# CWE-346.

Every Advisory and CVE whose sources give the weakness CWE-346, newest first.

## Records, newest first (an older page)

- [Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack)](https://agentprime.io/advisories/CVE-2026-108362.md)
  `CVE-2026-108362` · CVE record: Privasys ra-tls-clients · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-346
- [Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE Transport](https://agentprime.io/advisories/CVE-2026-109332.md)
  `CVE-2026-109332` · CVE record: Jovancoding Network-AI · CVSS 2.3 Low · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-346
- [Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal](https://agentprime.io/advisories/CVE-2026-109286.md)
  `CVE-2026-109286` · CVE record: open-webui open-webui · CVSS 8.6 High · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-346
- [Insufficient isolation of user-supplied code in Progress MarkLogic Server](https://agentprime.io/advisories/CVE-2026-9191.md)
  `CVE-2026-9191` · CVE record: Progress Software Corporation MarkLogic Server · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-346
- [ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session](https://agentprime.io/advisories/CVE-2026-108269.md)
  `CVE-2026-108269` · CVE record: Privasys ra-tls-clients · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-346
- [enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session](https://agentprime.io/advisories/CVE-2026-108268.md)
  `CVE-2026-108268` · CVE record: Privasys enclave-os-virtual · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-346
- [Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session](https://agentprime.io/advisories/CVE-2026-108267.md)
  `CVE-2026-108267` · CVE record: Privasys go · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-346
- [Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session](https://agentprime.io/advisories/CVE-2026-108266.md)
  `CVE-2026-108266` · CVE record: Privasys rustls · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-346
- [Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout](https://agentprime.io/advisories/GHSA-9h23-53f4-q947.md)
  `GHSA-9h23-53f4-q947`, `CVE-2026-107804`, `GO-2026-6724` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20251005005631-6de168c9454, <1.9.10-0.20260904075558-e30e331303fc`, fixed in `1.9.10-0.20260904075558-e30e331303fc` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-346
- [TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment](https://agentprime.io/advisories/GHSA-x34j-47hf-4xg7.md)
  `GHSA-x34j-47hf-4xg7`, `CVE-2026-108261` · npm `tinacms` and 1 more: affected `<3.14.0`, fixed in `3.14.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Open redirect, CWE-346, CWE-441
- [enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session](https://agentprime.io/advisories/CVE-2026-108265.md)
  `CVE-2026-108265` · CVE record: Privasys enclave-os-mini · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-346
- [PraisonAI: Call API localhost-only authentication bypass via spoofed Host header](https://agentprime.io/advisories/GHSA-2gpf-2492-q9jh.md)
  `GHSA-2gpf-2492-q9jh`, `CVE-2026-61435`, `PYSEC-2026-4247` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 8.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass, CWE-346
- [Pydantic AI Web chat UI (\`Agent.to_web()\`, \`clai web\`): the local chat endpoint does not validate the \`Host\` header](https://agentprime.io/advisories/GHSA-q2xc-rrxj-58x9.md)
  `GHSA-q2xc-rrxj-58x9`, `CVE-2026-107292`, `PYSEC-2026-4279`, `PYSEC-2026-4288` · PyPI `pydantic-ai` and 1 more: affected `>=1.34.0, <1.107.5 || >=2.0.0b1, <2.30.0`, fixed in `1.107.5`, `2.30.0` · CVSS 6.4 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-346, CWE-350
- [Pydantic AI Web chat UI (\`Agent.to_web()\`, \`clai web\`): a website visited by the developer can trigger agent runs and server-side tool execution on the local chat endpoint](https://agentprime.io/advisories/GHSA-h4xc-3qfq-jf93.md)
  `GHSA-h4xc-3qfq-jf93`, `CVE-2026-107295`, `PYSEC-2026-4278`, `PYSEC-2026-4287` · PyPI `pydantic-ai` and 1 more: affected `>=1.34.0, <1.107.4 || >=2.0.0b1, <2.28.0`, fixed in `1.107.4`, `2.28.0` · CVSS 7.6 High · Not analysed yet · Published 8 Oct 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins](https://agentprime.io/advisories/GHSA-v2j5-22fr-j62r.md)
  `GHSA-v2j5-22fr-j62r`, `CVE-2026-107230` · Maven `org.asynchttpclient:async-http-client`: affected `>=3.0.0, <3.0.14 || >=2.0.0, <=2.16.1`, fixed in `3.0.14` · CVSS 7.4 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control, CWE-346
- [Origin Validation Error in hMailServer](https://agentprime.io/advisories/CVE-2026-104659.md)
  `CVE-2026-104659` · CVE record: Progressive Robot Ltd hMailServer · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-346
- [Origin validation error in Eclipse Ditto Ditto Explorer UI](https://agentprime.io/advisories/CVE-2026-107503.md)
  `CVE-2026-107503` · CVE record: Eclipse Ditto Ditto Explorer UI · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Hard-coded credentials, CWE-15, CWE-346
- [AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities](https://agentprime.io/advisories/CVE-2026-107281.md)
  `CVE-2026-107281` · CVE record: AsyncHttpClient async-http-client · CVSS 7.6 High · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control, CWE-346
- [Next.js has information disclosure in development server's Model Context Protocol endpoint](https://agentprime.io/advisories/GHSA-39w2-rjm5-chcv.md)
  `GHSA-39w2-rjm5-chcv`, `CVE-2026-94486` · npm `next`: affected `>=16.0.0, <16.3.8`, fixed in `16.3.8` · CVSS 2.3 Low · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-346
- [Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass](https://agentprime.io/advisories/GHSA-f87g-xv8r-7p7x.md)
  `GHSA-f87g-xv8r-7p7x`, `CVE-2026-94485` · npm `next`: affected `>=16.0.0, <16.3.8`, fixed in `16.3.8` · CVSS 6.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-346
- [Payload external upload trust validation issue](https://agentprime.io/advisories/GHSA-pj5h-5q6c-3pfx.md)
  `GHSA-pj5h-5q6c-3pfx`, `CVE-2026-105861` · npm `payload`: affected `>=3.0.0, <3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 7.2 High · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure, CWE-346
- [Authenticated SMTP Sender Address Forgery](https://agentprime.io/advisories/CVE-2026-33586.md)
  `CVE-2026-33586` · CVE record: OVHcloud OVHcloud · CVSS 6.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass, CWE-346, CWE-1188
- [Gitea migration SSRF through ALLOWED_DOMAINS address check bypass](https://agentprime.io/advisories/CVE-2026-101027.md)
  `CVE-2026-101027` · CVE record: Gitea Gitea · CVSS 7.7 High · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-346
- [Joplin Web Clipper pairing allows cross-origin theft of a permanent API token](https://agentprime.io/advisories/CVE-2026-105783.md)
  `CVE-2026-105783` · CVE record: laurent22 joplin · CVSS 8.0 High · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site request forgery (CSRF), CWE-346
- [Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path](https://agentprime.io/advisories/GHSA-rvm3-566m-v7fv.md)
  `GHSA-rvm3-566m-v7fv`, `CVE-2026-103922` · Maven `com.capacitorjs:core` and 2 more: affected `>=6.0.0, <6.2.2 || >=7.0.0, <7.6.9 || >=8.5.0, <8.5.1 || >=8.3.5, <8.4.3 || >=8.0.0, <=8.3.4`, fixed in `6.2.2`, `7.6.9`, `8.5.1`, `8.4.3` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-346, CWE-441
- [Heym before v0.0.112 HITL Review Token Leak via Spoofable Origin Header](https://agentprime.io/advisories/CVE-2026-105396.md)
  `CVE-2026-105396` · CVE record: heymrun heym · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-346
- [SiYuan: Cross-Site WebSocket Hijacking on the admin-only network proxy endpoint (\`/ws/network/proxy\`) via explicit \`CheckOrigin: true\` bypass](https://agentprime.io/advisories/GHSA-3cc2-h3v6-rqpq.md)
  `GHSA-3cc2-h3v6-rqpq`, `CVE-2026-74802`, `GO-2026-6650` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260803045322-cb67e0b4fab5`, fixed in `0.0.0-20260803045322-cb67e0b4fab5` · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site request forgery (CSRF), Server-side request forgery (SSRF), CWE-346
- [CVE-2026-104056](https://agentprime.io/advisories/CVE-2026-104056.md)
  `CVE-2026-104056` · CVE record: Authlib Authlib · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-345, CWE-346, CWE-829
- [Moodle: csrf in xml grade import](https://agentprime.io/advisories/CVE-2026-102588.md)
  `CVE-2026-102588` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-346
- [mcp-chrome-bridge through 1.0.31 CORS Origin Bypass](https://agentprime.io/advisories/CVE-2026-102878.md)
  `CVE-2026-102878` · CVE record: hangwin mcp-chrome-bridge · CVSS 8.6 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-346
- [undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors](https://agentprime.io/advisories/GHSA-vp8m-p9jh-q5pm.md)
  `GHSA-vp8m-p9jh-q5pm`, `CVE-2026-85152` · npm `undici`: affected `>=8.10.0, <8.10.2`, fixed in `8.10.2` · CVSS 7.4 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-346
- [Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab](https://agentprime.io/advisories/GHSA-hq2x-r82h-9wj4.md)
  `GHSA-hq2x-r82h-9wj4`, `CVE-2026-102673` · npm `electron`: affected `<41.10.4 || >=42.0.0-alpha.1, <42.5.2 || >=43.0.0-alpha.1, <43.0.0`, fixed in `41.10.4`, `42.5.2`, `43.0.0` · CVSS 8.2 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-346, CWE-693
- [Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled](https://agentprime.io/advisories/GHSA-j84w-jfhq-vhvj.md)
  `GHSA-j84w-jfhq-vhvj`, `CVE-2026-102675` · npm `electron`: affected `<41.10.6 || >=42.0.0-alpha.1, <42.9.2 || >=43.0.0-alpha.1, <43.4.1 || >=44.0.0-alpha.1, <44.0.0-beta.5`, fixed in `41.10.6`, `42.9.2`, `43.4.1`, `44.0.0-beta.5` · CVSS 7.4 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-346
- [Mitigation bypass in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-100830.md)
  `CVE-2026-100830` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-346
- [Site isolation issue in the Panning and Zooming component](https://agentprime.io/advisories/CVE-2026-100821.md)
  `CVE-2026-100821` · CVE record: Mozilla Firefox and 1 more · CVSS 4.7 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-346
- [Site isolation issue in the DOM: Networking component](https://agentprime.io/advisories/CVE-2026-100816.md)
  `CVE-2026-100816` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-346
- [Same-origin policy bypass in the DevTools component](https://agentprime.io/advisories/CVE-2026-100809.md)
  `CVE-2026-100809` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-346
- [Same-origin policy bypass in the WebExtensions component](https://agentprime.io/advisories/CVE-2026-100803.md)
  `CVE-2026-100803` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-346
- [Trusted Domain Project OpenDMARC PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin validation](https://agentprime.io/advisories/CVE-2026-101278.md)
  `CVE-2026-101278` · CVE record: Trusted Domain Project OpenDMARC · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-345, CWE-346
- [Origin validation error in the connect-xcors npm package](https://agentprime.io/advisories/CVE-2026-18825.md)
  `CVE-2026-18825` · CVE record: github.com/antono connect-cors · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: CWE-346
- [SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header](https://agentprime.io/advisories/CVE-2026-100646.md)
  `CVE-2026-100646` · CVE record: siyuan-note siyuan · CVSS 8.6 High · Not analysed yet · Published 26 Sept 2026 · Tags: CWE-346
- [SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth](https://agentprime.io/advisories/CVE-2026-100642.md)
  `CVE-2026-100642` · CVE record: siyuan-note siyuan · CVSS 7.2 High · Not analysed yet · Published 26 Sept 2026 · Tags: CWE-346
- [OpenClaw before 2026.7.1 Approval Binding Logic Error](https://agentprime.io/advisories/CVE-2026-100598.md)
  `CVE-2026-100598` · CVE record: OpenClaw OpenClaw · CVSS 7.5 High · Not analysed yet · Published 26 Sept 2026 · Tags: CWE-346
- [Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (\`/browser\` endpoint)](https://agentprime.io/advisories/GHSA-3cj3-hqcr-g934.md)
  `GHSA-3cj3-hqcr-g934`, `CVE-2026-59723` · npm `cline`: affected `<3.0.30`, fixed in `3.0.30` · CVSS 8.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-346
- [DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution](https://agentprime.io/advisories/GHSA-fm8p-53ww-hf6w.md)
  `GHSA-fm8p-53ww-hf6w`, `CVE-2026-61742` · npm `@bytebase/dbhub`: affected `<0.22.5`, fixed in `0.22.5` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Authentication bypass, CWE-346
- [Discourse: Wildcard iframe origin allowlist bypass via authority separators](https://agentprime.io/advisories/CVE-2026-91132.md)
  `CVE-2026-91132` · CVE record: discourse discourse · CVSS 4.3 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-346
- [YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route](https://agentprime.io/advisories/CVE-2026-85682.md)
  `CVE-2026-85682` · CVE record: yourownprogrammer YOP Poll · CVSS 8.8 High · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-346
- [Origin validation error in Fabasoft Folio Client](https://agentprime.io/advisories/CVE-2026-97155.md)
  `CVE-2026-97155` · CVE record: Fabasoft Folio Client · CVSS 6.5 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-346
- [Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence](https://agentprime.io/advisories/CVE-2026-94243.md)
  `CVE-2026-94243` · CVE record: Apache Software Foundation Apache Sling Security Bundle · CVSS 7.3 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-346
- [Dark Reader: Ability to request icon-like bitmap data from certain local web servers](https://agentprime.io/advisories/CVE-2026-92706.md)
  `CVE-2026-92706` · CVE record: darkreader darkreader · CVSS 3.4 Low · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure, CWE-346
- [Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon](https://agentprime.io/advisories/CVE-2026-94111.md)
  `CVE-2026-94111` · CVE record: Tencent BrowserSkill · CVSS 6.9 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: CWE-346
- [Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools](https://agentprime.io/advisories/GHSA-5gm3-9crp-6g3v.md)
  `GHSA-5gm3-9crp-6g3v`, `CVE-2026-77339`, `GO-2026-6515` · Go `github.com/f1bonacc1/process-compose`: affected `<1.120.0`, fixed in `1.120.0` · CVSS 5.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass, CWE-346
- [Cocos AI: Intra-handshake attested TLS implementation is vulnerable to session-misbinding attacks for Intel TDX verifier path](https://agentprime.io/advisories/CVE-2026-92701.md)
  `CVE-2026-92701` · CVE record: ultravioletrs cocos · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-346, CWE-354
- [Cocos AI: Intra-handshake attested TLS implementation can accept Evidence with nil, empty, or omitted reportData in the AMD SEV-SNP path](https://agentprime.io/advisories/CVE-2026-92702.md)
  `CVE-2026-92702` · CVE record: ultravioletrs cocos · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-346
- [Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config](https://agentprime.io/advisories/CVE-2026-89058.md)
  `CVE-2026-89058` · CVE record: Red Hat and 4 more · CVSS 7.4 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-346, CWE-942
- [Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match](https://agentprime.io/advisories/GHSA-9ccq-2jfg-qw33.md)
  `GHSA-9ccq-2jfg-qw33`, `CVE-2026-72702`, `PKSA-ms14-tz6x-6sqm` · Packagist `getgrav/grav`: affected `<2.0.16`, fixed in `2.0.16` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-346
- [Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler](https://agentprime.io/advisories/CVE-2026-12284.md)
  `CVE-2026-12284` · CVE record: Mattermost Mattermost · CVSS 3.8 Low · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-346
- [Mattermost Desktop local network access from server-rendered content](https://agentprime.io/advisories/CVE-2026-75025.md)
  `CVE-2026-75025` · CVE record: Mattermost Mattermost · CVSS 4.7 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-346
- [NSEC3 insecure-referral proof can use unrelated cached NSEC3 RRsets](https://agentprime.io/advisories/CVE-2026-77119.md)
  `CVE-2026-77119` · CVE record: ISC BIND 9 · CVSS 5.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-346
- [ag-ui-protocol ag-ui Event Application Layer agent.ts prepareRunAgentInput origin validation](https://agentprime.io/advisories/CVE-2026-92360.md)
  `CVE-2026-92360` · CVE record: ag-ui-protocol ag-ui · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-345, CWE-346

Newest: <https://agentprime.io/advisories/tag/cwe-346.md>
Older: <https://agentprime.io/advisories/tag/cwe-346.md?cursor=WyIyMDI2LTA5LTE2VDEyOjMwOjA5LjUxMDAwMFoiLCJDVkUtMjAyNi05MjM2MCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-346&cursor=WyIyMDI2LTEwLTEzVDA3OjE5OjEwLjQ1NDAwMFoiLCJDVkUtMjAyNi0xMDM0MTciXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-346/?cursor=WyIyMDI2LTEwLTEzVDA3OjE5OjEwLjQ1NDAwMFoiLCJDVkUtMjAyNi0xMDM0MTciXQ>. Everything for agents: <https://agentprime.io/llms.txt>.