# CWE-346.

Every Advisory and CVE whose sources give the weakness CWE-346, newest first.

## Records, newest first (an older page)

- [ericc-ch copilot-api Token Endpoint server.ts cors cross-domain policy](https://agentprime.io/advisories/CVE-2026-6662.md)
  `CVE-2026-6662` · CVE record: ericc-ch copilot-api · CVSS 6.9 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: CWE-346, CWE-942
- [pyLoad has a Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition)](https://agentprime.io/advisories/GHSA-mp82-fmj6-f22v.md)
  `GHSA-mp82-fmj6-f22v`, `CVE-2026-40594`, `PYSEC-2026-125` · PyPI `pyload-ng`: affected `<0.5.0b3.dev98`, fixed in `0.5.0b3.dev98` · CVSS 4.8 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: CWE-346
- [WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses](https://agentprime.io/advisories/GHSA-ff5q-cc22-fgp4.md)
  `GHSA-ff5q-cc22-fgp4`, `CVE-2026-41057`, `PKSA-tsyg-vszv-9tkz` · Packagist `wwbn/avideo`: affected `<=29.0`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-346
- [farion1231 cc-switch ProxyServer server.rs cross-domain policy](https://agentprime.io/advisories/CVE-2026-6143.md)
  `CVE-2026-6143` · CVE record: farion1231 cc-switch · CVSS 5.3 Medium · Not analysed yet · Published 13 Apr 2026 · Tags: CWE-346, CWE-942
- [Missing Host Header Validation in Apollo MCP Server for Localhost Deployments](https://agentprime.io/advisories/CVE-2026-35577.md)
  `CVE-2026-35577` · CVE record: apollographql apollo-mcp-server · CVSS 6.8 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-346
- [Cross-site request forgery in Google Chrome](https://agentprime.io/advisories/CVE-2026-5918.md)
  `CVE-2026-5918` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-5899.md)
  `CVE-2026-5899` · CVE record: Google Chrome · CVSS 6.1 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-346
- [Zammad has an origin validation error in SSO mechanism](https://agentprime.io/advisories/CVE-2026-34720.md)
  `CVE-2026-34720` · CVE record: zammad zammad · CVSS 2.3 Low · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-346
- [Java-SDK has a DNS Rebinding Vulnerability](https://agentprime.io/advisories/GHSA-8jxr-pr72-r468.md)
  `GHSA-8jxr-pr72-r468`, `CVE-2026-35568` · Maven `io.modelcontextprotocol.sdk:mcp-core`: affected `<1.0.0`, fixed in `1.0.0` · CVSS 7.6 High · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-346
- [OpenClaw: iOS A2UI bridge trusted generic local-network pages for agent.request dispatch](https://agentprime.io/advisories/GHSA-4p4f-fc8q-84m3.md)
  `GHSA-4p4f-fc8q-84m3`, `CVE-2026-41398` · npm `openclaw`: affected `<2026.4.2`, fixed in `2026.4.2` · CVSS 2.1 Low · Not analysed yet · Published 7 Apr 2026 · Tags: Broken access control, CWE-346
- [Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim](https://agentprime.io/advisories/GHSA-5v8v-xvjv-57x7.md)
  `GHSA-5v8v-xvjv-57x7`, `CVE-2026-37977` · Maven `org.keycloak:keycloak-services`: affected `<26.4.13 || >=26.5.0, <26.6.3`, fixed in `26.4.13`, `26.6.3` · CVSS 3.7 Low · Not analysed yet · Published 6 Apr 2026 · Tags: CWE-346
- [Directus: Missing Cross-Origin Opener Policy](https://agentprime.io/advisories/GHSA-8m32-p958-jg99.md)
  `GHSA-8m32-p958-jg99`, `CVE-2026-35408` · npm `directus`: affected `<11.17.0`, fixed in `11.17.0` · CVSS 8.7 High · Not analysed yet · Published 4 Apr 2026 · Tags: CWE-346, CWE-693
- [Signal K Server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC Flow](https://agentprime.io/advisories/GHSA-cxj8-ggf2-p57c.md)
  `GHSA-cxj8-ggf2-p57c`, `CVE-2026-34083` · npm `signalk-server`: affected `>=2.20.0, <2.24.0`, fixed in `2.24.0` · CVSS 6.1 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Open redirect, CWE-346
- [OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration](https://agentprime.io/advisories/GHSA-q9w8-cf67-r238.md)
  `GHSA-q9w8-cf67-r238`, `CVE-2026-41393` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 5.9 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-346, CWE-350
- [OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode](https://agentprime.io/advisories/GHSA-mhr7-2xmv-4c4q.md)
  `GHSA-mhr7-2xmv-4c4q`, `CVE-2026-41347` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 2.3 Low · Not analysed yet · Published 3 Apr 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [Electron: Incorrect origin passed to permission request handler for iframe requests](https://agentprime.io/advisories/GHSA-r5p7-gp4j-qhrx.md)
  `GHSA-r5p7-gp4j-qhrx`, `CVE-2026-34777` · npm `electron`: affected `<38.8.6 || >=39.0.0-alpha.1, <39.8.1 || >=40.0.0-alpha.1, <40.8.1 || >=41.0.0-alpha.1, <41.0.0`, fixed in `38.8.6`, `39.8.1`, `40.8.1`, `41.0.0` · CVSS 5.4 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-346
- [OpenClaw: Matrix thread root and reply context bypass sender allowlist](https://agentprime.io/advisories/GHSA-rg8m-3943-vm6q.md)
  `GHSA-rg8m-3943-vm6q`, `CVE-2026-41376` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 2.3 Low · Not analysed yet · Published 2 Apr 2026 · Tags: Broken access control, CWE-346
- [vanna-ai vanna FastAPI/Flask Server cross-domain policy](https://agentprime.io/advisories/CVE-2026-5321.md)
  `CVE-2026-5321` · CVE record: vanna-ai vanna · CVSS 5.3 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-346, CWE-942
- [Cross-site request forgery in Google Chrome](https://agentprime.io/advisories/CVE-2026-5283.md)
  `CVE-2026-5283` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: Broken access control, Cross-site request forgery (CSRF), CWE-346
- [OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials](https://agentprime.io/advisories/GHSA-3cw3-5vxw-g2h3.md)
  `GHSA-3cw3-5vxw-g2h3`, `CVE-2026-41342` · npm `openclaw`: affected `<2026.3.28`, fixed in `2026.3.28` · CVSS 7.4 High · Not analysed yet · Published 31 Mar 2026 · Tags: Authentication bypass, Broken access control, CWE-346
- [GraphQL API endpoint ignores CORS origin restriction](https://agentprime.io/advisories/GHSA-q3p6-g7c4-829c.md)
  `GHSA-q3p6-g7c4-829c`, `BIT-parse-2026-34373`, `CVE-2026-34373` · npm `parse-server`: affected `>=3.5.0, <8.6.66 || >=9.0.0, <9.7.0-alpha.10`, fixed in `8.6.66`, `9.7.0-alpha.10` · CVSS 5.3 Medium · Not analysed yet · Published 30 Mar 2026 · Tags: CWE-346
- [HAPI FHIR Core has Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect](https://agentprime.io/advisories/GHSA-fgv2-4q4g-wc35.md)
  `GHSA-fgv2-4q4g-wc35`, `CVE-2026-34359` · Maven `ca.uhn.hapi.fhir:org.hl7.fhir.core` and 1 more: affected `<6.9.4`, fixed in `6.9.4` · CVSS 7.4 High · Not analysed yet · Published 30 Mar 2026 · Tags: CWE-346
- [CoCoS attested TLS is vulnerable to relay attacks via extracted ephemeral TLS keys](https://agentprime.io/advisories/CVE-2026-33697.md)
  `CVE-2026-33697` · CVE record: ultravioletrs cocos · CVSS 7.5 High · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-322, CWE-346
- [@grackle-ai/server has Missing WebSocket Origin Header Validation](https://agentprime.io/advisories/GHSA-w3hv-x4fp-6h6j.md)
  `GHSA-w3hv-x4fp-6h6j` · npm `@grackle-ai/server`: affected `<0.70.3`, fixed in `0.70.3` · CVSS 4.0, no score published · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-346
- [Cross-site scripting in Apple Safari and others](https://agentprime.io/advisories/CVE-2026-28861.md)
  `CVE-2026-28861` · CVE record: Apple Safari and 3 more · CVSS 4.3 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: Cross-site scripting (XSS), CWE-346
- [HCL Traveler is susceptible to a weak default HTTP header validation vulnerability](https://agentprime.io/advisories/CVE-2026-21790.md)
  `CVE-2026-21790` · CVE record: HCLSoftware Traveler · CVSS 6.3 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-346
- [Cryptomator for Android: Tampered vault configuration allows MITM attack on Hub API](https://agentprime.io/advisories/CVE-2026-32317.md)
  `CVE-2026-32317` · CVE record: cryptomator android · CVSS 7.6 High · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-346, CWE-354, CWE-451, CWE-923
- [Cryptomator for IOS: Tampered vault configuration allows MITM attack on Hub API](https://agentprime.io/advisories/CVE-2026-32318.md)
  `CVE-2026-32318` · CVE record: cryptomator ios · CVSS 7.6 High · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-346, CWE-354, CWE-451, CWE-923
- [Cryptomator: Tampered vault configuration allows MITM attack on Hub API](https://agentprime.io/advisories/CVE-2026-32303.md)
  `CVE-2026-32303` · CVE record: cryptomator cryptomator · CVSS 7.6 High · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-346, CWE-354, CWE-451, CWE-923
- [Improper Authentication and Origin Validation Error in pyload-ng](https://agentprime.io/advisories/GHSA-q485-cg9q-xq2r.md)
  `GHSA-q485-cg9q-xq2r`, `CVE-2026-33314`, `PYSEC-2026-122` · PyPI `pyload-ng`: affected `<0.5.0b3.dev97`, fixed in `0.5.0b3.dev97` · CVSS 6.5 Medium · Not analysed yet · Published 19 Mar 2026 · Tags: Authentication bypass, CWE-346
- [Jenkins has a DNS rebinding vulnerability in WebSocket CLI origin validation](https://agentprime.io/advisories/GHSA-phhv-63fh-rrc8.md)
  `GHSA-phhv-63fh-rrc8`, `BIT-jenkins-2026-33002`, `CVE-2026-33002` · Maven `org.jenkins-ci.main:jenkins-core`: affected `>=2.442, <2.555`, fixed in `2.555` · CVSS 7.5 High · Not analysed yet · Published 18 Mar 2026 · Tags: CWE-346, CWE-350
- [Improper input validation in Apple Safari and others](https://agentprime.io/advisories/CVE-2026-20643.md)
  `CVE-2026-20643` · CVE record: Apple Safari and 3 more · CVSS 5.4 Medium · Not analysed yet · Published 17 Mar 2026 · Tags: CWE-20, CWE-346
- [Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers](https://agentprime.io/advisories/GHSA-vx5f-957p-qpvm.md)
  `GHSA-vx5f-957p-qpvm`, `CVE-2026-32634`, `PYSEC-2026-2172` · PyPI `glances`: affected `<4.5.2`, fixed in `4.5.2` · CVSS 8.1 High · Not analysed yet · Published 16 Mar 2026 · Tags: Hard-coded credentials, CWE-346
- [Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding](https://agentprime.io/advisories/GHSA-hhcg-r27j-fhv9.md)
  `GHSA-hhcg-r27j-fhv9`, `CVE-2026-32632`, `PYSEC-2026-2171` · PyPI `glances`: affected `<4.5.2`, fixed in `4.5.2` · CVSS 5.9 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-346
- [Mattermost allows attackers to spoof permalink embeds](https://agentprime.io/advisories/GHSA-ph22-fw5m-w2q9.md)
  `GHSA-ph22-fw5m-w2q9`, `CVE-2026-2457`, `GO-2026-4732` · Go `github.com/mattermost/mattermost-server` and 1 more: affected `<5.3.2-0.20260123211116-9efe617be8b8 || >=10.11.0-rc1, <10.11.11 || >=11.2.0-rc1, <11.2.3 || >=11.3.0-rc1, <11.3.1`, fixed in `5.3.2-0.20260123211116-9efe617be8b8`, `10.11.11`, `11.2.3`, `11.3.1` · CVSS 4.3 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-346
- [OpenClaw: Untrusted web origins can obtain authenticated operator.admin access in trusted-proxy mode](https://agentprime.io/advisories/GHSA-5wcw-8jjv-m286.md)
  `GHSA-5wcw-8jjv-m286`, `CVE-2026-32302` · npm `openclaw`: affected `<2026.3.11`, fixed in `2026.3.11` · CVSS 8.1 High · Not analysed yet · Published 12 Mar 2026 · Tags: CWE-346
- [Same-origin policy bypass in the CSS Parsing and Computation component](https://agentprime.io/advisories/CVE-2026-3846.md)
  `CVE-2026-3846` · CVE record: Mozilla Firefox · CVSS 6.5 Medium · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-346
- [Webauthn Framework: allowed_origins collapses URL-like origins to host-only values, bypassing exact origin validation](https://agentprime.io/advisories/GHSA-f7pm-6hr8-7ggm.md)
  `GHSA-f7pm-6hr8-7ggm`, `CVE-2026-30964`, `PKSA-1sct-n8q3-hf7r`, `PKSA-mvry-7c68-swp2`, `PKSA-n72g-8zd8-6dm2` · Packagist `web-auth/webauthn-framework` and 2 more: affected `>=5.2.0, <5.2.4`, fixed in `5.2.4` · CVSS 5.4 Medium · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-346
- [Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass](https://agentprime.io/advisories/GHSA-rv5f-ccpm-xjj4.md)
  `GHSA-rv5f-ccpm-xjj4`, `CVE-2026-25604`, `PYSEC-2026-2363` · PyPI `apache-airflow-providers-amazon`: affected `<9.22.0`, fixed in `9.22.0` · CVSS 5.4 Medium · Not analysed yet · Published 9 Mar 2026 · Tags: CWE-346
- [Dark Reader gives users the ability to request style sheets from local web servers](https://agentprime.io/advisories/GHSA-x369-mcw8-8rvj.md)
  `GHSA-x369-mcw8-8rvj`, `CVE-2025-68467` · npm `darkreader`: affected `<4.9.117`, fixed in `4.9.117` · CVSS 3.4 Low · Not analysed yet · Published 4 Mar 2026 · Tags: Information disclosure, CWE-346
- [OpenClaw's browser-origin WebSocket auth hardening gap could enable loopback password brute-force chains](https://agentprime.io/advisories/GHSA-jmmg-jqc7-5qf4.md)
  `GHSA-jmmg-jqc7-5qf4`, `CVE-2026-32025` · npm `openclaw`: affected `<2026.2.25`, fixed in `2026.2.25` · CVSS 7.5 High · Not analysed yet · Published 3 Mar 2026 · Tags: Authentication bypass, CWE-346
- [Textream Cross-Site WebSocket Hijacking (CSWSH) vulnerability](https://agentprime.io/advisories/CVE-2026-28403.md)
  `CVE-2026-28403` · CVE record: f textream · CVSS 7.6 High · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-346
- [calibre has IP Ban Bypass via X-Forwarded-For Header Spoofing](https://agentprime.io/advisories/CVE-2026-27824.md)
  `CVE-2026-27824` · CVE record: kovidgoyal calibre · CVSS 5.3 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Authentication bypass, CWE-346
- [CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function](https://agentprime.io/advisories/GHSA-j5mf-6rh3-rhgg.md)
  `GHSA-j5mf-6rh3-rhgg`, `CVE-2026-26861` · npm `clevertap-web-sdk`: affected `<1.15.3`, fixed in `1.15.3` · CVSS 8.3 High · Not analysed yet · Published 27 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-346
- [Storybook Dev Server is Vulnerable to WebSocket Hijacking](https://agentprime.io/advisories/GHSA-mjf5-7g4m-gx5w.md)
  `GHSA-mjf5-7g4m-gx5w`, `CVE-2026-27148` · npm `storybook`: affected `>=8.1.0, <8.6.17 || >=8.7.0-alpha.0, <9.1.19 || >=10.0.0-beta.0, <10.2.10`, fixed in `8.6.17`, `9.1.19`, `10.2.10` · CVSS 8.9 High · Not analysed yet · Published 26 Feb 2026 · Tags: Other injection, Cross-site scripting (XSS), CWE-346, CWE-1385
- [Origin validation error in Genetec Inc. Genetec Update Service](https://agentprime.io/advisories/CVE-2025-1787.md)
  `CVE-2025-1787` · CVE record: Genetec Inc. Genetec Update Service · CVSS 5.8 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: CWE-346
- [Same-origin policy bypass in the Networking: JAR component](https://agentprime.io/advisories/CVE-2026-2790.md)
  `CVE-2026-2790` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 24 Feb 2026 · Tags: CWE-346
- [Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm](https://agentprime.io/advisories/GHSA-c3f3-cc42-xr9v.md)
  `GHSA-c3f3-cc42-xr9v`, `CVE-2026-23552` · Maven `org.apache.camel:camel-keycloak`: affected `>=4.15.0, <4.18.0`, fixed in `4.18.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Feb 2026 · Tags: CWE-346
- [CollabPlatform : CORS Misconfiguration Allows Arbitrary Origin With Credentials Leading to Authenticated Account Data Exposure](https://agentprime.io/advisories/CVE-2026-27579.md)
  `CVE-2026-27579` · CVE record: karnop realtime-collaboration-platform · CVSS 7.4 High · Not analysed yet · Published 21 Feb 2026 · Tags: CWE-346, CWE-942
- [Feathers has an origin validation bypass via prefix matching](https://agentprime.io/advisories/GHSA-mp4x-c34x-wv3x.md)
  `GHSA-mp4x-c34x-wv3x`, `CVE-2026-27192` · npm `@feathersjs/authentication-oauth`: affected `<5.0.40`, fixed in `5.0.40` · CVSS 7.6 High · Not analysed yet · Published 19 Feb 2026 · Tags: CWE-346
- [Cache poisoning in @sveltejs/adapter-vercel](https://agentprime.io/advisories/GHSA-9pq4-5hcf-288c.md)
  `GHSA-9pq4-5hcf-288c`, `CVE-2026-27118` · npm `@sveltejs/adapter-vercel`: affected `<6.3.2`, fixed in `6.3.2` · CVSS 5.3 Medium · Not analysed yet · Published 19 Feb 2026 · Tags: CWE-346
- [OpenClaw session tool visibility hardening and Telegram webhook secret fallback](https://agentprime.io/advisories/GHSA-6hf3-mhgc-cm65.md)
  `GHSA-6hf3-mhgc-cm65`, `CVE-2026-27004` · npm `openclaw`: affected `<2026.2.15`, fixed in `2026.2.15` · CVSS 6.9 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Information disclosure, CWE-346
- [Insufficient Origin Validation in Proctorio Chrome Extension postMessage Handlers](https://agentprime.io/advisories/CVE-2026-2345.md)
  `CVE-2026-2345` · CVE record: Proctorio Secure Exam Proctor Extension · CVSS 3.6 Low · Not analysed yet · Published 11 Feb 2026 · Tags: CWE-346
- [Origin Validation Error in GitLab](https://agentprime.io/advisories/CVE-2025-7659.md)
  `CVE-2025-7659` · CVE record: GitLab GitLab · CVSS 8.0 High · Not analysed yet · Published 11 Feb 2026 · Tags: CWE-346
- [Certain HP OfficeJet Pro Printers - Information Disclosure](https://agentprime.io/advisories/CVE-2026-1997.md)
  `CVE-2026-1997` · CVE record: HP Inc HP OfficeJet Pro 8730 All-in-One Printer and 4 more · CVSS 6.9 Medium · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-346
- [Multiple Innomic VibroLine VLX and avibia AVLX allow unauthenticated access to device configuration](https://agentprime.io/advisories/CVE-2022-50975.md)
  `CVE-2022-50975` · CVE record: Innomic VibroLine VLX1 HD 5.0 and 4 more · CVSS 8.8 High · Not analysed yet · Published 2 Feb 2026 · Tags: CWE-346
- [AliasVault is Missing Origin Validation in Android Passkey Credential Provider](https://agentprime.io/advisories/CVE-2026-22694.md)
  `CVE-2026-22694` · CVE record: aliasvault aliasvault · CVSS 6.1 Medium · Not analysed yet · Published 14 Jan 2026 · Tags: CWE-346
- [Prowise Reflect v1.0.9 - Remote Keystroke Injection](https://agentprime.io/advisories/CVE-2022-50925.md)
  `CVE-2022-50925` · CVE record: Prowise Prowise Reflect · CVSS 8.6 High · Not analysed yet · Published 13 Jan 2026 · Tags: CWE-346
- [Account Takeover Vulnerability in Appsmith](https://agentprime.io/advisories/CVE-2026-22794.md)
  `CVE-2026-22794` · CVE record: appsmithorg appsmith · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jan 2026 · Tags: CWE-346
- [MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation](https://agentprime.io/advisories/GHSA-pgqp-8h46-6x4j.md)
  `GHSA-pgqp-8h46-6x4j`, `BIT-mlflow-2025-14279`, `CVE-2025-14279`, `PYSEC-2026-1656` · PyPI `mlflow`: affected `<3.5.0`, fixed in `3.5.0` · CVSS 8.1 High · Not analysed yet · Published 12 Jan 2026 · Tags: CWE-346

Newest: <https://agentprime.io/advisories/tag/cwe-346.md>
Older: <https://agentprime.io/advisories/tag/cwe-346.md?cursor=WyIyMDI2LTAxLTEyVDA5OjMwOjMxLjAwMDAwMFoiLCJHSFNBLXBncXAtOGg0Ni02eDRqIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-346&cursor=WyIyMDI2LTA0LTIyVDIwOjMyOjExLjAwMDAwMFoiLCJHSFNBLXc5MzctZmcyaC14aHEyIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-346/?cursor=WyIyMDI2LTA0LTIyVDIwOjMyOjExLjAwMDAwMFoiLCJHSFNBLXc5MzctZmcyaC14aHEyIl0>. Everything for agents: <https://agentprime.io/llms.txt>.