# CWE-345.

Every Advisory and CVE whose sources give the weakness CWE-345, newest first.

## Records, newest first (an older page)

- [Apache CXF: Self-issued ID token claims validation skipped](https://agentprime.io/advisories/CVE-2026-65583.md)
  `CVE-2026-65583` · CVE record: Apache Software Foundation Apache CXF · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-345
- [Openshift/oauth-proxy: openshift/oauth-proxy: unauthenticated identity header injection on whitelisted paths](https://agentprime.io/advisories/CVE-2026-49331.md)
  `CVE-2026-49331` · CVE record: Red Hat Red Hat OpenShift Container Platform 4 · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-345
- [marimo < 0.23.15 API Key Exfiltration via Malicious Notebook PEP-723 Metadata](https://agentprime.io/advisories/CVE-2026-67618.md)
  `CVE-2026-67618` · CVE record: marimo-team marimo · CVSS 7.1 High · Not analysed yet · Published 4 Aug 2026 · Tags: CWE-345
- [Production Debug-Unlock Token Verification Missing Device Binding](https://agentprime.io/advisories/CVE-2026-11836.md)
  `CVE-2026-11836` · CVE record: Caliptra Core ROM and 1 more · CVSS 1.8 Low · Not analysed yet · Published 4 Aug 2026 · Tags: CWE-345
- [Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning](https://agentprime.io/advisories/GHSA-jhpw-976m-542j.md)
  `GHSA-jhpw-976m-542j`, `CVE-2026-68945` · npm `@angular/common`: affected `<=19.2.25 || >=20.0.0-next.0, <20.3.27 || >=21.0.0-next.0, <21.2.19 || >=22.0.0-next.0, <22.0.2`, fixed in `20.3.27`, `21.2.19`, `22.0.2` · CVSS 8.8 High · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-345
- [@fastify/aws-lambda vulnerable to Lambda event spoofing via client-controlled x-apigateway-event header](https://agentprime.io/advisories/CVE-2026-18248.md)
  `CVE-2026-18248` · CVE record: @fastify/aws-lambda @fastify/aws-lambda · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-345
- [S/MIME validator trusts signer-asserted signingTime for path validation](https://agentprime.io/advisories/CVE-2026-59641.md)
  `CVE-2026-59641` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 2 more · CVSS 8.7 High · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-345
- [Wazuh before 5.0.0-beta3 Cluster Attribution Spoofing via Inventory Sync](https://agentprime.io/advisories/CVE-2026-67307.md)
  `CVE-2026-67307` · CVE record: wazuh wazuh · CVSS 7.0 High · Not analysed yet · Published 1 Aug 2026 · Tags: CWE-345
- [Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes](https://agentprime.io/advisories/CVE-2026-10827.md)
  `CVE-2026-10827` · CVE record: Unknown Spectra Legacy · CVSS 3.5 Low · Not analysed yet · Published 1 Aug 2026 · Tags: CWE-345
- [WordPress MasterStudy LMS plugin <= 3.7.39 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-28145.md)
  `CVE-2026-28145` · CVE record: StylemixThemes MasterStudy LMS · CVSS 5.3 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-345
- [Stackrox: stackrox: deploy-time policy enforcement and visibility bypass via label injection](https://agentprime.io/advisories/CVE-2026-10079.md)
  `CVE-2026-10079` · CVE record: Red Hat Red Hat Advanced Cluster Security 4 · CVSS 8.5 High · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-345
- [joserfc accepts JWT with padding, leading to JWT malleability](https://agentprime.io/advisories/CVE-2026-62995.md)
  `CVE-2026-62995` · CVE record: authlib joserfc · CVSS 2.3 Low · Not analysed yet · Published 29 Jul 2026 · Tags: CWE-345
- [Insufficient verification of Hex package metadata in Gleam](https://agentprime.io/advisories/CVE-2026-59247.md)
  `CVE-2026-59247` · CVE record: Gleam Gleam · CVSS 7.6 High · Not analysed yet · Published 29 Jul 2026 · Tags: CWE-345
- [Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn](https://agentprime.io/advisories/CVE-2026-12383.md)
  `CVE-2026-12383` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 3 more · CVSS 7.5 High · Not analysed yet · Published 27 Jul 2026 · Tags: CWE-345
- [OmniFaces: Forged combined-resource IDs and related output/push boundaries](https://agentprime.io/advisories/GHSA-fp43-vj7g-pg92.md)
  `GHSA-fp43-vj7g-pg92`, `CVE-2026-102695` · Maven `org.omnifaces:omnifaces`: affected `<1.14.3 || >=2.0.0, <2.7.33 || >=3.0.0, <3.14.23 || >=4.0.0, <4.7.12 || >=5.0.0, <5.4.2`, fixed in `1.14.3`, `2.7.33`, `3.14.23`, `4.7.12`, `5.4.2` · CVSS 8.2 High · Not analysed yet · Published 24 Jul 2026 · Tags: Cross-site scripting (XSS), Information disclosure, Denial of service, Broken access control
- [Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)](https://agentprime.io/advisories/GHSA-pvcr-8mvp-w8qr.md)
  `GHSA-pvcr-8mvp-w8qr`, `CVE-2026-72849` · npm `@budibase/server`: affected `<=3.38.1`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 24 Jul 2026 · Tags: Broken access control, Cross-site request forgery (CSRF), CWE-345
- [Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in](https://agentprime.io/advisories/GHSA-qq9h-g4jm-xgf3.md)
  `GHSA-qq9h-g4jm-xgf3`, `CVE-2026-67327` · npm `better-auth`: affected `>=1.1.3, <1.6.22 || >=1.7.0-beta.0, <1.7.0-beta.10`, fixed in `1.6.22`, `1.7.0-beta.10` · CVSS 8.7 High · Not analysed yet · Published 24 Jul 2026 · Tags: Authentication bypass, CWE-345
- [LOIDC nonce validation bypass](https://agentprime.io/advisories/CVE-2026-15612.md)
  `CVE-2026-15612` · CVE record: Logto Logto · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: CWE-345
- [SAML \<Conditions> element not validated](https://agentprime.io/advisories/CVE-2026-15615.md)
  `CVE-2026-15615` · CVE record: Logto Logto · CVSS 7.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: CWE-345
- [Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them](https://agentprime.io/advisories/GHSA-x445-f3h2-j279.md)
  `GHSA-x445-f3h2-j279`, `CVE-2026-73419` · npm `@auth/core` and 1 more: affected `<0.41.3`, fixed in `0.41.3` · CVSS 6.8 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: CWE-345, CWE-346, CWE-940
- [RRSIGs with too few labels can lead to bypass of DNSSEC wildcard validation](https://agentprime.io/advisories/CVE-2026-52688.md)
  `CVE-2026-52688` · CVE record: PowerDNS Recursor · CVSS 7.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: Weak cryptography or TLS, CWE-345
- [Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly.](https://agentprime.io/advisories/CVE-2026-39155.md)
  `CVE-2026-39155` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: CWE-345
- [n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login](https://agentprime.io/advisories/GHSA-8342-988q-86cr.md)
  `GHSA-8342-988q-86cr`, `CVE-2026-72772` · npm `n8n`: affected `<2.31.5 || >=2.32.0, <2.32.1`, fixed in `2.31.5`, `2.32.1` · CVSS 8.9 High · Not analysed yet · Published 22 Jul 2026 · Tags: Broken access control, CWE-345, CWE-640
- [DialogHandler Parameters Tampering Vulnerability in Telerik UI for ASP.NET AJAX](https://agentprime.io/advisories/CVE-2026-13188.md)
  `CVE-2026-13188` · CVE record: Progress Software Telerik UI for ASP.NET AJAX · CVSS 5.9 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-345
- [BOGUS configured primary hostname accepted for XFR in auth/rpz zones](https://agentprime.io/advisories/CVE-2026-50248.md)
  `CVE-2026-50248` · CVE record: NLnet Labs Unbound · CVSS 6.5 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-345
- [Cross-zone wildcard cache poisoning via RRSIG.labels manipulation](https://agentprime.io/advisories/CVE-2026-44690.md)
  `CVE-2026-44690` · CVE record: NLnet Labs Unbound · CVSS 7.5 High · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-345
- [Open redirect in Oracle Corporation Oracle Production Scheduling](https://agentprime.io/advisories/CVE-2026-62517.md)
  `CVE-2026-62517` · CVE record: Oracle Corporation Oracle Production Scheduling · CVSS 5.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Open redirect, CWE-345, CWE-640
- [Microsoft Security Advisory CVE-2026-50526 – .NET Tampering Vulnerability](https://agentprime.io/advisories/GHSA-55jh-fwmh-39m4.md)
  `GHSA-55jh-fwmh-39m4`, `BIT-dotnet-2026-50526`, `BIT-dotnet-sdk-2026-50526`, `CVE-2026-50526` · NuGet `Microsoft.NET.Build.Containers`: affected `>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.29`, `9.0.18`, `10.0.10` · CVSS 7.0 High · Not analysed yet · Published 21 Jul 2026 · Tags: Path traversal, CWE-345
- [Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability](https://agentprime.io/advisories/GHSA-g8r8-53c2-pm3f.md)
  `GHSA-g8r8-53c2-pm3f`, `BIT-dotnet-2026-47304`, `BIT-dotnet-sdk-2026-47304`, `CVE-2026-47304` · NuGet `System.Security.Cryptography.Xml`: affected `>=8.0.0, <8.0.4 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.4`, `9.0.18`, `10.0.10` · CVSS 8.1 High · Not analysed yet · Published 20 Jul 2026 · Tags: Weak cryptography or TLS, CWE-345
- [Mistune toc / TableOfContents directive: heading IDs use predictable \`toc_N\` numbering with no slugification, allowing collision with attacker-controlled \`id="toc_N"\` content](https://agentprime.io/advisories/GHSA-2hm2-hc3v-44h9.md)
  `GHSA-2hm2-hc3v-44h9`, `CVE-2026-59930`, `PYSEC-2026-2218` · PyPI `mistune`: affected `<3.3.0`, fixed in `3.3.0` · CVSS 4.3 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-345, CWE-1284
- [Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password](https://agentprime.io/advisories/CVE-2026-12724.md)
  `CVE-2026-12724` · CVE record: Unknown Kirki · CVSS 4.3 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-345
- [Reviews Feed < 2.6.5 - Unauthenticated Stored Arbitrary Shortcode Execution via Google Reviews](https://agentprime.io/advisories/CVE-2026-10724.md)
  `CVE-2026-10724` · CVE record: Unknown Reviews Feed · CVSS 4.8 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-345
- [SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft](https://agentprime.io/advisories/CVE-2026-63094.md)
  `CVE-2026-63094` · CVE record: SigNoz signoz · CVSS 7.6 High · Not analysed yet · Published 17 Jul 2026 · Tags: Open redirect, CWE-345
- [OpenClaw < 2026.6.5 Authentication Bypass via HTTP Canvas](https://agentprime.io/advisories/CVE-2026-62215.md)
  `CVE-2026-62215` · CVE record: OpenClaw OpenClaw · CVSS 5.1 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-345
- [Quicly is vulnerable to stateless reset injection](https://agentprime.io/advisories/CVE-2026-44434.md)
  `CVE-2026-44434` · CVE record: h2o quicly · CVSS 5.3 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: CWE-345, CWE-665
- [Activepieces: Cross-tenant file download via missing JWT audience check on step-files signed URL](https://agentprime.io/advisories/CVE-2026-53536.md)
  `CVE-2026-53536` · CVE record: activepieces activepieces · CVSS 5.3 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: Broken access control, CWE-345
- [Postiz: Unauthenticated arbitrary lifetime PRO grant via Nowpayments webhook](https://agentprime.io/advisories/CVE-2026-48799.md)
  `CVE-2026-48799` · CVE record: gitroomhq postiz-app · CVSS 7.7 High · Not analysed yet · Published 15 Jul 2026 · Tags: Broken access control, CWE-345
- [Insufficient verification of data authenticity in Eclipse Foundation Eclipse Kura](https://agentprime.io/advisories/CVE-2026-9561.md)
  `CVE-2026-9561` · CVE record: Eclipse Foundation Eclipse Kura · CVSS 8.8 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-345, CWE-348, CWE-807
- [WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler](https://agentprime.io/advisories/CVE-2026-11901.md)
  `CVE-2026-11901` · CVE record: thimpress WP Hotel Booking · CVSS 5.3 Medium · Not analysed yet · Published 11 Jul 2026 · Tags: CWE-345
- [melange: Incomplete package integrity verification allows data section substitution](https://agentprime.io/advisories/GHSA-fpg8-7664-jc5q.md)
  `GHSA-fpg8-7664-jc5q`, `CVE-2026-54174`, `GO-2026-5968` · Go `chainguard.dev/apko` and 1 more: affected `<1.2.9`, fixed in `1.2.9` · CVSS 8.3 High · Not analysed yet · Published 10 Jul 2026 · Tags: CWE-345, CWE-354
- [sigstore-go has a multi-log threshold bypass via single compromised log](https://agentprime.io/advisories/GHSA-9vcr-p3rj-q5q6.md)
  `GHSA-9vcr-p3rj-q5q6`, `CVE-2026-49834`, `GO-2026-5952` · Go `github.com/sigstore/sigstore-go`: affected `<1.2.0`, fixed in `1.2.0` · CVSS 5.9 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Weak cryptography or TLS, CWE-345
- [Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding)](https://agentprime.io/advisories/CVE-2026-53961.md)
  `CVE-2026-53961` · CVE record: discourse discourse · CVSS 6.5 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: CWE-345
- [@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints](https://agentprime.io/advisories/GHSA-5rr4-8452-hf4v.md)
  `GHSA-5rr4-8452-hf4v`, `CVE-2026-53513` · npm `@better-auth/sso`: affected `>=0.1.0, <1.6.11`, fixed in `1.6.11` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jul 2026 · Tags: Server-side request forgery (SSRF), CWE-20, CWE-345, CWE-441
- [Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email](https://agentprime.io/advisories/GHSA-g38m-r43w-p2q7.md)
  `GHSA-g38m-r43w-p2q7`, `CVE-2026-53516` · npm `better-auth`: affected `<1.6.11`, fixed in `1.6.11` · CVSS 8.3 High · Not analysed yet · Published 7 Jul 2026 · Tags: Authentication bypass, CWE-345
- [Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin](https://agentprime.io/advisories/GHSA-fmh4-wcc4-5jm3.md)
  `GHSA-fmh4-wcc4-5jm3`, `CVE-2026-53514` · npm `better-auth`: affected `<1.6.11`, fixed in `1.6.11` · CVSS 7.7 High · Not analysed yet · Published 7 Jul 2026 · Tags: Authentication bypass, Broken access control, CWE-345, CWE-441
- [Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins](https://agentprime.io/advisories/GHSA-pw9m-5jxm-xr6h.md)
  `GHSA-pw9m-5jxm-xr6h`, `CVE-2026-53512` · npm `better-auth`: affected `<1.6.11`, fixed in `1.6.11` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jul 2026 · Tags: Authentication bypass, Broken access control, CWE-345
- [Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness](https://agentprime.io/advisories/GHSA-ww9q-8r59-xv46.md)
  `GHSA-ww9q-8r59-xv46`, `CVE-2026-54496` · crates.io `halo2_gadgets` and 3 more: affected `<0.5.0`, fixed in `0.5.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-345
- [Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access](https://agentprime.io/advisories/GHSA-5g4w-3vw9-478w.md)
  `GHSA-5g4w-3vw9-478w`, `CVE-2026-55430`, `GO-2026-5917` · Go `github.com/coder/coder/v2`: affected `<2.29.17 || >=2.30.0, <2.32.7 || >=2.33.0, <2.33.8 || >=2.34.0, <2.34.2`, fixed in `2.29.17`, `2.32.7`, `2.33.8`, `2.34.2` · CVSS 5.8 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-345, CWE-441
- [SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned \`Response/InResponseTo\` is combined with a signed assertion lacking \`SubjectConfirmationData/InResponseTo\`](https://agentprime.io/advisories/GHSA-q8r6-xj3f-wrrm.md)
  `GHSA-q8r6-xj3f-wrrm`, `CVE-2026-49284`, `PKSA-569h-6vqh-5xr3` · Packagist `simplesamlphp/simplesamlphp`: affected `<2.4.7 || >=2.5.0, <2.5.2`, fixed in `2.4.7`, `2.5.2` · CVSS 7.1 High · Not analysed yet · Published 2 Jul 2026 · Tags: CWE-345
- [Zebra has sync restart poisoning from single unauthenticated peer via above-lookahead block](https://agentprime.io/advisories/GHSA-gvjc-3w7c-92jx.md)
  `GHSA-gvjc-3w7c-92jx`, `CVE-2026-52737` · crates.io `zebra-consensus` and 1 more: affected `<7.0.0`, fixed in `7.0.0` · CVSS 5.3 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: CWE-345
- [OpenClaw: Trusted retry endpoint checks could match hostname prefixes](https://agentprime.io/advisories/GHSA-77q5-rr5v-x43q.md)
  `GHSA-77q5-rr5v-x43q`, `CVE-2026-53839` · npm `openclaw`: affected `<2026.5.7`, fixed in `2026.5.7` · CVSS 6.0 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: CWE-20, CWE-345, CWE-1023
- [Rancher Fleet has Unauthenticated Webhook: Regex Injection via Unsanitized Repository URL Components](https://agentprime.io/advisories/GHSA-jmf4-m7j9-g72r.md)
  `GHSA-jmf4-m7j9-g72r`, `CVE-2026-44937`, `GO-2026-5874` · Go `github.com/rancher/fleet`: affected `>=0.12.0, <0.12.15 || >=0.13.0, <0.13.11 || >=0.14.0, <0.14.6 || >=0.15.0, <0.15.2`, fixed in `0.12.15`, `0.13.11`, `0.14.6`, `0.15.2` · CVSS 8.3 High · Not analysed yet · Published 1 Jul 2026 · Tags: Server-side request forgery (SSRF), CWE-345
- [sigstore-js has Insufficient Verification of Data Authenticity](https://agentprime.io/advisories/GHSA-xgjw-pm74-86q4.md)
  `GHSA-xgjw-pm74-86q4`, `CVE-2026-48816` · npm `@sigstore/verify`: affected `>=3.1.0, <3.1.1`, fixed in `3.1.1` · CVSS 6.5 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: CWE-345
- [NodeBB - ActivityPub Author Spoofing via Unvalidated attributedTo Mapped to Local User](https://agentprime.io/advisories/CVE-2026-58593.md)
  `CVE-2026-58593` · CVE record: NodeBB NodeBB · CVSS 8.7 High · Not analysed yet · Published 1 Jul 2026 · Tags: Authentication bypass, CWE-345
- [MyScale MyScaleDB SegmentId.h getCacheKey data authenticity](https://agentprime.io/advisories/CVE-2026-13513.md)
  `CVE-2026-13513` · CVE record: MyScale MyScaleDB · CVSS 2.3 Low · Not analysed yet · Published 28 Jun 2026 · Tags: CWE-345
- [volcengine OpenViking Local VectorDB Primary-key Label str_to_uint64.py str_to_uint64 data authenticity](https://agentprime.io/advisories/CVE-2026-13507.md)
  `CVE-2026-13507` · CVE record: volcengine OpenViking · CVSS 2.3 Low · Not analysed yet · Published 28 Jun 2026 · Tags: CWE-345
- [arc53 DocsGPT Credential Storage encryption.py encrypt_credentials data authenticity](https://agentprime.io/advisories/CVE-2026-13483.md)
  `CVE-2026-13483` · CVE record: arc53 DocsGPT · CVSS 2.3 Low · Not analysed yet · Published 28 Jun 2026 · Tags: CWE-345
- [RegistrationMagic <= 6.0.8.6 - Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request](https://agentprime.io/advisories/CVE-2026-9242.md)
  `CVE-2026-9242` · CVE record: metagauss RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login · CVSS 5.3 Medium · Not analysed yet · Published 27 Jun 2026 · Tags: CWE-345
- [pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes](https://agentprime.io/advisories/GHSA-w466-c33r-3gjp.md)
  `GHSA-w466-c33r-3gjp`, `CVE-2026-55698` · npm `pnpm`: affected `<10.34.2 || >=11.0.0, <11.5.3`, fixed in `10.34.2`, `11.5.3` · CVSS 8.8 High · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-345, CWE-494, CWE-829
- [pnpm: Unsafe default behavior breaks integrity check](https://agentprime.io/advisories/GHSA-54hh-g5mx-jqcp.md)
  `GHSA-54hh-g5mx-jqcp`, `CVE-2026-50573` · npm `pnpm`: affected `<10.34.0 || >=11.0.0, <11.4.0`, fixed in `10.34.0`, `11.4.0` · CVSS 6.8 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-345

Newest: <https://agentprime.io/advisories/tag/cwe-345.md>
Older: <https://agentprime.io/advisories/tag/cwe-345.md?cursor=WyIyMDI2LTA2LTI2VDIyOjUyOjMzLjAwMDAwMFoiLCJHSFNBLTU0aGgtZzVteC1qcWNwIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-345&cursor=WyIyMDI2LTA4LTA2VDExOjIzOjQ1LjE3NTAwMFoiLCJDVkUtMjAyNi02MzY4NyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-345/?cursor=WyIyMDI2LTA4LTA2VDExOjIzOjQ1LjE3NTAwMFoiLCJDVkUtMjAyNi02MzY4NyJd>. Everything for agents: <https://agentprime.io/llms.txt>.