# CWE-248.

Every Advisory and CVE whose sources give the weakness CWE-248, newest first.

## Records, newest first

- [Kyverno before 1.19.2 Image Verification Bypass via Attestation Type Panic](https://agentprime.io/advisories/CVE-2026-122315.md)
  `CVE-2026-122315` · CVE record: kyverno kyverno · CVSS 8.7 High · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-248
- [Kyverno before 1.19.2 Denial of Service via Shallow Variable Substitution Panic](https://agentprime.io/advisories/CVE-2026-122314.md)
  `CVE-2026-122314` · CVE record: kyverno kyverno · CVSS 8.7 High · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-248
- [tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process](https://agentprime.io/advisories/CVE-2026-76892.md)
  `CVE-2026-76892` · CVE record: tsparticles tsparticles and 1 more · CVSS 8.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-248
- [svg-sanitizer from 1.1.0 before 1.1.1 Denial of Service via Unclosed Tag](https://agentprime.io/advisories/CVE-2026-121443.md)
  `CVE-2026-121443` · CVE record: darylldoyle svg-sanitizer · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-248
- [Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update](https://agentprime.io/advisories/CVE-2026-121414.md)
  `CVE-2026-121414` · CVE record: parse-community parse-server · CVSS 8.2 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-248
- [FreeRDP before 3.32.2 Denial of Service via WinPR PNG/JPEG Image Readers](https://agentprime.io/advisories/CVE-2026-121386.md)
  `CVE-2026-121386` · CVE record: FreeRDP FreeRDP · CVSS 8.7 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-248
- [In multiple locations, there is a possible permission bypass due to an uncaught exception.](https://agentprime.io/advisories/CVE-2026-59004.md)
  `CVE-2026-59004` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-248
- [In validEfCfis of SIMRecords.java, there is a possible way to cause a denial of service due to an uncaught exception.](https://agentprime.io/advisories/CVE-2026-55288.md)
  `CVE-2026-55288` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-248
- [fastify vulnerable to Denial of Service via uncaught exception on handlerTimeout with streaming responses](https://agentprime.io/advisories/CVE-2026-120216.md)
  `CVE-2026-120216` · CVE record: fastify fastify · CVSS 5.9 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-248
- [@fastify/cors vulnerable to Denial of Service on a CORS preflight with the onSend hook](https://agentprime.io/advisories/CVE-2026-120215.md)
  `CVE-2026-120215` · CVE record: @fastify/cors @fastify/cors · CVSS 3.7 Low · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-248
- [Null pointer dereference vulnerability in the ArkWeb module.](https://agentprime.io/advisories/CVE-2026-101175.md)
  `CVE-2026-101175` · CVE record: Huawei HarmonyOS · CVSS 4.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-248
- [Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message](https://agentprime.io/advisories/GHSA-8hrf-8g6f-7xwp.md)
  `GHSA-8hrf-8g6f-7xwp`, `CVE-2026-119188` · npm `node-forge`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Memory corruption, CWE-248
- [Aedes has Uncaught Exception and Uncontrolled Resource Consumption](https://agentprime.io/advisories/CVE-2026-63341.md)
  `CVE-2026-63341` · CVE record: moscajs aedes · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Denial of service, CWE-248
- [llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length](https://agentprime.io/advisories/CVE-2026-119052.md)
  `CVE-2026-119052` · CVE record: ggml-org llama.cpp · CVSS 8.7 High · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-248
- [undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation](https://agentprime.io/advisories/GHSA-qrxm-fqhp-jwvm.md)
  `GHSA-qrxm-fqhp-jwvm`, `CVE-2026-87018` · npm `undici`: affected `>=4.2.1, <6.29.1 || >=7.0.0, <7.30.1 || >=8.0.0, <8.12.2`, fixed in `6.29.1`, `7.30.1`, `8.12.2` · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: Denial of service, CWE-248
- [undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor](https://agentprime.io/advisories/GHSA-55wc-3pg8-jfw6.md)
  `GHSA-55wc-3pg8-jfw6`, `CVE-2026-87029` · npm `undici`: affected `>=7.15.0, <7.30.1 || >=8.0.0, <8.12.2`, fixed in `7.30.1`, `8.12.2` · CVSS 5.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-248
- [qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)](https://agentprime.io/advisories/GHSA-6pq8-jhm2-2vcw.md)
  `GHSA-6pq8-jhm2-2vcw`, `CVE-2026-110816` · npm `qs`: affected `>=6.7.0, <6.16.1`, fixed in `6.16.1` · CVSS 6.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-248, CWE-704
- [undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake](https://agentprime.io/advisories/GHSA-qq8j-7v2v-3rwp.md)
  `GHSA-qq8j-7v2v-3rwp`, `CVE-2026-109855` · npm `undici`: affected `>=8.11.0, <8.11.2`, fixed in `8.11.2` · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-248, CWE-754
- [Fireware OS NULL Pointer Dereference in Management Interface Allows Unauthenticated Denial of Service](https://agentprime.io/advisories/CVE-2026-111107.md)
  `CVE-2026-111107` · CVE record: WatchGuard Fireware OS · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption, CWE-248, CWE-1286
- [Datadog dd-trace-py: IAST instrumentation can lead to application DOS](https://agentprime.io/advisories/GHSA-p3m5-h5v9-vqj6.md)
  `GHSA-p3m5-h5v9-vqj6`, `CVE-2026-116589` · PyPI `ddtrace`: affected `>=3.13.0, <4.15.5`, fixed in `4.15.5` · CVSS 8.2 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-248
- [svg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()](https://agentprime.io/advisories/CVE-2026-117541.md)
  `CVE-2026-117541` · CVE record: darylldoyle svg-sanitizer · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-248
- [undici vulnerable to Denial of Service via unhandled error on excessive content-encodings](https://agentprime.io/advisories/GHSA-xjj6-f33q-929c.md)
  `GHSA-xjj6-f33q-929c`, `CVE-2026-109869` · npm `undici`: affected `>=6.23.0, <6.29.1 || >=7.18.0, <7.30.1 || >=8.0.0, <8.12.2`, fixed in `6.29.1`, `7.30.1`, `8.12.2` · CVSS 7.5 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-248, CWE-459
- [multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown](https://agentprime.io/advisories/GHSA-q7qp-rjg7-q26m.md)
  `GHSA-q7qp-rjg7-q26m`, `CVE-2026-113872` · npm `multer`: affected `>=2.0.0, <2.5.0`, fixed in `2.5.0` · CVSS 7.5 High · Not analysed yet · Published 23 Oct 2026 · Tags: Denial of service, CWE-248
- [body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body](https://agentprime.io/advisories/GHSA-27r3-jxmh-p828.md)
  `GHSA-27r3-jxmh-p828`, `CVE-2026-111181` · npm `body-parser`: affected `<1.20.9 || >=2.0.0, <2.4.0`, fixed in `1.20.9`, `2.4.0` · CVSS 7.5 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-248
- [JweRsaKeyEncryptionDecryptorImpl.Decrypt panics on attacker-chosen IV length (stdlib GCM.Open reached without nonce-size check)](https://agentprime.io/advisories/CVE-2026-89318.md)
  `CVE-2026-89318` · CVE record: Eclipse Foundation Eclipse KeyPont - GOSE · CVSS 6.9 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-248
- [LoadPublicKey panics on kty/alg mismatch (kty=EC with a non-EC alg) via unchecked \*ECDSAOptions type assertion](https://agentprime.io/advisories/CVE-2026-89316.md)
  `CVE-2026-89316` · CVE record: Eclipse Foundation Eclipse KeyPont - GOSE · CVSS 6.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-248
- [JwtClaims.MarshalJSON panics via reflect.StructOf when any untyped claim key is not a valid Go identifier suffix](https://agentprime.io/advisories/CVE-2026-89315.md)
  `CVE-2026-89315` · CVE record: Eclipse Foundation Eclipse KeyPont - GOSE · CVSS 6.9 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-248
- [AesGcmCryptor.Open passes attacker-controlled nonce to cipher.AEAD.Open without length check, causing panic on wrong-size IV](https://agentprime.io/advisories/CVE-2026-89312.md)
  `CVE-2026-89312` · CVE record: Eclipse Foundation Eclipse KeyPont - GOSE · CVSS 6.9 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-248
- [Cisco Expressway Series Software Hardening Release: October 2026 - Uncaught Exception Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76493.md)
  `CVE-2026-76493` · CVE record: Cisco Cisco TelePresence Video Communication Server (VCS) Expressway · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-248
- [Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client](https://agentprime.io/advisories/CVE-2026-82231.md)
  `CVE-2026-82231` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-248
- [vLLM before 0.31.0 Denial of Service via min_tokens in /inference/v1/generate](https://agentprime.io/advisories/CVE-2026-114051.md)
  `CVE-2026-114051` · CVE record: vllm-project vllm · CVSS 7.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-248
- [Panic lowering a host-created component model stream into a guest that expects a different payload type](https://agentprime.io/advisories/GHSA-9pvw-hwfg-92h5.md)
  `GHSA-9pvw-hwfg-92h5`, `CVE-2026-115892`, `RUSTSEC-2026-0378` · crates.io `wasmtime`: affected `>=46.0.0, <48.0.7 || >=49.0.0, <49.0.4`, fixed in `48.0.7`, `49.0.4` · CVSS 5.7 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Memory corruption, CWE-248
- [Gitea panic on the repositories route of individual users](https://agentprime.io/advisories/CVE-2026-105661.md)
  `CVE-2026-105661` · CVE record: Gitea Gitea · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Memory corruption, CWE-248
- [CoreDNS \`k8s_external\` headless AXFR can emit an empty transfer batch that panics the \`transfer\` plugin](https://agentprime.io/advisories/GHSA-74w3-63xv-x9mv.md)
  `GHSA-74w3-63xv-x9mv`, `CVE-2026-62994`, `GO-2026-6805` · Go `github.com/coredns/coredns`: affected `>=1.9.4, <1.14.5`, fixed in `1.14.5` · CVSS 3.7 Low · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-248, CWE-755
- [countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception](https://agentprime.io/advisories/CVE-2026-42270.md)
  `CVE-2026-42270` · CVE record: Countly countly-server · CVSS 7.5 High · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-248
- [Qwik: Crashing any Qwik Server via Resource thenable](https://agentprime.io/advisories/GHSA-x586-xvc8-g7q6.md)
  `GHSA-x586-xvc8-g7q6`, `CVE-2026-84994` · npm `@builder.io/qwik` and 1 more: affected `<1.20.0`, fixed in `1.20.0` · CVSS 8.7 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-248
- [kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path](https://agentprime.io/advisories/GHSA-fh4f-47mf-f2gj.md)
  `GHSA-fh4f-47mf-f2gj`, `CVE-2026-100347`, `GO-2026-6783` · Go `github.com/getkin/kin-openapi`: affected `<0.145.0`, fixed in `0.145.0` · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-20, CWE-248
- [kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items](https://agentprime.io/advisories/GHSA-p6wj-qrr4-pgh5.md)
  `GHSA-p6wj-qrr4-pgh5`, `CVE-2026-97394`, `GO-2026-6790` · Go `github.com/getkin/kin-openapi`: affected `>=0.136.0, <0.143.0`, fixed in `0.143.0` · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Memory corruption, CWE-248
- [libp2p: Single pre-auth STUN packet terminates \`@libp2p/webrtc\` WebRTC-direct Node.js listeners](https://agentprime.io/advisories/CVE-2026-103936.md)
  `CVE-2026-103936` · CVE record: libp2p js-libp2p and 1 more · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-248, CWE-755
- [HPE NonStop ANSI SQLUTIL - Denial of Service vulnerability](https://agentprime.io/advisories/CVE-2026-79833.md)
  `CVE-2026-79833` · CVE record: Hewlett Packard Enterprise HPE NonStop ANSI SQLUTIL · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-248
- [Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data Manipulation.](https://agentprime.io/advisories/CVE-2026-110933.md)
  `CVE-2026-110933` · CVE record: Samsung Open Source Vyond · CVSS 4.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-248
- [Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error](https://agentprime.io/advisories/CVE-2026-110854.md)
  `CVE-2026-110854` · CVE record: parse-community parse-server · CVSS 8.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-248
- [RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers](https://agentprime.io/advisories/CVE-2026-67418.md)
  `CVE-2026-67418` · CVE record: rabbitmq rabbitmq-server · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-248, CWE-1286
- [RabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation](https://agentprime.io/advisories/CVE-2026-67416.md)
  `CVE-2026-67416` · CVE record: rabbitmq rabbitmq-server · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-20, CWE-248, CWE-754
- [Windows Failover Cluster Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-96945.md)
  `CVE-2026-96945` · CVE record: Microsoft Windows Server 2019 and 4 more · CVSS 7.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-248
- [Windows Failover Cluster Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-88099.md)
  `CVE-2026-88099` · CVE record: Microsoft Windows Server 2019 and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-248
- [Windows DNS Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-70082.md)
  `CVE-2026-70082` · CVE record: Microsoft Windows Server 2012 and 4 more · CVSS 7.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-248
- [Fortinet FortiSandbox: An Uncaught Exception vulnerability \[CWE-248\] vulnerability in Fortinet FortiSandbox…](https://agentprime.io/advisories/CVE-2026-106170.md)
  `CVE-2026-106170` · CVE record: Fortinet FortiSandbox · CVSS 4.8 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-248
- [SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values](https://agentprime.io/advisories/CVE-2026-109338.md)
  `CVE-2026-109338` · CVE record: surrealdb surrealdb · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-248
- [Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL](https://agentprime.io/advisories/CVE-2026-109301.md)
  `CVE-2026-109301` · CVE record: parse-community parse-server · CVSS 8.2 High · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-248
- [MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS](https://agentprime.io/advisories/GHSA-cx2f-j9fh-8g68.md)
  `GHSA-cx2f-j9fh-8g68`, `BIT-mariadb-2026-107382`, `BIT-mariadb-min-2026-107382`, `BIT-mysql-client-2026-107382`, `CVE-2026-107382` · npm `mariadb`: affected `>=3.3.0, <3.5.4`, fixed in `3.5.4` · CVSS 5.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-248
- [music-metadata: uncatchable process crash parsing a crafted \`.dsf\` (residual of GHSA-v6c2-xwv6-8xf7)](https://agentprime.io/advisories/GHSA-8j4c-6x6g-rq3j.md)
  `GHSA-8j4c-6x6g-rq3j`, `CVE-2026-107392` · npm `music-metadata`: affected `<11.15.0`, fixed in `11.15.0` · CVSS 6.2 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Denial of service, CWE-248
- [Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks](https://agentprime.io/advisories/GHSA-2j4c-ffch-9f23.md)
  `GHSA-2j4c-ffch-9f23`, `CVE-2026-107214`, `GO-2026-6684` · Go `github.com/xuri/excelize/v2`: affected `>=2.3.1, <2.11.1-0.20260915055537-22f76f9acb94`, fixed in `2.11.1-0.20260915055537-22f76f9acb94` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-248
- [RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers](https://agentprime.io/advisories/GHSA-7822-rcf6-97fx.md)
  `GHSA-7822-rcf6-97fx`, `CVE-2026-106122` · Maven `com.rabbitmq:amqp-client`: affected `<5.36.0`, fixed in `5.36.0` · CVSS 6.0 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-172, CWE-248
- [Apache YuniKorn: LDAP Group provider panics on lowercase attribute name](https://agentprime.io/advisories/CVE-2026-78243.md)
  `CVE-2026-78243` · CVE record: Apache Software Foundation Apache YuniKorn · CVSS 2.1 Low · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-248
- [Uncaught Exception in Elastic Endpoint Leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-102413.md)
  `CVE-2026-102413` · CVE record: Elastic Elastic Agent and Elastic Defend · CVSS 6.2 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-248
- [Gitea denial of service through external issue tracker patterns](https://agentprime.io/advisories/CVE-2026-96399.md)
  `CVE-2026-96399` · CVE record: Gitea Gitea · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Memory corruption, CWE-248
- [vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)](https://agentprime.io/advisories/GHSA-85xf-c7hm-whqw.md)
  `GHSA-85xf-c7hm-whqw`, `CVE-2026-105757`, `PYSEC-2026-4199` · PyPI `vllm`: affected `<0.30.0`, fixed in `0.30.0` · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-20, CWE-248, CWE-755
- [vLLM: Loose \`cache_salt\` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream \`ValueError\` denial of service](https://agentprime.io/advisories/GHSA-2823-qmq8-rwvj.md)
  `GHSA-2823-qmq8-rwvj`, `CVE-2026-105756`, `PYSEC-2026-4306` · PyPI `vllm`: affected `<0.30.0`, fixed in `0.30.0` · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-20, CWE-248
- [vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process](https://agentprime.io/advisories/GHSA-2v2p-6j97-cjg9.md)
  `GHSA-2v2p-6j97-cjg9`, `CVE-2026-100722` · npm `vm2`: affected `<3.12.2`, fixed in `3.12.2` · CVSS 8.9 High · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-248, CWE-703

Older: <https://agentprime.io/advisories/tag/cwe-248.md?cursor=WyIyMDI2LTEwLTA1VDIzOjE5OjU1LjAwMDAwMFoiLCJHSFNBLTJ2MnAtNmo5Ny1jamc5Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-248>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-248/>. Everything for agents: <https://agentprime.io/llms.txt>.