 4.5.5. CVSS 7.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-8918: ASUS Armoury Crate: A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to…

Mon, 22 Jun 2026 02:00:12 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

Fri, 19 Jun 2026 14:34:46 GMT

undici <6.27.0 || >=7.0.0, <7.28.0 || >=8.0.0, <8.5.0, fixed in 6.27.0, 7.28.0, 8.5.0. CVSS 3.7 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Duplicate Advisory: PickleScan's pkgutil.resolve_name has a universal blocklist bypass

Wed, 17 Jun 2026 18:35:57 GMT

picklescan <1.0.4, fixed in 1.0.4. CVSS 10.0 (Critical). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

Wed, 17 Jun 2026 18:06:06 GMT

@anthropic-ai/claude-code >=0.2.54, <2.1.163, fixed in 2.1.163. CVSS 6.0 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching

Tue, 19 May 2026 16:34:34 GMT

@apify/actors-mcp-server <0.9.21, fixed in 0.9.21. CVSS 6.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

HAX open-apis: Credential Theft via Server-Side Request Forgery (SSRF) in open-apis

Tue, 19 May 2026 14:44:46 GMT

@haxtheweb/open-apis <26.0.0, fixed in 26.0.0. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules

Tue, 05 May 2026 19:23:45 GMT

gix >=0.31.0, <0.83.0, fixed in 0.83.0. CVSS 7.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

Tue, 05 May 2026 00:25:22 GMT

axios <0.31.1 || >=1.0.0, <1.15.1, fixed in 0.31.1, 1.15.1. CVSS 5.4 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

Tue, 05 May 2026 00:20:58 GMT

axios <0.31.1 || >=1.0.0, <1.15.1, fixed in 0.31.1, 1.15.1. CVSS 7.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-29514: NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin

Mon, 04 May 2026 16:05:33 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

Netfoil has incorrect allowlist enforcement

Wed, 29 Apr 2026 22:22:16 GMT

github.com/tinfoil-factory/netfoil <0.2.1, fixed in 0.2.1. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)

Wed, 22 Apr 2026 17:34:17 GMT

dompurify <3.4.0, fixed in 3.4.0. CVSS 6.0 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OpenClaw: QMD memory_get restricts reads to canonical or indexed memory paths

Fri, 17 Apr 2026 22:33:33 GMT

openclaw <2026.4.15, fixed in 2026.4.15. CVSS 2.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OpenClaw: Empty approver lists could grant explicit approval authorization

Fri, 17 Apr 2026 21:55:54 GMT

openclaw <2026.4.12, fixed in 2026.4.12. CVSS 6.0 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-40899: DataEase has an Arbitrary File Read Vulnerability

Thu, 16 Apr 2026 19:48:44 GMT

CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-21915: JSI Virtual Lightweight Collector: Shell escape allows privilege escalation to root

Thu, 09 Apr 2026 21:26:28 GMT

CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

DOMPurify ADD_ATTR predicate skips URI validation

Fri, 03 Apr 2026 03:46:07 GMT

dompurify <3.3.2, fixed in 3.3.2. CVSS 5.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides

Tue, 31 Mar 2026 23:59:36 GMT

openclaw <2026.3.22, fixed in 2026.3.22. CVSS 8.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)

Fri, 27 Mar 2026 17:56:45 GMT

express-xss-sanitizer <2.0.2, fixed in 2.0.2. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OpenClaw: Tlon settings empty-allowlist reconciliation bypassed intended revocation

Thu, 26 Mar 2026 21:30:54 GMT

openclaw <2026.3.22, fixed in 2026.3.22. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Astro: Remote allowlist bypass via unanchored matchPathname wildcard

Thu, 26 Mar 2026 18:45:17 GMT

astro >=2.10.10, <5.18.1, fixed in 5.18.1. CVSS 2.9 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-4509: PbootCMS File Upload file.php incomplete blacklist

Sat, 21 Mar 2026 06:02:10 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Permissive List of Allowed Inputs in ewe

Mon, 16 Mar 2026 20:49:36 GMT

ewe >=0.6.0, <3.0.5, fixed in 3.0.5. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling

Tue, 10 Feb 2026 21:31:31 GMT

go.mongodb.org/mongo-driver <1.17.7, fixed in 1.17.7. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-2302: Unsafe Reflection in Mongoid::Criteria.from_hash

Tue, 10 Feb 2026 18:59:23 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

n8n: Webhook Node IP Whitelist Bypass via Partial String Matching

Tue, 13 Jan 2026 14:57:12 GMT

n8n >=1.36.0, <2.2.0, fixed in 2.2.0. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-59457: JetBrains TeamCity: In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential…

Wed, 17 Sep 2025 09:04:02 GMT

CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.