agentprime: CWE-345Every new CWE-345 Advisory and CVE.https://agentprime.io/CVE-2026-88982: Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)https://agentprime.io/advisories/CVE-2026-88982/https://agentprime.io/advisories/CVE-2026-88982/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 22:25:58 GMTCVECVE-2026-115770: Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofinghttps://agentprime.io/advisories/CVE-2026-115770/https://agentprime.io/advisories/CVE-2026-115770/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 22:32:18 GMTCVEcriticalCVE-2026-121637: WatchGuard AuthPoint Gateway Improper HMAC Validation in LDAP Authentication Callback Allows Forged Authentication Resultshttps://agentprime.io/advisories/CVE-2026-121637/https://agentprime.io/advisories/CVE-2026-121637/CVSS 8.9 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 14:44:14 GMTCVECVE-2026-121620: CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verificationhttps://agentprime.io/advisories/CVE-2026-121620/https://agentprime.io/advisories/CVE-2026-121620/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 12:38:54 GMTCVECVE-2026-121606: Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verificationhttps://agentprime.io/advisories/CVE-2026-121606/https://agentprime.io/advisories/CVE-2026-121606/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 01:00:26 GMTCVEcriticalCVE-2022-30267: Emerson Ovation Insufficient Verification of Data Authenticityhttps://agentprime.io/advisories/CVE-2022-30267/https://agentprime.io/advisories/CVE-2022-30267/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 23:03:12 GMTCVECVE-2026-121545: Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handlerhttps://agentprime.io/advisories/CVE-2026-121545/https://agentprime.io/advisories/CVE-2026-121545/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 15:17:05 GMTCVECVE-2026-91075: Eupago Gateway For Woocommerce 4.5.0 - 4.7.5 - Unauthenticated Payment Confirmation Bypasshttps://agentprime.io/advisories/CVE-2026-91075/https://agentprime.io/advisories/CVE-2026-91075/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 08:20:22 GMTCVECVE-2026-103327: CryptoCloud - Crypto Payment Gateway 3.0.0 - 3.0.1 - Unauthenticated Arbitrary Order Payment Forgery via Empty-Default Webhook Secrethttps://agentprime.io/advisories/CVE-2026-103327/https://agentprime.io/advisories/CVE-2026-103327/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 08:20:21 GMTCVECVE-2026-119731: Munshi Payment Bypass via Unauthenticated Webhook Endpointhttps://agentprime.io/advisories/CVE-2026-119731/https://agentprime.io/advisories/CVE-2026-119731/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 18:54:28 GMTCVECVE-2026-103310: PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass via Unverified Payment Notificationhttps://agentprime.io/advisories/CVE-2026-103310/https://agentprime.io/advisories/CVE-2026-103310/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 07:10:35 GMTCVECVE-2026-120317: http4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrityhttps://agentprime.io/advisories/CVE-2026-120317/https://agentprime.io/advisories/CVE-2026-120317/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 02:01:15 GMTCVECVE-2026-63115: ActivityPub Undo handler can unfollow or remove reposts on behalf of other accountshttps://agentprime.io/advisories/CVE-2026-63115/https://agentprime.io/advisories/CVE-2026-63115/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 21:33:55 GMTCVECVE-2026-119289: Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gatehttps://agentprime.io/advisories/CVE-2026-119289/https://agentprime.io/advisories/CVE-2026-119289/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 15:48:59 GMTCVECVE-2026-119422: Hyperswitch before 1.128.0 Webhook Authentication Bypass via Worldpayxml Connectorhttps://agentprime.io/advisories/CVE-2026-119422/https://agentprime.io/advisories/CVE-2026-119422/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 11:30:52 GMTCVECVE-2026-93008: Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurationshttps://agentprime.io/advisories/CVE-2026-93008/https://agentprime.io/advisories/CVE-2026-93008/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 12:33:22 GMTCVEPython Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victimhttps://agentprime.io/advisories/GHSA-h2r5-x5m7-3935/https://agentprime.io/advisories/GHSA-h2r5-x5m7-3935/social-auth-core <6.2.0, fixed in 6.2.0. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Wed, 28 Oct 2026 21:16:51 GMTPyPIsocial-auth-corefilelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable markerhttps://agentprime.io/advisories/GHSA-rfpc-qcw5-3pc4/https://agentprime.io/advisories/GHSA-rfpc-qcw5-3pc4/filelock >=3.22.0, <4.2.1, fixed in 4.2.1. CVSS 4.7 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Wed, 28 Oct 2026 21:08:45 GMTPyPIfilelockCVE-2026-110985: Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configuredhttps://agentprime.io/advisories/CVE-2026-110985/https://agentprime.io/advisories/CVE-2026-110985/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 16:37:45 GMTCVEcriticalCVE-2026-110952: Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by defaulthttps://agentprime.io/advisories/CVE-2026-110952/https://agentprime.io/advisories/CVE-2026-110952/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 16:37:34 GMTCVECVE-2026-103402: Session Smart Router and Session Smart Conductor: Lack of integrity verification in cache files causes arbitrary code execution and privilege escalationhttps://agentprime.io/advisories/CVE-2026-103402/https://agentprime.io/advisories/CVE-2026-103402/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 16:34:58 GMTCVECVE-2026-103330: Sadad QA Payment 1.28 - Unauthenticated Arbitrary Order Payment Confirmation via Signature Bypasshttps://agentprime.io/advisories/CVE-2026-103330/https://agentprime.io/advisories/CVE-2026-103330/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 10:45:12 GMTCVECVE-2026-103313: BitPay Gateway for WooCommerce <= 4.1.3 - Unauthenticated Payment Bypass via Payment Return Handlerhttps://agentprime.io/advisories/CVE-2026-103313/https://agentprime.io/advisories/CVE-2026-103313/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 10:45:11 GMTCVECVE-2026-118377: mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbackshttps://agentprime.io/advisories/CVE-2026-118377/https://agentprime.io/advisories/CVE-2026-118377/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 02:03:24 GMTCVECVE-2026-104381: Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Servicehttps://agentprime.io/advisories/CVE-2026-104381/https://agentprime.io/advisories/CVE-2026-104381/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 15:52:27 GMTCVEbetter-auth: OAuth Proxy lets an attacker sign in as another userhttps://agentprime.io/advisories/GHSA-r4xp-prcw-77qf/https://agentprime.io/advisories/GHSA-r4xp-prcw-77qf/better-auth >=1.5.0-beta.12, <1.7.7, fixed in 1.7.7. CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 27 Oct 2026 15:32:16 GMTnpmbetter-authcriticalLiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Keyhttps://agentprime.io/advisories/GHSA-7hp6-4w63-5g45/https://agentprime.io/advisories/GHSA-7hp6-4w63-5g45/litellm >=1.91.0, <1.100.4 || >=1.101.0, <1.101.3 || >=1.102.0, <1.102.2 || >=1.103.0, <1.103.1 || >=1.104.0rc1, <1.104.0rc2, fixed in 1.100.4, 1.101.3, 1.102.2, 1.103.1, 1.104.0rc2. CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 27 Oct 2026 15:04:14 GMTPyPIlitellmcriticalCVE-2026-115408: ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secretshttps://agentprime.io/advisories/CVE-2026-115408/https://agentprime.io/advisories/CVE-2026-115408/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 11:55:15 GMTCVECVE-2026-103359: PayDunya WooCommerce Payment Gateway 1.1.6 - Unauthenticated Order Payment Completion via Webhook Forgeryhttps://agentprime.io/advisories/CVE-2026-103359/https://agentprime.io/advisories/CVE-2026-103359/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 06:42:43 GMTCVECVE-2026-116608: DAMO Academy VideoLLaMA2 Model Loading __init__.py load_pretrained_model integrity checkhttps://agentprime.io/advisories/CVE-2026-116608/https://agentprime.io/advisories/CVE-2026-116608/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 00:15:18 GMTCVECVE-2026-116254: rathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validationhttps://agentprime.io/advisories/CVE-2026-116254/https://agentprime.io/advisories/CVE-2026-116254/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 26 Oct 2026 09:45:18 GMTCVECVE-2026-103300: Eurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified Callbackhttps://agentprime.io/advisories/CVE-2026-103300/https://agentprime.io/advisories/CVE-2026-103300/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 26 Oct 2026 07:05:40 GMTCVECVE-2026-116116: Yoosee GM8135S Camera Secure Boot signature verificationhttps://agentprime.io/advisories/CVE-2026-116116/https://agentprime.io/advisories/CVE-2026-116116/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 26 Oct 2026 04:00:19 GMTCVEcriticalCVE-2026-115183: Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widgethttps://agentprime.io/advisories/CVE-2026-115183/https://agentprime.io/advisories/CVE-2026-115183/CVSS 2.4 (Low). Published by the CVE Program. Not analysed by agentprime yet.Sun, 25 Oct 2026 06:00:21 GMTCVECVE-2026-115933: Forged signed tokens let any registered user take over other users and organizationshttps://agentprime.io/advisories/CVE-2026-115933/https://agentprime.io/advisories/CVE-2026-115933/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sat, 24 Oct 2026 14:17:05 GMTCVEcriticalCVE-2026-115937: Unauthenticated payment reuse allows unpaid orders to be marked as paidhttps://agentprime.io/advisories/CVE-2026-115937/https://agentprime.io/advisories/CVE-2026-115937/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 21:50:13 GMTCVEchi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-Forhttps://agentprime.io/advisories/GHSA-j6qf-3m9c-vwj3/https://agentprime.io/advisories/GHSA-j6qf-3m9c-vwj3/github.com/go-chi/chi/v5 <5.4.0, fixed in 5.4.0. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 23 Oct 2026 20:56:46 GMTGogithub.com/go-chi/chi/v5vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM enginehttps://agentprime.io/advisories/GHSA-p92p-rxj5-7p2x/https://agentprime.io/advisories/GHSA-p92p-rxj5-7p2x/vllm <0.31.0, fixed in 0.31.0. CVSS 7.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 23 Oct 2026 20:43:44 GMTPyPIvllmSiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted pluginhttps://agentprime.io/advisories/GHSA-rpx2-p6hp-x5gj/https://agentprime.io/advisories/GHSA-rpx2-p6hp-x5gj/github.com/siyuan-note/siyuan/kernel <0.0.0-20260808010544-26ccb40d390e, fixed in 0.0.0-20260808010544-26ccb40d390e. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 23 Oct 2026 18:38:25 GMTGogithub.com/siyuan-note/siyuan/kernelCVE-2026-55459: Goobi viewer: OpenID JWT audience not enforced by the verifierhttps://agentprime.io/advisories/CVE-2026-55459/https://agentprime.io/advisories/CVE-2026-55459/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 14:16:44 GMTCVECVE-2026-110510: Essential Addons for Elementor < 6.8.7 - Author+ Content Injection via Pricing Table and Post Timeline Title Taghttps://agentprime.io/advisories/CVE-2026-110510/https://agentprime.io/advisories/CVE-2026-110510/CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 06:00:18 GMTCVECVE-2026-105256: LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameterhttps://agentprime.io/advisories/CVE-2026-105256/https://agentprime.io/advisories/CVE-2026-105256/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 08:38:58 GMTCVECVE-2026-104642: Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verification Bypasshttps://agentprime.io/advisories/CVE-2026-104642/https://agentprime.io/advisories/CVE-2026-104642/CVSS 2.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 08:38:57 GMTCVECVE-2026-104641: Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Recipienthttps://agentprime.io/advisories/CVE-2026-104641/https://agentprime.io/advisories/CVE-2026-104641/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 08:38:56 GMTCVECVE-2026-103301: Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secrethttps://agentprime.io/advisories/CVE-2026-103301/https://agentprime.io/advisories/CVE-2026-103301/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 08:38:56 GMTCVEDuplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronizationhttps://agentprime.io/advisories/GHSA-hfwf-hgvp-4rr8/https://agentprime.io/advisories/GHSA-hfwf-hgvp-4rr8/vllm *, no fixed version yet. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Wed, 21 Oct 2026 03:32:14 GMTPyPIvllmCVE-2026-91588: Insufficient verification of data authenticity in Oracle Corporation Oracle Business Intelligence Enterprise Editionhttps://agentprime.io/advisories/CVE-2026-91588/https://agentprime.io/advisories/CVE-2026-91588/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 21:26:35 GMTCVECVE-2026-87414: Insufficient verification of data authenticity in Oracle Corporation Oracle Solarishttps://agentprime.io/advisories/CVE-2026-87414/https://agentprime.io/advisories/CVE-2026-87414/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 21:24:34 GMTCVECVE-2026-113205: Insufficient verification of data authenticity in Google Chromehttps://agentprime.io/advisories/CVE-2026-113205/https://agentprime.io/advisories/CVE-2026-113205/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 21:02:10 GMTCVECVE-2026-43835: Insufficient verification of data authenticity in Advantech ADAM-3600https://agentprime.io/advisories/CVE-2026-43835/https://agentprime.io/advisories/CVE-2026-43835/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 08:02:58 GMTCVE