# CWE-346.

Every Advisory and CVE whose sources give the weakness CWE-346, newest first.

## Records, newest first (an older page)

- [chi Middleware Vulnerable to Potential IP Spoofing via \`X-Forwarded-For\` Header in \`Request.RemoteAddr\` Resolution](https://agentprime.io/advisories/GHSA-9g5q-2w5x-hmxf.md)
  `GHSA-9g5q-2w5x-hmxf`, `CVE-2026-72817`, `GO-2026-5775` · Go `github.com/go-chi/chi/middleware` and 4 more: affected `>=0.9.0, <=1.5.5`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-345, CWE-346
- [LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow](https://agentprime.io/advisories/CVE-2026-54030.md)
  `CVE-2026-54030` · CVE record: danny-avila LibreChat · CVSS 8.0 High · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-13034.md)
  `CVE-2026-13034` · CVE record: Google Chrome · CVSS 4.7 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-13022.md)
  `CVE-2026-13022` · CVE record: Google Chrome · CVSS 3.1 Low · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-13021.md)
  `CVE-2026-13021` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-346
- [Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack](https://agentprime.io/advisories/GHSA-w856-8p3r-p338.md)
  `GHSA-w856-8p3r-p338`, `CVE-2026-46611`, `PYSEC-2026-2498` · PyPI `glances`: affected `<4.5.5`, fixed in `4.5.5` · CVSS 5.3 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: CWE-346, CWE-350
- [Apache NiFi fails to validate proxy host headers when constructing qualified URLs](https://agentprime.io/advisories/GHSA-8vm2-c32j-mvfr.md)
  `GHSA-8vm2-c32j-mvfr`, `CVE-2026-54665` · Maven `org.apache.nifi:nifi-jetty`: affected `<2.10.0`, fixed in `2.10.0` · CVSS 6.3 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: CWE-346
- [Anki's local HTTP server does not sufficiently validate requests](https://agentprime.io/advisories/GHSA-869j-r97x-hx2g.md)
  `GHSA-869j-r97x-hx2g`, `CVE-2026-59153`, `PYSEC-2026-3459` · PyPI `aqt`: affected `<25.9.3`, fixed in `25.9.3` · CVSS 2.1 Low · Not analysed yet · Published 19 Jun 2026 · Tags: Path traversal, CWE-346
- [LangSmith SDK TracingMiddleware: Arbitrary server-side file read](https://agentprime.io/advisories/GHSA-f4xh-w4cj-qxq8.md)
  `GHSA-f4xh-w4cj-qxq8`, `CVE-2026-59152` · PyPI `langsmith`: affected `<0.8.18`, fixed in `0.8.18` · CVSS 5.0 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Path traversal, Memory corruption, CWE-346
- [Anki: User scripts in iframes have access to the internal Anki API](https://agentprime.io/advisories/GHSA-cw6h-ffmh-x6vh.md)
  `GHSA-cw6h-ffmh-x6vh`, `CVE-2026-58266` · PyPI `aqt`: affected `<25.9.4`, fixed in `25.9.4` · CVSS 6.5 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Path traversal, CWE-346
- [Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests](https://agentprime.io/advisories/GHSA-v3f4-w7r7-v3hm.md)
  `GHSA-v3f4-w7r7-v3hm`, `CVE-2026-58497` · npm `@zenalexa/unicli`: affected `<0.225.2`, fixed in `0.225.2` · CVSS 8.6 High · Not analysed yet · Published 19 Jun 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [dbt MCP Server: Unauthenticated OAuth Context Endpoint Leaks dbt Platform Tokens](https://agentprime.io/advisories/GHSA-jr33-mw75-7j8f.md)
  `GHSA-jr33-mw75-7j8f`, `CVE-2026-55837`, `PYSEC-2026-2443` · PyPI `dbt-mcp`: affected `<1.20.0`, fixed in `1.20.0` · CVSS 6.8 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Information disclosure, Authentication bypass, CWE-346
- [TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover](https://agentprime.io/advisories/GHSA-g5qx-h5f3-mp2f.md)
  `GHSA-g5qx-h5f3-mp2f`, `CVE-2026-55660` · npm `tinacms` and 1 more: affected `<3.9.3`, fixed in `3.9.3` · CVSS 7.6 High · Not analysed yet · Published 19 Jun 2026 · Tags: Cross-site scripting (XSS), Open redirect, CWE-346, CWE-940
- [Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs](https://agentprime.io/advisories/GHSA-c55v-343g-5xff.md)
  `GHSA-c55v-343g-5xff`, `CVE-2026-55791`, `PKSA-5xds-5mf3-ckxn` · Packagist `craftcms/cms`: affected `>=4.0.0-RC1, <4.18 || >=5.0.0-RC1, <5.10`, fixed in `4.18`, `5.10` · CVSS 6.9 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Cross-site scripting (XSS), Server-side request forgery (SSRF), CWE-346, CWE-644
- [Blocky DNSSEC validation bypass and validation-cache scope pollution](https://agentprime.io/advisories/GHSA-x845-2f78-7v36.md)
  `GHSA-x845-2f78-7v36`, `GO-2026-5745` · Go `github.com/0xERR0R/blocky`: affected `>=0.28.0, <0.32.0`, fixed in `0.32.0` · CVSS 8.6 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-346, CWE-807
- [Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)](https://agentprime.io/advisories/GHSA-v52w-28xh-v562.md)
  `GHSA-v52w-28xh-v562` · npm `kozou` and 3 more: affected `<1.8.1`, fixed in `1.8.1` · CVSS 4.0, no score published · Not analysed yet · Published 19 Jun 2026 · Tags: Denial of service, CWE-272, CWE-346, CWE-1188
- [guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts](https://agentprime.io/advisories/GHSA-cwxw-98qj-8qjx.md)
  `GHSA-cwxw-98qj-8qjx`, `CVE-2026-55767`, `PKSA-93qv-9n9h-6k6p` · Packagist `guzzlehttp/guzzle`: affected `<7.12.1`, fixed in `7.12.1` · CVSS 5.8 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-346, CWE-1286
- [undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse](https://agentprime.io/advisories/GHSA-hm92-r4w5-c3mj.md)
  `GHSA-hm92-r4w5-c3mj`, `CVE-2026-6734` · npm `undici`: affected `>=7.23.0, <7.28.0 || >=8.0.0, <8.2.0`, fixed in `7.28.0`, `8.2.0` · CVSS 7.5 High · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-346, CWE-940
- [PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools](https://agentprime.io/advisories/GHSA-vmf9-xx9w-86wx.md)
  `GHSA-vmf9-xx9w-86wx`, `CVE-2026-57112`, `PYSEC-2026-3521`, `PYSEC-2026-3534` · PyPI `praisonai` and 1 more: affected `>=3.10.0, <4.6.59`, fixed in `4.6.59` · CVSS 8.3 High · Not analysed yet · Published 18 Jun 2026 · Tags: Authentication bypass, Broken access control, CWE-346
- [ZITADEL: Missing Token Audience Validation (\`aud\`) in JWT IdP Provider](https://agentprime.io/advisories/GHSA-g5h5-m4hm-xjrr.md)
  `GHSA-g5h5-m4hm-xjrr`, `CVE-2026-55669`, `GO-2026-5391` · Go `github.com/zitadel/zitadel`: affected `<1.80.0-v2.20.0.20260615132747-d184e976fc79`, fixed in `1.80.0-v2.20.0.20260615132747-d184e976fc79` · CVSS 4.2 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-346
- [webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies](https://agentprime.io/advisories/GHSA-mx8g-39q3-5c79.md)
  `GHSA-mx8g-39q3-5c79`, `CVE-2026-9595` · npm `webpack-dev-server`: affected `<5.2.5`, fixed in `5.2.5` · CVSS 5.3 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: CWE-346, CWE-441
- [Open WebUI: Cross-origin postMessage confirmation bypass via action:submit](https://agentprime.io/advisories/GHSA-3vv5-8xxp-4f55.md)
  `GHSA-3vv5-8xxp-4f55`, `CVE-2026-54007`, `PYSEC-2026-2695` · PyPI `open-webui`: affected `<0.9.6`, fixed in `0.9.6` · CVSS 7.1 High · Not analysed yet · Published 17 Jun 2026 · Tags: CWE-346
- [Same-origin policy bypass in the Networking: Cookies component](https://agentprime.io/advisories/CVE-2026-12304.md)
  `CVE-2026-12304` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-346
- [Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations](https://agentprime.io/advisories/CVE-2026-47825.md)
  `CVE-2026-47825` · CVE record: Spring Spring Cloud Gateway · CVSS 8.6 High · Not analysed yet · Published 15 Jun 2026 · Tags: CWE-346
- [@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass](https://agentprime.io/advisories/GHSA-xrxm-cp7j-8xf6.md)
  `GHSA-xrxm-cp7j-8xf6`, `CVE-2026-50168` · npm `@angular/platform-server`: affected `<=18.2.14 || >=19.0.0-next.0, <19.2.23 || >=20.0.0-next.0, <20.3.22 || >=21.0.0-next.0, <21.2.15 || >=22.0.0-next.0, <22.0.0-rc.2`, fixed in `19.2.23`, `20.3.22`, `21.2.15`, `22.0.0-rc.2` · CVSS 8.8 High · Not analysed yet · Published 15 Jun 2026 · Tags: Server-side request forgery (SSRF), CWE-346
- [MCP Toolbox for Databases has an Origin Validation Error](https://agentprime.io/advisories/GHSA-76g7-m3xw-x9gr.md)
  `GHSA-76g7-m3xw-x9gr`, `CVE-2026-11624`, `GO-2026-6288` · Go `github.com/googleapis/mcp-toolbox`: affected `<0.25.0`, fixed in `0.25.0` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jun 2026 · Tags: CWE-346
- [Appsmith: Configuration-dependent origin validation bypass in password reset and email verification link generation](https://agentprime.io/advisories/GHSA-j9gf-vw2f-9hrw.md)
  `GHSA-j9gf-vw2f-9hrw` · Maven `com.appsmith:server`: affected `<2.0`, fixed in `2.0` · CVSS 8.1 High · Not analysed yet · Published 12 Jun 2026 · Tags: CWE-346, CWE-807
- [Idira Identity Browser Extension: Unauthorized Application Interaction via Origin Validation Failure](https://agentprime.io/advisories/CVE-2026-45173.md)
  `CVE-2026-45173` · CVE record: CyberArk Software, a Palo Alto Networks Company Identity Browser Extensions · CVSS 8.4 High · Not analysed yet · Published 11 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-12032.md)
  `CVE-2026-12032` · CVE record: Google Chrome · CVSS 3.1 Low · Not analysed yet · Published 11 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-12024.md)
  `CVE-2026-12024` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 11 Jun 2026 · Tags: CWE-346
- [@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects](https://agentprime.io/advisories/GHSA-x426-x7cc-3fpc.md)
  `GHSA-x426-x7cc-3fpc`, `CVE-2026-48022` · npm `@hapi/wreck`: affected `<18.1.2`, fixed in `18.1.2` · CVSS 6.5 Medium · Not analysed yet · Published 11 Jun 2026 · Tags: Information disclosure, Weak cryptography or TLS, Hard-coded credentials, CWE-346
- [Spring for GraphQL: Cross-Site WebSocket Hijacking](https://agentprime.io/advisories/GHSA-m39w-hqxx-3r48.md)
  `GHSA-m39w-hqxx-3r48`, `CVE-2026-41700` · Maven `org.springframework.graphql:spring-graphql`: affected `>=2.0.0, <2.0.4 || >=1.4.0, <1.4.6 || >=1.3.0, <=1.3.8 || >=1.0.0, <=1.0.6`, fixed in `2.0.4`, `1.4.6` · CVSS 8.1 High · Not analysed yet · Published 11 Jun 2026 · Tags: CWE-346
- [Xibo Vulnerable to Stored XSS and Iframe Sandbox Escape via Data Connector Script in DataSet](https://agentprime.io/advisories/CVE-2026-42558.md)
  `CVE-2026-42558` · CVE record: xibosignage xibo-cms · CVSS 7.6 High · Not analysed yet · Published 10 Jun 2026 · Tags: Cross-site scripting (XSS), CWE-116, CWE-346
- [Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload](https://agentprime.io/advisories/GHSA-qvv5-jq5g-4cgg.md)
  `GHSA-qvv5-jq5g-4cgg`, `CVE-2026-48063` · npm `baileys` and 1 more: affected `<6.7.22 || >=7.0.0-rc.1, <7.0.0-rc12`, fixed in `6.7.22`, `7.0.0-rc12` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jun 2026 · Tags: Authentication bypass, CWE-345, CWE-346
- [Insufficient verification that responses belong to a query](https://agentprime.io/advisories/CVE-2026-10846.md)
  `CVE-2026-10846` · CVE record: NLnet Labs ldns · CVSS 8.2 High · Not analysed yet · Published 10 Jun 2026 · Tags: CWE-346
- [Email Spoofing vulnerability in SAP Business Objects Business Intelligence Platform](https://agentprime.io/advisories/CVE-2026-44755.md)
  `CVE-2026-44755` · CVE record: SAP_SE SAP Business Objects Business Intelligence Platform · CVSS 4.3 Medium · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11693.md)
  `CVE-2026-11693` · CVE record: Google Chrome · CVSS 8.1 High · Not analysed yet · Published 8 Jun 2026 · Tags: CWE-346
- [Netty has Insufficient Bailiwick Validation for NS Records](https://agentprime.io/advisories/GHSA-5pvg-856g-cp85.md)
  `GHSA-5pvg-856g-cp85`, `CVE-2026-47691` · Maven `io.netty:netty-resolver-dns`: affected `>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final`, fixed in `4.2.15.Final`, `4.1.135.Final` · CVSS 8.7 High · Not analysed yet · Published 8 Jun 2026 · Tags: CWE-345, CWE-346
- [Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records](https://agentprime.io/advisories/GHSA-676x-f7gg-47vc.md)
  `GHSA-676x-f7gg-47vc`, `CVE-2026-45674` · Maven `io.netty:netty-resolver-dns`: affected `>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final`, fixed in `4.2.15.Final`, `4.1.135.Final` · CVSS 8.7 High · Not analysed yet · Published 8 Jun 2026 · Tags: CWE-345, CWE-346
- [Netty's Default QUIC token handler accepts any client-supplied token](https://agentprime.io/advisories/GHSA-cmm3-54f8-px4j.md)
  `GHSA-cmm3-54f8-px4j`, `CVE-2026-44894` · Maven `io.netty:netty-codec-classes-quic`: affected `>=4.2.0.Final, <4.2.15.Final`, fixed in `4.2.15.Final` · CVSS 7.5 High · Not analysed yet · Published 8 Jun 2026 · Tags: CWE-346, CWE-940
- [gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection](https://agentprime.io/advisories/GHSA-36w4-95hv-5vwg.md)
  `GHSA-36w4-95hv-5vwg`, `CVE-2026-43972`, `EEF-CVE-2026-43972` · Hex `gun`: affected `>=2.0.0, <2.4.0`, fixed in `2.4.0` · CVSS 6.3 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: CWE-346
- [sanic-cors contains an improper regular expression in the try_match() function](https://agentprime.io/advisories/GHSA-94jw-hqvj-vw74.md)
  `GHSA-94jw-hqvj-vw74`, `CVE-2026-37737`, `PYSEC-2026-3539` · PyPI `sanic-cors`: affected `<=2.2.0`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 5 Jun 2026 · Tags: CWE-346, CWE-625
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11309.md)
  `CVE-2026-11309` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11298.md)
  `CVE-2026-11298` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11291.md)
  `CVE-2026-11291` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11278.md)
  `CVE-2026-11278` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11243.md)
  `CVE-2026-11243` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11226.md)
  `CVE-2026-11226` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11217.md)
  `CVE-2026-11217` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-346
- [Cross-site request forgery in Google Chrome](https://agentprime.io/advisories/CVE-2026-11214.md)
  `CVE-2026-11214` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [Cross-site request forgery in Google Chrome](https://agentprime.io/advisories/CVE-2026-11200.md)
  `CVE-2026-11200` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [Cross-site request forgery in Google Chrome](https://agentprime.io/advisories/CVE-2026-11195.md)
  `CVE-2026-11195` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [Cross-site request forgery in Google Chrome](https://agentprime.io/advisories/CVE-2026-11194.md)
  `CVE-2026-11194` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11181.md)
  `CVE-2026-11181` · CVE record: Google Chrome · CVSS 6.3 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11178.md)
  `CVE-2026-11178` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11176.md)
  `CVE-2026-11176` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11161.md)
  `CVE-2026-11161` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11133.md)
  `CVE-2026-11133` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11132.md)
  `CVE-2026-11132` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-346
- [Origin validation error in Google Chrome](https://agentprime.io/advisories/CVE-2026-11084.md)
  `CVE-2026-11084` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Cross-site request forgery (CSRF), CWE-346

Newest: <https://agentprime.io/advisories/tag/cwe-346.md>
Older: <https://agentprime.io/advisories/tag/cwe-346.md?cursor=WyIyMDI2LTA2LTA0VDIzOjA0OjQ5Ljc1MjAwMFoiLCJDVkUtMjAyNi0xMTA4NCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-346&cursor=WyIyMDI2LTA2LTI2VDIzOjE4OjEzLjAwMDAwMFoiLCJHSFNBLTV3eDYtbWc3NS12NTdyIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-346/?cursor=WyIyMDI2LTA2LTI2VDIzOjE4OjEzLjAwMDAwMFoiLCJHSFNBLTV3eDYtbWc3NS12NTdyIl0>. Everything for agents: <https://agentprime.io/llms.txt>.