agentprime: CWE-212

CVE-2026-118996: CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig

Fri, 30 Oct 2026 13:10:21 GMT

Published by the CVE Program. Not analysed by agentprime yet.

Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs

Tue, 27 Oct 2026 16:08:47 GMT

rustls <0.23.46 || >=0.24.0-dev.1, <0.24.0-dev.2, fixed in 0.23.46, 0.24.0-dev.2. CVSS 4.0 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-115363: OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration

Thu, 22 Oct 2026 19:13:37 GMT

CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.

follow-redirects array-form headers bypass cross-origin credential stripping

Tue, 20 Oct 2026 17:58:04 GMT

follow-redirects >=1.16.0, <1.16.1, fixed in 1.16.1. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-111387: Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint

Fri, 16 Oct 2026 01:17:55 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`

Thu, 08 Oct 2026 17:16:32 GMT

pydantic-ai >=0.3.4, <1.107.4 || >=2.0.0b1, <2.27.1, fixed in 1.107.4, 2.27.1. CVSS 2.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`

Thu, 08 Oct 2026 16:48:16 GMT

pydantic-ai >=0.3.4, <1.107.6 || >=2.0.0b1, <2.44.0, fixed in 1.107.6, 2.44.0. CVSS 2.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-96879: "Checked by" label in page history should not be shown if the underlying review log entry is suppressed"

Fri, 25 Sep 2026 20:10:22 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-17511: This Power System update is being released to address

Thu, 24 Sep 2026 14:09:29 GMT

CVSS 3.4 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-90860: Canva: The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned…

Mon, 21 Sep 2026 06:43:02 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-67071: HCL DevOps Deploy / HCL Launch is susceptible to an Improper Removal of Sensitive Information Before Storage or Transfer

Thu, 17 Sep 2026 20:21:26 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-73440: Security Advisory 0178

Wed, 16 Sep 2026 09:55:14 GMT

CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-86740: Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains

Wed, 09 Sep 2026 13:32:06 GMT

CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Microsoft Security Advisory CVE-2026-62900 – .NET Information Disclosure Vulnerability

Tue, 08 Sep 2026 20:25:10 GMT

Microsoft.Build.Tasks.Git >=10.0.102, <10.0.111 || >=10.0.200, <=10.0.204 || >=10.0.300, <10.0.303, fixed in 10.0.111, 10.0.303. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-82069: Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router

Tue, 08 Sep 2026 16:12:28 GMT

CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-78658: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an information disclosure vulnerability

Fri, 04 Sep 2026 15:10:10 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-85094: Canva: The Canva Android App before 2.376.0 did not restrict the headers returned to an external…

Fri, 04 Sep 2026 06:02:47 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-5300: AppArmor Base Profile Misconfiguration in snapd Permits Confined Snaps Unauthorized Access to Hashed Passwords via systemd-userdbd

Tue, 21 Jul 2026 14:00:51 GMT

CVSS 5.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-15811: Kronosnet: kronosnet: encryption key exposure in memory after cryptographic configuration changes

Tue, 21 Jul 2026 05:09:48 GMT

CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Guzzle: URI fragments disclosed in redirect Referer headers

Mon, 20 Jul 2026 23:28:36 GMT

guzzlehttp/guzzle <7.15.1, fixed in 7.15.1. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-16104: Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins

Fri, 17 Jul 2026 16:43:54 GMT

CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

nebula-mesh: CA private key not zeroized on web mobile-bundle error paths

Tue, 14 Jul 2026 20:05:38 GMT

github.com/forgekeep/nebula-mesh <0.3.8, fixed in 0.3.8. CVSS 7.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties

Sun, 14 Jun 2026 06:30:24 GMT

ironic >=17.0.0, <29.0.6 || >=30.0.0, <32.0.2 || >=33.0.0, <35.0.2 || >=36.0.0, <37.0.1, fixed in 29.0.6, 32.0.2, 35.0.2, 37.0.1. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-46657: Bludit's persistent authentication tokens not revoked upon account disablement

Mon, 08 Jun 2026 15:05:45 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-36178: The factory reset functionality in GNCC GP5 v7.1.76 fails to clear sensitive cryptographic material in the JFFS2 configuration partition, possibly allowing attackers to recover and obtain sensitive u…

Thu, 04 Jun 2026 00:00:00 GMT

CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations

Tue, 19 May 2026 15:54:21 GMT

github.com/argoproj/argo-cd/v3 >=3.2.0, <3.2.12 || >=3.3.0-rc1, <3.3.10 || >=3.4.0-rc1, <3.4.2, fixed in 3.2.12, 3.3.10, 3.4.2. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive Content

Mon, 11 May 2026 21:20:04 GMT

github.com/safedep/gryph <0.7.0, fixed in 0.7.0. CVSS 5.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download

Thu, 07 May 2026 19:33:48 GMT

facturascripts/facturascripts <2026, fixed in 2026. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2024-43384: Phoenix Contact: Improper removal of sensitive information in MGUARD products

Thu, 07 May 2026 08:37:04 GMT

CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Thu, 07 May 2026 01:56:53 GMT

github.com/argoproj/argo-cd/v3 >=3.2.0, <3.2.11 || >=3.3.0, <3.3.9, fixed in 3.2.11, 3.3.9. CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OpenBao's Namespace Deletion May Not Delete Data Properly

Tue, 05 May 2026 20:02:52 GMT

github.com/openbao/openbao <0.0.0-20260420173541-6d2e0506e2b4, fixed in 0.0.0-20260420173541-6d2e0506e2b4. CVSS 2.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases

Fri, 17 Apr 2026 21:47:15 GMT

openclaw <2026.4.14, fixed in 2026.4.14. CVSS 7.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-20928: Windows Recovery Environment Security Feature Bypass Vulnerability

Tue, 14 Apr 2026 16:57:51 GMT

CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets

Tue, 14 Apr 2026 01:11:11 GMT

follow-redirects <1.16.0, fixed in 1.16.0. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-39937: Global vanishing does not completely remove user email

Tue, 07 Apr 2026 21:44:46 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

OpenClaw: SSH-based sandbox backends pass unsanitized process.env to child processes

Thu, 02 Apr 2026 21:01:57 GMT

openclaw <2026.3.31, fixed in 2026.3.31. CVSS 2.0 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON

Sun, 29 Mar 2026 15:13:30 GMT

io.trino:trino-iceberg >=439, <480, fixed in 480. CVSS 7.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OpenClaw Exposes Credentials Embedded in baseUrl Fields via config.get and channels.status

Thu, 26 Mar 2026 21:15:59 GMT

openclaw <2026.3.22, fixed in 2026.3.22. CVSS 7.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-32891: Anchorr Privilege Escalation: Jellyseerr User → Anchorr Admin via Stored XSS

Fri, 20 Mar 2026 02:38:43 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-1182: Improper Removal of Sensitive Information Before Storage or Transfer in GitLab

Thu, 12 Mar 2026 01:33:23 GMT

CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-1732: Improper Removal of Sensitive Information Before Storage or Transfer in GitLab

Wed, 11 Mar 2026 15:37:26 GMT

CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-27640: tfplan2md has Sensitive Value Exposure in Generated Reports

Wed, 25 Feb 2026 03:52:26 GMT

CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-8860: Qemu-kvm: uefi-vars: information disclosure vulnerability in uefi_vars_write callback

Wed, 18 Feb 2026 20:49:06 GMT

CVSS 3.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-59955: Coolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpoint

Mon, 05 Jan 2026 17:46:56 GMT

CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CBORDecoder reuse can leak shareable values across decode calls

Wed, 31 Dec 2025 22:01:38 GMT

cbor2 >=3.0.0, <5.8.0, fixed in 5.8.0. CVSS 5.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

URI Credential Leakage Bypass over CVE-2025-27221

Tue, 30 Dec 2025 21:07:14 GMT

uri <0.12.5 || >=0.13.0, <0.13.3 || >=1.0.0, <1.0.4, fixed in 0.12.5, 0.13.3, 1.0.4. CVSS 2.1 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-14267: Unintended temporary cached data included in a structure only copy intended to be empty of data

Fri, 19 Dec 2025 06:15:09 GMT

CVSS 5.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-65000: Exposure of SSH Private Keys in Remote Alert Handlers (Linux) Rule

Thu, 18 Dec 2025 14:04:12 GMT

CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.

Grype has a credential disclosure vulnerability in its JSON output

Tue, 25 Nov 2025 14:18:46 GMT

github.com/anchore/grype >=0.68.0, <0.104.1, fixed in 0.104.1. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-62483: Zoom Clients - Improper Removal of Sensitive Information

Thu, 13 Nov 2025 15:03:07 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.