agentprime: CWE-289

kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion

Thu, 15 Oct 2026 20:19:20 GMT

github.com/getkin/kin-openapi >=0.144.0, <0.147.0, fixed in 0.147.0. CVSS 7.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-104143: DataEase: Stored SQL Injection via dateFormat field templates

Wed, 14 Oct 2026 18:43:34 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend

Thu, 24 Sep 2026 19:55:57 GMT

social-auth-core <5.0.0, fixed in 5.0.0. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-95514: WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerability

Wed, 23 Sep 2026 18:14:36 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-76183: Apache Tomcat: Bypass of security constraints for WebSocket endpoints

Wed, 23 Sep 2026 11:16:09 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-73511: Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)

Mon, 21 Sep 2026 20:20:26 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-92579: AVideo through 29.0 Broken Access Control via CSRF Exemption Basename Collision

Wed, 16 Sep 2026 21:46:47 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-12101: Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

Tue, 15 Sep 2026 17:16:19 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-15980: MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token

Sun, 30 Aug 2026 04:25:48 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-15985: Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login

Wed, 26 Aug 2026 11:36:39 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads

Wed, 12 Aug 2026 15:14:47 GMT

winter/wn-cms-module <1.2.13, fixed in 1.2.13. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-8457: WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT

Sat, 01 Aug 2026 23:29:35 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-10842: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability

Thu, 30 Jul 2026 15:57:16 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-9701: Eventer <= 4.4.2 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation

Wed, 08 Jul 2026 04:30:50 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass

Mon, 06 Jul 2026 20:52:13 GMT

github.com/coder/coder/v2 <2.29.17 || >=2.30.0, <2.32.7 || >=2.33.0, <2.33.8 || >=2.34.0, <2.34.2, fixed in 2.29.17, 2.32.7, 2.33.8, 2.34.2. CVSS 7.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-48618: node: A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling…

Fri, 26 Jun 2026 01:14:36 GMT

CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

Apache Shiro shiro-guice module vulnerable to authentication bypass

Thu, 25 Jun 2026 09:31:23 GMT

org.apache.shiro:shiro-guice >=2.0.0, <3.0.0, fixed in 3.0.0. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts

Tue, 16 Jun 2026 21:04:29 GMT

github.com/traefik/traefik <=1.7.34, no fixed version yet. CVSS 7.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator

Fri, 12 Jun 2026 12:31:33 GMT

org.apache.cxf:cxf-rt-rs-security-oauth2 >=4.2.0, <4.2.2 || <4.1.7, fixed in 4.2.2, 4.1.7. CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

Fri, 29 May 2026 15:59:30 GMT

axios <0.32.0 || >=1.15.0, <1.16.0, fixed in 0.32.0, 1.16.0. CVSS 8.6 (High). Critical: CVSS score 8.6 (7.0 or more) and EPSS 0.12 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-43617: Rsync < 3.4.3 Authorization Bypass via Hostname Resolution

Wed, 20 May 2026 00:52:38 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Traefik: Pre-authentication decision bypass due to forwarded alias spoofing

Fri, 24 Apr 2026 16:32:34 GMT

github.com/traefik/traefik <=1.7.34, no fixed version yet. CVSS 7.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-3184: Util-linux: util-linux: access control bypass due to improper hostname canonicalization

Fri, 03 Apr 2026 18:43:45 GMT

CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty

Thu, 12 Mar 2026 14:21:35 GMT

openclaw <2026.3.8, fixed in 2026.3.8. CVSS 2.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OpenClaw has gateway plugin auth bypass via encoded dot-segment traversal in protected /api/channels paths

Tue, 03 Mar 2026 18:54:35 GMT

openclaw <2026.2.26, fixed in 2026.2.26. CVSS 8.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Apache Shiro has an Authentication Bypass

Mon, 09 Feb 2026 12:30:22 GMT

org.apache.shiro:shiro-spring <2.1.0, fixed in 2.1.0. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Soft Serve Affected by an Authentication Bypass in github.com/charmbracelet/soft-serve

Mon, 02 Feb 2026 21:05:55 GMT

github.com/charmbracelet/soft-serve <0.11.3, fixed in 0.11.3. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-55130: node: A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and…

Tue, 20 Jan 2026 20:41:55 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-14777: Keycloak: keycloak idor in realm client creating/deleting

Tue, 16 Dec 2025 05:02:42 GMT

CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-13613: Elated Membership <= 1.2 - Authentication Bypass via Social Login

Wed, 10 Dec 2025 01:51:52 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provider, authentik creates a service accou...

Wed, 19 Nov 2025 17:15:52 GMT

authentik-client >=2025.8.0, <2025.8.5 || >=2025.10.0, <2025.10.2, fixed in 2025.8.5, 2025.10.2. CVSS 4.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-64343: (conda) Constructor: Excessive permissions during and after installation

Fri, 07 Nov 2025 05:20:38 GMT

CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-60375: The authentication mechanism in Perfex CRM before 3.3.1 allows attackers to bypass login credentials due to insufficient server-side validation.

Thu, 09 Oct 2025 00:00:00 GMT

CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

Spring Security annotation detection mechanism has authorization bypass

Tue, 16 Sep 2025 15:32:34 GMT

org.springframework.security:spring-security-core >=6.4.0, <6.4.10 || >=6.5.0, <6.5.4, fixed in 6.4.10, 6.5.4. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-8415: Cryostat: authentication bypass if network policies are disabled

Wed, 20 Aug 2025 16:14:33 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-29266: Unraid: Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console…

Mon, 31 Mar 2025 00:00:00 GMT

CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-11283: WP JobHunt <= 7.1 - Authentication Bypass to Candidate

Fri, 14 Mar 2025 04:22:34 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-56511: DataEase has an unauthorized vulnerability

Fri, 10 Jan 2025 15:19:13 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. CVSS score 9.3 (7.0 or more) and EPSS 0.50 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.

Drupal's uniqueness checking for certain user fields is inconsistent depending on the database engine and its collation.

Wed, 20 Nov 2024 17:21:58 GMT

drupal/core >=8.0.0, <10.2.11 || >=10.3.0, <10.3.9 || >=11.0.0, <11.0.8, fixed in 10.2.11, 10.3.9, 11.0.8. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Moodle Lesson activity password bypass through PHP loose comparison

Wed, 20 Nov 2024 12:30:35 GMT

moodle/moodle <4.1.13 || >=4.2.0-beta, <4.2.10 || >=4.3.0-beta, <4.3.7 || >=4.4.0-beta, <4.4.3, fixed in 4.1.13, 4.2.10, 4.3.7, 4.4.3. CVSS 5.4 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Symfony has an Authentication Bypass via RememberMe

Wed, 13 Nov 2024 18:29:04 GMT

symfony/security-http >=5.3.0, <5.4.47 || >=6.0.0-BETA1, <6.4.15 || >=7.0.0-BETA1, <7.1.8, fixed in 5.4.47, 6.4.15, 7.1.8. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2024-2098: Download Manager <= 3.2.89 - Improper Authorization via protectMediaLibrary

Thu, 13 Jun 2024 05:34:44 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-34519: Avantra Server 24.x before 24.0.7 and 24.1.x before 24.1.1 mishandles the security of dashboards, aka XAN-5367.

Sun, 05 May 2024 00:00:00 GMT

CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Hail relies on OIDC email claims to verify the validity of a user's domain.

Tue, 02 Jan 2024 16:40:58 GMT

hail <0.2.127, fixed in 0.2.127. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation

Wed, 20 Sep 2023 23:01:52 GMT

Kentor.AuthServices <=0.23.0, no fixed version yet. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2023-3263: Dataprobe iBoot PDU: The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable…

Mon, 14 Aug 2023 04:02:55 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2023-38487: HedgeDoc API allows to hide existing notes

Fri, 04 Aug 2023 15:40:16 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2023-20046: A vulnerability in the key-based SSH authentication feature of Cisco StarOS Software could allow an authenticated, remote attacker to elevate privileges on an affected device.

Tue, 09 May 2023 13:06:10 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2023-1803: Authentication Bypass in Redline Router

Fri, 14 Apr 2023 13:40:27 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Go-tuf Improperly handles multiple key IDs for the same public keys in attacker-controlled metadata

Fri, 16 Sep 2022 17:17:13 GMT

github.com/theupdateframework/go-tuf <0.3.2, fixed in 0.3.2. Published by the GitHub Advisory Database. Not analysed by agentprime yet.