# CWE-345.

Every Advisory and CVE whose sources give the weakness CWE-345, newest first.

## Records, newest first (an older page)

- [pac4j-oidc before 6.5.6 Authentication Bypass via Access Token Substitution](https://agentprime.io/advisories/CVE-2026-82462.md)
  `CVE-2026-82462` · CVE record: pac4j pac4j · CVSS 6.9 Medium · Not analysed yet · Published 29 Aug 2026 · Tags: CWE-345
- [IGEL OS 12 / 11 Boot Registry Parameter Injection via Unsigned Configuration Area](https://agentprime.io/advisories/CVE-2026-82017.md)
  `CVE-2026-82017` · CVE record: IGEL IGEL OS 12 and 1 more · CVSS 8.6 High · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-345
- [Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check](https://agentprime.io/advisories/GHSA-mf7q-r4rv-jv94.md)
  `GHSA-mf7q-r4rv-jv94`, `CVE-2026-105163`, `GO-2026-6302` · Go `github.com/crossplane/crossplane-runtime/v2`: affected `>=2.3.0, <2.3.3 || >=2.4.0-rc.0, <2.4.0-rc.1`, fixed in `2.3.3`, `2.4.0-rc.1` · CVSS 6.9 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: Race condition, CWE-345
- [openssl_encrypt before 1.4.9 fails to prevent namespace collisions between own identities and contacts in IdentityStore, allowing attackers to create shadowed contact entries invisible until the co...](https://agentprime.io/advisories/GHSA-8gmx-w9m8-vx7q.md)
  `GHSA-8gmx-w9m8-vx7q`, `CVE-2026-81706`, `PYSEC-2026-3781` · PyPI `openssl-encrypt`: affected `<1.4.9`, fixed in `1.4.9` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-345
- [openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can ...](https://agentprime.io/advisories/GHSA-q8p3-7h6h-ghfr.md)
  `GHSA-q8p3-7h6h-ghfr`, `CVE-2026-81702`, `PYSEC-2026-3962` · PyPI `openssl-encrypt`: affected `<1.4.9`, fixed in `1.4.9` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-345
- [mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)](https://agentprime.io/advisories/GHSA-p7x2-g5cq-fhmq.md)
  `GHSA-p7x2-g5cq-fhmq`, `CVE-2026-55663` · crates.io `mediasoup` and 1 more: affected `>=0.22.0, <0.22.5`, fixed in `0.22.5` · CVSS 5.6 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-345
- [Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive user](https://agentprime.io/advisories/CVE-2026-53561.md)
  `CVE-2026-53561` · CVE record: Apache Software Foundation Apache Hive · CVSS 7.4 High · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass, CWE-305, CWE-345
- [joserfc claim-validation bypass via array-typed single-string claims (iss/sub/jti)](https://agentprime.io/advisories/CVE-2026-75509.md)
  `CVE-2026-75509` · CVE record: authlib joserfc · CVSS 6.5 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: Authentication bypass, CWE-345
- [Insufficient verification of data authenticity in Devolutions Remote Desktop Manager](https://agentprime.io/advisories/CVE-2026-78417.md)
  `CVE-2026-78417` · CVE record: Devolutions Remote Desktop Manager · CVSS 4.3 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-345
- [Duplicate Advisory: SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin](https://agentprime.io/advisories/GHSA-989h-w3q9-3m2f.md)
  `GHSA-989h-w3q9-3m2f` · Go `github.com/siyuan-note/siyuan/kernel`: affected `*`, no fixed version yet · CVSS 6.6 Medium · Withdrawn · Not analysed yet · Published 22 Aug 2026 · Tags: CWE-345
- [WWBN AVideo Authorization Bypass via Users_affiliations add.json.php](https://agentprime.io/advisories/CVE-2026-58002.md)
  `CVE-2026-58002` · CVE record: WWBN AVideo · CVSS 7.1 High · Not analysed yet · Published 22 Aug 2026 · Tags: CWE-345
- [Arc Enterprise cluster replication accepts unauthenticated MsgReplicateSync messages, enabling cluster-wide data injection from any TLS-trusted peer](https://agentprime.io/advisories/CVE-2026-48106.md)
  `CVE-2026-48106` · CVE record: Basekick-Labs arc · CVSS 8.3 High · Not analysed yet · Published 21 Aug 2026 · Tags: Authentication bypass, CWE-345, CWE-924
- [Arc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitive](https://agentprime.io/advisories/CVE-2026-48105.md)
  `CVE-2026-48105` · CVE record: Basekick-Labs arc · CVSS 8.3 High · Not analysed yet · Published 21 Aug 2026 · Tags: Path traversal, CWE-345, CWE-913
- [Charitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass](https://agentprime.io/advisories/CVE-2026-16650.md)
  `CVE-2026-16650` · CVE record: Unknown Charitable · CVSS 5.3 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: CWE-345
- [myCred < 3.2.5 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCRED](https://agentprime.io/advisories/CVE-2026-15150.md)
  `CVE-2026-15150` · CVE record: Unknown myCred · CVSS 5.3 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: CWE-345
- [Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header](https://agentprime.io/advisories/GHSA-f5f4-3hh4-f54m.md)
  `GHSA-f5f4-3hh4-f54m`, `CVE-2026-54167`, `GO-2026-6266` · Go `github.com/openshift-pipelines/pipelines-as-code`: affected `<0.37.8 || >=0.38.0, <0.39.6 || >=0.40.0, <0.42.1 || >=0.43.0, <0.48.0`, fixed in `0.37.8`, `0.39.6`, `0.42.1`, `0.48.0` · CVSS 8.2 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-345
- [Lighthouse: lighthouse: cross-cluster dns spoofing via unvalidated endpointslice ip addresses](https://agentprime.io/advisories/CVE-2026-66787.md)
  `CVE-2026-66787` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16 and 1 more · CVSS 8.7 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-345
- [Submariner: submariner: missing validation of remote endpoint subnets and clusterid enables cross-cluster traffic hijack](https://agentprime.io/advisories/CVE-2026-66785.md)
  `CVE-2026-66785` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16 and 2 more · CVSS 8.7 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-345
- [Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses](https://agentprime.io/advisories/EEF-CVE-2026-53425.md)
  `EEF-CVE-2026-53425`, `CVE-2026-53425` · Hex `samly`: affected `>=0.3.0`, no fixed version yet · CVSS 7.6 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-345
- [EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code execution](https://agentprime.io/advisories/CVE-2026-44725.md)
  `CVE-2026-44725` · CVE record: emqx emqx · CVSS 6.6 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-345, CWE-672
- [Coturn: STUN attributes after MESSAGE-INTEGRITY are processed, letting on-path attackers modify authenticated TURN requests](https://agentprime.io/advisories/CVE-2026-68554.md)
  `CVE-2026-68554` · CVE record: coturn coturn · CVSS 2.3 Low · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-345, CWE-924
- [Triton VM Soundness Vulnerability due to Missing Constraint](https://agentprime.io/advisories/GHSA-vjf8-9fx6-mv6x.md)
  `GHSA-vjf8-9fx6-mv6x`, `RUSTSEC-2021-0156` · crates.io `triton-vm`: affected `>=0.42.0-alpha.4, <4.0.0`, fixed in `4.0.0` · CVSS 4.0, no score published · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-345
- [BetterDesk has a replay behavior vulnerability when devices are deleted](https://agentprime.io/advisories/CVE-2026-50575.md)
  `CVE-2026-50575` · CVE record: UNITRONIX BetterDesk · CVSS 7.7 High · Not analysed yet · Published 18 Aug 2026 · Tags: Authentication bypass, CWE-345, CWE-672
- [Notepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution](https://agentprime.io/advisories/CVE-2026-71858.md)
  `CVE-2026-71858` · CVE record: notepad-plus-plus notepad-plus-plus · CVSS 5.4 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: Command injection, CWE-345, CWE-693
- [Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage](https://agentprime.io/advisories/GHSA-m44r-7c5h-m6mj.md)
  `GHSA-m44r-7c5h-m6mj`, `CVE-2026-53728` · npm `@medplum/core`: affected `<5.1.6`, fixed in `5.1.6` · CVSS 7.1 High · Not analysed yet · Published 17 Aug 2026 · Tags: Open redirect, CWE-345
- [Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier](https://agentprime.io/advisories/CVE-2026-18674.md)
  `CVE-2026-18674` · CVE record: Kong Inc. Kong Mesh · CVSS 7.0 High · Not analysed yet · Published 17 Aug 2026 · Tags: Broken access control, CWE-345
- [openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST_CURRENT_TEST environment va...](https://agentprime.io/advisories/GHSA-rvc2-5jxq-gpcj.md)
  `GHSA-rvc2-5jxq-gpcj`, `CVE-2026-74890`, `PYSEC-2026-3766` · PyPI `openssl-encrypt`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-345
- [openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private n...](https://agentprime.io/advisories/GHSA-2592-7m3g-7fq6.md)
  `GHSA-2592-7m3g-7fq6`, `CVE-2026-74882`, `PYSEC-2026-3744` · PyPI `openssl-encrypt`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 8.7 High · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-345
- [Trigger.dev: Cross-tenant payload poisoning via packet write + replay](https://agentprime.io/advisories/CVE-2026-73657.md)
  `CVE-2026-73657` · CVE record: triggerdotdev trigger.dev · CVSS 4.2 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal, Broken access control, CWE-345
- [WordPress Log in with Google plugin <= 1.4.2 - Broken Authentication vulnerability](https://agentprime.io/advisories/CVE-2026-28185.md)
  `CVE-2026-28185` · CVE record: rtCamp Log in with Google · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-345
- [PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext](https://agentprime.io/advisories/CVE-2026-14663.md)
  `CVE-2026-14663` · CVE record: PostgreSQL · CVSS 6.5 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-313, CWE-345
- [Potential package cache integrity issue in JFrog Artifactory](https://agentprime.io/advisories/CVE-2026-69105.md)
  `CVE-2026-69105` · CVE record: jfrog artifactory · CVSS 8.1 High · Not analysed yet · Published 12 Aug 2026 · Tags: CWE-345
- [Estatik Real Estate Plugin < 4.3.4 - Unauthenticated Arbitrary-Recipient Mail Relay via Signed-Value Mismatch](https://agentprime.io/advisories/CVE-2026-18044.md)
  `CVE-2026-18044` · CVE record: Unknown Estatik Real Estate Plugin · CVSS 3.7 Low · Not analysed yet · Published 12 Aug 2026 · Tags: CWE-345
- [CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to validate the integrity of the DataStore, a non-partitioned filesystem, responsible for storing configuration and cryptographic details.](https://agentprime.io/advisories/CVE-2025-59323.md)
  `CVE-2025-59323` · CVE record · CVSS 8.4 High · Not analysed yet · Published 12 Aug 2026 · Tags: CWE-345
- [Azure Entra ID Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-62869.md)
  `CVE-2026-62869` · CVE record: Microsoft Microsoft Entra · CVSS 8.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-345
- [Insufficient verification of data authenticity in Intel(R) Trust Domain Extensions (Intel(R) TDX)](https://agentprime.io/advisories/CVE-2025-31356.md)
  `CVE-2025-31356` · CVE record: Intel(R) Trust Domain Extensions (Intel(R) TDX) · CVSS 5.6 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-345
- [OpenSignLabs OpenSign - Insufficient Verification of Data Authenticity](https://agentprime.io/advisories/CVE-2026-72544.md)
  `CVE-2026-72544` · CVE record: OpenSignLabs OpenSign · CVSS 7.5 High · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-345
- [CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature](https://agentprime.io/advisories/CVE-2026-71965.md)
  `CVE-2026-71965` · CVE record: usmannasir cyberpanel · CVSS 8.7 High · Not analysed yet · Published 10 Aug 2026 · Tags: CWE-345
- [Multicluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlers](https://agentprime.io/advisories/CVE-2026-71576.md)
  `CVE-2026-71576` · CVE record: Red Hat Multicluster Global Hub 1.4.9 and 4 more · CVSS 8.5 High · Not analysed yet · Published 10 Aug 2026 · Tags: CWE-345
- [Insufficient verification of data authenticity in Samsung Mobile Smart Switch](https://agentprime.io/advisories/CVE-2026-21078.md)
  `CVE-2026-21078` · CVE record: Samsung Mobile Smart Switch · CVSS 4.7 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: CWE-345
- [Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection](https://agentprime.io/advisories/CVE-2026-17011.md)
  `CVE-2026-17011` · CVE record: Unknown Nexter Blocks · CVSS 3.8 Low · Not analysed yet · Published 9 Aug 2026 · Tags: CWE-345
- [Klever-Go: PubKeysBitmap padding bits bypass the BLS signature quorum](https://agentprime.io/advisories/CVE-2026-58262.md)
  `CVE-2026-58262` · CVE record: klever-io klever-go · CVSS 7.1 High · Not analysed yet · Published 7 Aug 2026 · Tags: Weak cryptography or TLS, CWE-345
- [Pathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoning](https://agentprime.io/advisories/CVE-2026-47664.md)
  `CVE-2026-47664` · CVE record: aehrc pathling · CVSS 8.6 High · Not analysed yet · Published 7 Aug 2026 · Tags: Server-side request forgery (SSRF), CWE-20, CWE-345
- [Simple CAPTCHA with Cloudflare Turnstile < 1.42.0 - Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache Key](https://agentprime.io/advisories/CVE-2026-15239.md)
  `CVE-2026-15239` · CVE record: Unknown Simple CAPTCHA with Cloudflare Turnstile · CVSS 5.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: CWE-345
- [Subscriptions for WooCommerce < 2.0.1 - Payment Bypass via Attacker-Supplied PayPal Capture Token](https://agentprime.io/advisories/CVE-2026-15211.md)
  `CVE-2026-15211` · CVE record: Unknown Subscriptions for WooCommerce · CVSS 5.9 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: CWE-345
- [WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR](https://agentprime.io/advisories/CVE-2026-15148.md)
  `CVE-2026-15148` · CVE record: Unknown WP Events Manager · CVSS 5.3 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: CWE-345
- [RegistrationMagic < 6.0.9.5 - Unauthenticated Payment Bypass via Amount-Blind PayPal Verification](https://agentprime.io/advisories/CVE-2026-15208.md)
  `CVE-2026-15208` · CVE record: Unknown RegistrationMagic · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-345
- [Five Star Restaurant Reservations < 2.7.23 - Unauthenticated Payment Bypass and Booking Confirmation via IDOR](https://agentprime.io/advisories/CVE-2026-15147.md)
  `CVE-2026-15147` · CVE record: Unknown Five Star Restaurant Reservations · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Broken access control, CWE-345
- [Simple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification](https://agentprime.io/advisories/CVE-2026-14936.md)
  `CVE-2026-14936` · CVE record: Unknown Simple Membership · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-345
- [Insufficient verification of lifetime-deal redemption codes allows forgery of permanent paid subscriptions](https://agentprime.io/advisories/CVE-2026-19127.md)
  `CVE-2026-19127` · CVE record: GitroomHQ postiz-app · CVSS 6.5 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-345
- [GetPaid < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verification](https://agentprime.io/advisories/CVE-2026-12901.md)
  `CVE-2026-12901` · CVE record: Unknown GetPaid · CVSS 5.9 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-345
- [WP Travel Engine < 6.8.2 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver and Amount Verification](https://agentprime.io/advisories/CVE-2026-12501.md)
  `CVE-2026-12501` · CVE record: Unknown WP Travel Engine · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-345
- [WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass](https://agentprime.io/advisories/CVE-2026-15152.md)
  `CVE-2026-15152` · CVE record: Unknown WP Hotel Booking · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-345
- [Insta InstaKNXServiceApp Firmware Update CreateWebClientAndDownloadFileList data authenticity](https://agentprime.io/advisories/CVE-2026-19061.md)
  `CVE-2026-19061` · CVE record: Insta InstaKNXServiceApp · CVSS 6.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-345
- [Traefik: Incomplete fix for CVE-2026-33433 + CVE-2026-39858 cross-cohort: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth](https://agentprime.io/advisories/GHSA-x677-9fxg-v5c5.md)
  `GHSA-x677-9fxg-v5c5`, `CVE-2026-54763`, `GO-2026-6211` · Go `github.com/traefik/traefik/v2` and 1 more: affected `<2.11.51`, fixed in `2.11.51` · CVSS 7.8 High · Not analysed yet · Published 6 Aug 2026 · Tags: Authentication bypass, CWE-178, CWE-345
- [Formidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription Status](https://agentprime.io/advisories/CVE-2026-11361.md)
  `CVE-2026-11361` · CVE record: Unknown Formidable Forms · CVSS 5.9 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-345
- [Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse](https://agentprime.io/advisories/CVE-2026-10599.md)
  `CVE-2026-10599` · CVE record: Unknown Integrate PhonePe with WooCommerce · CVSS 7.5 High · Not analysed yet · Published 6 Aug 2026 · Tags: Broken access control, CWE-345
- [Traefik: ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false](https://agentprime.io/advisories/GHSA-3q9r-p662-5j8m.md)
  `GHSA-3q9r-p662-5j8m`, `CVE-2026-54764`, `GO-2026-6202` · Go `github.com/traefik/traefik` and 2 more: affected `<=1.7.34`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-345
- [RealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment Bypass](https://agentprime.io/advisories/CVE-2026-15246.md)
  `CVE-2026-15246` · CVE record: Unknown RealHomes Memberships · CVSS 4.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Broken access control, CWE-345
- [Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters](https://agentprime.io/advisories/CVE-2026-63687.md)
  `CVE-2026-63687` · CVE record: Apache Software Foundation Apache CXF · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-345

Newest: <https://agentprime.io/advisories/tag/cwe-345.md>
Older: <https://agentprime.io/advisories/tag/cwe-345.md?cursor=WyIyMDI2LTA4LTA2VDExOjIzOjQ1LjE3NTAwMFoiLCJDVkUtMjAyNi02MzY4NyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-345&cursor=WyIyMDI2LTA4LTI5VDE2OjM1OjI4LjMyMTAwMFoiLCJDVkUtMjAyNi04MjQ2NSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-345/?cursor=WyIyMDI2LTA4LTI5VDE2OjM1OjI4LjMyMTAwMFoiLCJDVkUtMjAyNi04MjQ2NSJd>. Everything for agents: <https://agentprime.io/llms.txt>.