agentprime: CWE-346Every new CWE-346 Advisory and CVE.https://agentprime.io/CVE-2026-123272: mcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadatahttps://agentprime.io/advisories/CVE-2026-123272/https://agentprime.io/advisories/CVE-2026-123272/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:45:36 GMTCVECVE-2026-123271: ChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicatorhttps://agentprime.io/advisories/CVE-2026-123271/https://agentprime.io/advisories/CVE-2026-123271/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 18:45:35 GMTCVEkaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hostshttps://agentprime.io/advisories/GHSA-5q7h-w9jf-cx97/https://agentprime.io/advisories/GHSA-5q7h-w9jf-cx97/github.com/chainguard-dev/kaniko <1.25.20, fixed in 1.25.20. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:48:54 GMTGogithub.com/chainguard-dev/kanikocriticalCVE-2026-119344: Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attackshttps://agentprime.io/advisories/CVE-2026-119344/https://agentprime.io/advisories/CVE-2026-119344/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 15:58:32 GMTCVEcriticalCVE-2026-102895: GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated adminhttps://agentprime.io/advisories/CVE-2026-102895/https://agentprime.io/advisories/CVE-2026-102895/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 21:16:59 GMTCVEcriticalCVE-2026-63183: OmniAuth: Host Header Injection Vulnerabilityhttps://agentprime.io/advisories/CVE-2026-63183/https://agentprime.io/advisories/CVE-2026-63183/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 19:07:04 GMTCVECVE-2026-92704: SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process executionhttps://agentprime.io/advisories/CVE-2026-92704/https://agentprime.io/advisories/CVE-2026-92704/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 15:24:16 GMTCVECVE-2026-121145: Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile applicationhttps://agentprime.io/advisories/CVE-2026-121145/https://agentprime.io/advisories/CVE-2026-121145/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 12:34:14 GMTCVECVE-2026-114456: Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client drivershttps://agentprime.io/advisories/CVE-2026-114456/https://agentprime.io/advisories/CVE-2026-114456/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 11:22:52 GMTCVECVE-2026-121802: Origin validation error in better-auth Better Authhttps://agentprime.io/advisories/CVE-2026-121802/https://agentprime.io/advisories/CVE-2026-121802/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 02:36:13 GMTCVEcriticalCVE-2026-120987: Origin validation error in NAVER Whale browserhttps://agentprime.io/advisories/CVE-2026-120987/https://agentprime.io/advisories/CVE-2026-120987/Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 06:42:16 GMTCVECVE-2026-74760: Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth statehttps://agentprime.io/advisories/CVE-2026-74760/https://agentprime.io/advisories/CVE-2026-74760/Published by the CVE Program. Not analysed by agentprime yet.Sun, 01 Nov 2026 16:43:34 GMTCVEFiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin readshttps://agentprime.io/advisories/GHSA-g5jq-qmqr-qrwf/https://agentprime.io/advisories/GHSA-g5jq-qmqr-qrwf/github.com/gofiber/fiber/v2 >=2.52.1, <2.52.3, fixed in 2.52.3. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 30 Oct 2026 22:58:05 GMTGogithub.com/gofiber/fiber/v2CVE-2026-119331: Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutationhttps://agentprime.io/advisories/CVE-2026-119331/https://agentprime.io/advisories/CVE-2026-119331/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:56:01 GMTCVECVE-2026-7005: WIT SynApps Runtime 1.4.11 Browser-Mediated SSRF via Controller Onboardinghttps://agentprime.io/advisories/CVE-2026-7005/https://agentprime.io/advisories/CVE-2026-7005/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 19:01:12 GMTCVECVE-2026-119416: CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matchinghttps://agentprime.io/advisories/CVE-2026-119416/https://agentprime.io/advisories/CVE-2026-119416/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 11:30:48 GMTCVECVE-2026-76026: Origin validation error in Google Chromehttps://agentprime.io/advisories/CVE-2026-76026/https://agentprime.io/advisories/CVE-2026-76026/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 00:05:07 GMTCVECVE-2026-61546: AnkiMCP: DNS rebinding reaches unauthenticated local AnkiMCP HTTP toolshttps://agentprime.io/advisories/CVE-2026-61546/https://agentprime.io/advisories/CVE-2026-61546/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 21:40:16 GMTCVEEcho: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headershttps://agentprime.io/advisories/GHSA-2ffq-g2xg-c22p/https://agentprime.io/advisories/GHSA-2ffq-g2xg-c22p/github.com/labstack/echo/v4 <4.16.0, fixed in 4.16.0. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Wed, 28 Oct 2026 21:04:52 GMTGogithub.com/labstack/echo/v4github.com/labstack/echo/v5Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Defaulthttps://agentprime.io/advisories/GHSA-99jh-6h7p-pp36/https://agentprime.io/advisories/GHSA-99jh-6h7p-pp36/github.com/labstack/echo/v4 >=4.0.0, <=4.16.2, no fixed version yet. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Wed, 28 Oct 2026 19:53:24 GMTGogithub.com/labstack/echo/v4github.com/labstack/echo/v5undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirectshttps://agentprime.io/advisories/GHSA-4w7w-5xrc-9h26/https://agentprime.io/advisories/GHSA-4w7w-5xrc-9h26/undici >=7.0.0, <7.30.1 || >=8.0.0, <8.12.2, fixed in 7.30.1, 8.12.2. CVSS 7.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 27 Oct 2026 19:02:31 GMTnpmundiciCVE-2026-115413: AWS API MCP Server OAuth Token Audience Validation Bypasshttps://agentprime.io/advisories/CVE-2026-115413/https://agentprime.io/advisories/CVE-2026-115413/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 18:10:28 GMTCVECVE-2026-82332: Fireware OS Improper Authentication in AuthPoint MFA Verification Allows Session Hijackinghttps://agentprime.io/advisories/CVE-2026-82332/https://agentprime.io/advisories/CVE-2026-82332/CVSS 5.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 15:52:27 GMTCVETwisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validationhttps://agentprime.io/advisories/GHSA-jj36-9pvh-vj5r/https://agentprime.io/advisories/GHSA-jj36-9pvh-vj5r/twisted <26.10.0rc1, fixed in 26.10.0rc1. CVSS 3.1 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 27 Oct 2026 14:45:29 GMTPyPItwistedCVE-2026-117976: Site isolation issue in the DOM: Navigation componenthttps://agentprime.io/advisories/CVE-2026-117976/https://agentprime.io/advisories/CVE-2026-117976/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 14:05:46 GMTCVECVE-2026-117966: Site isolation issue in the Networking: HTTP componenthttps://agentprime.io/advisories/CVE-2026-117966/https://agentprime.io/advisories/CVE-2026-117966/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 14:05:42 GMTCVECVE-2026-117965: Same-origin policy bypass in the Address Bar componenthttps://agentprime.io/advisories/CVE-2026-117965/https://agentprime.io/advisories/CVE-2026-117965/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 14:05:42 GMTCVECVE-2026-117958: Site isolation issue in the Networking: HTTP componenthttps://agentprime.io/advisories/CVE-2026-117958/https://agentprime.io/advisories/CVE-2026-117958/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 14:05:39 GMTCVECVE-2026-117928: Same-origin policy bypass in the CSS Parsing and Computation componenthttps://agentprime.io/advisories/CVE-2026-117928/https://agentprime.io/advisories/CVE-2026-117928/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 14:05:28 GMTCVECVE-2026-117912: Same-origin policy bypass in the CSS Parsing and Computation componenthttps://agentprime.io/advisories/CVE-2026-117912/https://agentprime.io/advisories/CVE-2026-117912/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 14:05:22 GMTCVECVE-2026-117860: Same-origin policy bypass in the DOM: Navigation componenthttps://agentprime.io/advisories/CVE-2026-117860/https://agentprime.io/advisories/CVE-2026-117860/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 14:05:01 GMTCVECVE-2026-110737: Push Endpoint Returns Permissive CORS Headershttps://agentprime.io/advisories/CVE-2026-110737/https://agentprime.io/advisories/CVE-2026-110737/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 10:26:37 GMTCVECVE-2026-82121: Origin Validation Error Vulnerability in HiRDBhttps://agentprime.io/advisories/CVE-2026-82121/https://agentprime.io/advisories/CVE-2026-82121/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 09:37:21 GMTCVECVE-2026-116254: rathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validationhttps://agentprime.io/advisories/CVE-2026-116254/https://agentprime.io/advisories/CVE-2026-116254/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 26 Oct 2026 09:45:18 GMTCVECVE-2026-116194: Rclone 1.52.0 before 1.75.2 CSRF via pCloud OAuth Callbackhttps://agentprime.io/advisories/CVE-2026-116194/https://agentprime.io/advisories/CVE-2026-116194/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 25 Oct 2026 13:20:28 GMTCVEMSAL Node authorization code flow may disclose parameters to an attacker-controlled endpointhttps://agentprime.io/advisories/GHSA-xcx6-jx8p-x3h5/https://agentprime.io/advisories/GHSA-xcx6-jx8p-x3h5/@azure/msal-node >=5.0.0-beta.0, <7.1.0, fixed in 7.1.0. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 23 Oct 2026 22:16:44 GMTnpm@azure/msal-nodeCVE-2026-79977: WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyrhttps://agentprime.io/advisories/CVE-2026-79977/https://agentprime.io/advisories/CVE-2026-79977/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 19:56:13 GMTCVEobsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopbackhttps://agentprime.io/advisories/GHSA-pqh8-4pj7-32xx/https://agentprime.io/advisories/GHSA-pqh8-4pj7-32xx/obsidian-tc <1.3.1, fixed in 1.3.1. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 23 Oct 2026 18:29:02 GMTnpmobsidian-tcCVE-2026-115724: VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Providerhttps://agentprime.io/advisories/CVE-2026-115724/https://agentprime.io/advisories/CVE-2026-115724/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 11:36:47 GMTCVEElectron: Pointer lock permission requests can be attributed to the wrong framehttps://agentprime.io/advisories/GHSA-x562-297c-g43g/https://agentprime.io/advisories/GHSA-x562-297c-g43g/electron <42.11.9 || >=43.0.0-alpha.1, <43.7.6 || >=44.0.0-alpha.1, <44.5.0 || >=45.0.0-alpha.1, <45.0.0-alpha.13, fixed in 42.11.9, 43.7.6, 44.5.0, 45.0.0-alpha.13. CVSS 5.4 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Thu, 22 Oct 2026 16:47:15 GMTnpmelectronElectron: openExternal permission requests can be attributed to the wrong originhttps://agentprime.io/advisories/GHSA-997q-gvvc-jwmx/https://agentprime.io/advisories/GHSA-997q-gvvc-jwmx/electron <42.11.3 || >=43.0.0-alpha.1, <43.7.0 || >=44.0.0-alpha.1, <44.3.0 || >=45.0.0-alpha.1, <45.0.0-alpha.5, fixed in 42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.5. CVSS 5.4 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Thu, 22 Oct 2026 16:43:59 GMTnpmelectronCVE-2026-112085: webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgradeshttps://agentprime.io/advisories/CVE-2026-112085/https://agentprime.io/advisories/CVE-2026-112085/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 22 Oct 2026 09:31:59 GMTCVEStorybook: Missing origin validation in Storybook preview allows code injection from malicious websiteshttps://agentprime.io/advisories/GHSA-f2ph-cmg5-wxc8/https://agentprime.io/advisories/GHSA-f2ph-cmg5-wxc8/storybook >=8.0.0, <8.6.19 || >=9.0.0, <9.1.21 || >=10.0.0, <10.6.2 || >=11.0.0-alpha.0, <11.0.0-alpha.6, fixed in 8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6. CVSS 8.6 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Wed, 21 Oct 2026 17:23:29 GMTnpmstorybook@storybook/addon-mcp@storybook/addon-vitest@storybook/core@storybook/core-server@storybook/experimental-addon-testElectron: HID and USB permission checks can be attributed to the wrong originhttps://agentprime.io/advisories/GHSA-fw47-9c62-h3vw/https://agentprime.io/advisories/GHSA-fw47-9c62-h3vw/electron <42.11.3 || >=43.0.0-alpha.1, <43.7.0 || >=44.0.0-alpha.1, <44.3.0 || >=45.0.0-alpha.1, <45.0.0-alpha.5, fixed in 42.11.3, 43.7.0, 44.3.0, 45.0.0-alpha.5. CVSS 5.4 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Wed, 21 Oct 2026 17:21:51 GMTnpmelectronCVE-2026-113075: Origin validation error in Google Chromehttps://agentprime.io/advisories/CVE-2026-113075/https://agentprime.io/advisories/CVE-2026-113075/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 21:02:27 GMTCVECVE-2026-112377: CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attackhttps://agentprime.io/advisories/CVE-2026-112377/https://agentprime.io/advisories/CVE-2026-112377/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 17:26:39 GMTCVEcriticalLoopX serve-status permissive CORS policy exposes control-plane state and private Markdown fileshttps://agentprime.io/advisories/GHSA-vx2m-gpq4-8j5q/https://agentprime.io/advisories/GHSA-vx2m-gpq4-8j5q/loopx >=0.0.1, <0.4.5, fixed in 0.4.5. CVSS 7.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Mon, 19 Oct 2026 16:11:57 GMTPyPIloopxCVE-2026-112101: BlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validationhttps://agentprime.io/advisories/CVE-2026-112101/https://agentprime.io/advisories/CVE-2026-112101/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 09:30:25 GMTCVECVE-2026-55842: Scoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domainhttps://agentprime.io/advisories/CVE-2026-55842/https://agentprime.io/advisories/CVE-2026-55842/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 18:30:57 GMTCVECVE-2026-55587: AliasVault: Browser extension WebAuthn bridge accepts forged origin/RP IDhttps://agentprime.io/advisories/CVE-2026-55587/https://agentprime.io/advisories/CVE-2026-55587/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 15 Oct 2026 18:21:53 GMTCVE