# CWE-348.

Every Advisory and CVE whose sources give the weakness CWE-348, newest first.

## Records, newest first

- [Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment](https://agentprime.io/advisories/CVE-2026-77463.md)
  `CVE-2026-77463` · CVE record: umputun remark42 · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-348, CWE-807
- [ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed \`X-Forwarded-For\` header](https://agentprime.io/advisories/CVE-2026-86041.md)
  `CVE-2026-86041` · CVE record: mayswind ezbookkeeping · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-348
- [CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port](https://agentprime.io/advisories/CVE-2026-120633.md)
  `CVE-2026-120633` · CVE record · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Open redirect, CWE-348
- [PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header](https://agentprime.io/advisories/CVE-2026-119711.md)
  `CVE-2026-119711` · CVE record: pipeshub-ai pipeshub-ai · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-348
- [chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For](https://agentprime.io/advisories/GHSA-j6qf-3m9c-vwj3.md)
  `GHSA-j6qf-3m9c-vwj3`, `CVE-2026-114437` · Go `github.com/go-chi/chi/v5`: affected `<5.4.0`, fixed in `5.4.0` · CVSS 6.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-345, CWE-348
- [Echo: X-Real-IP extractor trusts the header value instead of the sending peer](https://agentprime.io/advisories/GHSA-h53f-rm2w-w7rg.md)
  `GHSA-h53f-rm2w-w7rg`, `CVE-2026-118265`, `GO-2026-6841` · Go `github.com/labstack/echo/v5`: affected `>=5.0.0, <5.4.1`, fixed in `5.4.1` · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-348
- [Use of Less Trusted Source in GitLab](https://agentprime.io/advisories/CVE-2026-112378.md)
  `CVE-2026-112378` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-348
- [Duplicate Advisory: chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For](https://agentprime.io/advisories/GHSA-7cgw-qmxx-7fc2.md)
  `GHSA-7cgw-qmxx-7fc2` · Go `github.com/go-chi/chi/v5`: affected `<=5.3.2`, no fixed version yet · CVSS 4.8 Medium · Withdrawn · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-348
- [Use of Less Trusted Source in hMailServer](https://agentprime.io/advisories/CVE-2026-114474.md)
  `CVE-2026-114474` · CVE record: Progressive Robot Ltd hMailServer · CVSS 5.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-348
- [Use of Less Trusted Source in hMailServer](https://agentprime.io/advisories/CVE-2026-107567.md)
  `CVE-2026-107567` · CVE record: Progressive Robot Ltd hMailServer · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-348
- [Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header](https://agentprime.io/advisories/CVE-2026-111934.md)
  `CVE-2026-111934` · CVE record: coder coder · CVSS 6.3 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: CWE-348
- [Wheels: Wheels through 4.1.1 derives its default production error-email address from the Host…](https://agentprime.io/advisories/CVE-2026-111450.md)
  `CVE-2026-111450` · CVE record: Wheels Wheels · CVSS 5.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-348
- [Wheels: Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a…](https://agentprime.io/advisories/CVE-2026-111443.md)
  `CVE-2026-111443` · CVE record: Wheels Wheels · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-348
- [Resource allocation without limits in Eclipse Foundation Eclipse Connected Services Platform](https://agentprime.io/advisories/CVE-2026-110726.md)
  `CVE-2026-110726` · CVE record: Eclipse Foundation Eclipse Connected Services Platform · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Denial of service, CWE-348, CWE-807
- [Znuny: In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and…](https://agentprime.io/advisories/CVE-2026-93483.md)
  `CVE-2026-93483` · CVE record: Znuny Znuny · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-348
- [Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing](https://agentprime.io/advisories/CVE-2026-108736.md)
  `CVE-2026-108736` · CVE record: alexjustesen speedtest-tracker · CVSS 6.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: CWE-348
- [PairDrop through 1.11.2 IP Spoofing via cf-connecting-ip Header](https://agentprime.io/advisories/CVE-2026-108555.md)
  `CVE-2026-108555` · CVE record: schlagmichdoch PairDrop · CVSS 2.3 Low · Not analysed yet · Published 10 Oct 2026 · Tags: CWE-348
- [Pingvin Share X before 1.22.0 Rate Limit Bypass via Spoofed X-Forwarded-For](https://agentprime.io/advisories/CVE-2026-108162.md)
  `CVE-2026-108162` · CVE record: smp46 pingvin-share-x · CVSS 6.9 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: CWE-348
- [Dell Secure Connect Gateway (SCG) Policy Manager: Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16…](https://agentprime.io/advisories/CVE-2026-78015.md)
  `CVE-2026-78015` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 3.7 Low · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-348
- [Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing](https://agentprime.io/advisories/CVE-2026-107271.md)
  `CVE-2026-107271` · CVE record: gophish gophish · CVSS 6.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-348
- [PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion](https://agentprime.io/advisories/GHSA-x33g-cr3x-6449.md)
  `GHSA-x33g-cr3x-6449`, `CVE-2026-102275`, `PYSEC-2026-4183` · PyPI `pyjwt`: affected `>=2.1.0, <2.15.0`, fixed in `2.15.0` · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-345, CWE-348
- [proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet](https://agentprime.io/advisories/GHSA-jqcg-44mw-7w3h.md)
  `GHSA-jqcg-44mw-7w3h`, `CVE-2026-90711` · npm `proxy-addr`: affected `>=1.1.0, <2.0.8`, fixed in `2.0.8` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass, CWE-348, CWE-697
- [Irdeto Denuvo Anti-Tamper: Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via…](https://agentprime.io/advisories/CVE-2026-105051.md)
  `CVE-2026-105051` · CVE record: Irdeto Denuvo Anti-Tamper · CVSS 1.9 Low · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-348
- [simple-php-router through 5.4.1.7 IP restriction bypass via forwarding headers](https://agentprime.io/advisories/CVE-2026-103592.md)
  `CVE-2026-103592` · CVE record: pecee simple-router · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-348
- [UnoPim 2.0.0 before 2.0.1 and 2.1.0 before 2.1.1 Cache Poisoning via X-Forwarded-Host](https://agentprime.io/advisories/CVE-2026-102630.md)
  `CVE-2026-102630` · CVE record: unopim unopim · CVSS 2.3 Low · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-348
- [Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted source](https://agentprime.io/advisories/CVE-2026-101277.md)
  `CVE-2026-101277` · CVE record: Trusted Domain Project OpenDKIM · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: CWE-348
- [vLLM is an inference and serving engine for large language models. In versions from 0.22.1 through 0.28.0, the operator-supplied model revision pin (--revision / --code-revision) is not propagated ...](https://agentprime.io/advisories/GHSA-hhv2-872h-628q.md)
  `GHSA-hhv2-872h-628q`, `CVE-2026-100653`, `PYSEC-2026-4324` · PyPI `vllm`: affected `>=0.22.1, <0.28.0`, fixed in `0.28.0` · CVSS 8.3 High · Not analysed yet · Published 26 Sept 2026 · Tags: CWE-348
- [wpForo Forum 3.0.0 - 3.1.5 - Unauthenticated AI Credit Exhaustion via IP Rate Limit Bypass](https://agentprime.io/advisories/CVE-2026-80514.md)
  `CVE-2026-80514` · CVE record: Unknown wpForo Forum · CVSS 5.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-348
- [In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header.](https://agentprime.io/advisories/CVE-2026-97404.md)
  `CVE-2026-97404` · CVE record: OpenStack Zaqar · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-348
- [Use of Less Trusted Source in GitLab](https://agentprime.io/advisories/CVE-2026-92530.md)
  `CVE-2026-92530` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-348
- [Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust](https://agentprime.io/advisories/CVE-2026-84718.md)
  `CVE-2026-84718` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-348
- [Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing](https://agentprime.io/advisories/CVE-2026-87070.md)
  `CVE-2026-87070` · CVE record: Unknown Forminator Forms · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-348
- [Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header](https://agentprime.io/advisories/GHSA-fq95-v8xc-jm3v.md)
  `GHSA-fq95-v8xc-jm3v`, `CVE-2026-62987`, `GO-2026-6566` · Go `github.com/fabiolb/fabio`: affected `>=1.6.6, <1.7.2`, fixed in `1.7.2` · CVSS 5.8 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass, CWE-348
- [kcp front-proxy does not strip inbound X-Remote-\* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace](https://agentprime.io/advisories/GHSA-c8w2-fgvx-vhv4.md)
  `GHSA-c8w2-fgvx-vhv4`, `CVE-2026-61682`, `GO-2026-6517` · Go `github.com/kcp-dev/kcp`: affected `<0.31.4 || >=0.32.0, <0.32.2`, fixed in `0.31.4`, `0.32.2` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass, CWE-302, CWE-348
- [djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path](https://agentprime.io/advisories/GHSA-v9rj-xjfv-xj9r.md)
  `GHSA-v9rj-xjfv-xj9r`, `CVE-2026-61589`, `PYSEC-2026-4046` · PyPI `djust`: affected `<1.0.7`, fixed in `1.0.7` · CVSS 6.3 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control, CWE-348
- [@fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet](https://agentprime.io/advisories/CVE-2026-92395.md)
  `CVE-2026-92395` · CVE record: @fastify/proxy-addr @fastify/proxy-addr · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass, CWE-348, CWE-697
- [Forgejo: Forgejo 13.0.0 through 16.0.4, when "\[federation\] ENABLED = true" is set…](https://agentprime.io/advisories/CVE-2026-90679.md)
  `CVE-2026-90679` · CVE record: Forgejo Forgejo · CVSS 4.3 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: CWE-348
- [Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API WHMCS Module](https://agentprime.io/advisories/CVE-2026-16272.md)
  `CVE-2026-16272` · CVE record: PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-348
- [fastify vulnerable to X-Forwarded-\* spoofing under trustProxy hop-count](https://agentprime.io/advisories/GHSA-3m5p-2c4r-xxw2.md)
  `GHSA-3m5p-2c4r-xxw2`, `CVE-2026-16732` · npm `fastify`: affected `>=5.8.3, <5.12.1`, fixed in `5.12.1` · CVSS 6.1 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-348
- [9router: Unauthenticated \`/v1\` proxy access via \`Host\`-header spoofing → open AI relay + SSRF](https://agentprime.io/advisories/GHSA-86m2-fcxq-5q7c.md)
  `GHSA-86m2-fcxq-5q7c`, `CVE-2026-55641` · npm `9router`: affected `<0.5.2`, fixed in `0.5.2` · CVSS 8.2 High · Not analysed yet · Published 28 Aug 2026 · Tags: Authentication bypass, Server-side request forgery (SSRF), CWE-348, CWE-1327
- [CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()](https://agentprime.io/advisories/GHSA-7wmf-pw8j-mc78.md)
  `GHSA-7wmf-pw8j-mc78`, `CVE-2026-63220`, `PKSA-kcc6-gffv-vchj` · Packagist `codeigniter4/framework`: affected `<4.7.4`, fixed in `4.7.4` · CVSS 4.8 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: CWE-348
- [Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header](https://agentprime.io/advisories/CVE-2026-25552.md)
  `CVE-2026-25552` · CVE record: TryGhost Ghost-CLI · CVSS 6.3 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-348
- ['response-ip'/'rpz' can rewrite BOGUS answers instead of returning SERVFAIL](https://agentprime.io/advisories/CVE-2026-50243.md)
  `CVE-2026-50243` · CVE record: NLnet Labs Unbound · CVSS 6.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-348
- [Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication](https://agentprime.io/advisories/GHSA-xgm2-5f3f-mvvc.md)
  `GHSA-xgm2-5f3f-mvvc`, `CVE-2026-59897` · npm `hono`: affected `>=4.3.3, <4.12.27`, fixed in `4.12.27` · CVSS 4.8 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-348
- [Glance 0.8.5 IP Spoofing Authentication Brute-Force Protection Bypass](https://agentprime.io/advisories/CVE-2026-63770.md)
  `CVE-2026-63770` · CVE record: glanceapp glance · CVSS 8.2 High · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-348
- [FileCodeBox < 2.4 Anti-bruteforce Rate Limit Bypass via Spoofed Headers](https://agentprime.io/advisories/CVE-2026-64619.md)
  `CVE-2026-64619` · CVE record: vastsa FileCodeBox · CVSS 8.7 High · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-348
- [Insufficient verification of data authenticity in Eclipse Foundation Eclipse Kura](https://agentprime.io/advisories/CVE-2026-9561.md)
  `CVE-2026-9561` · CVE record: Eclipse Foundation Eclipse Kura · CVSS 8.8 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-345, CWE-348, CWE-807
- [Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofing](https://agentprime.io/advisories/CVE-2026-58122.md)
  `CVE-2026-58122` · CVE record: nesquena hermes-webui · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jul 2026 · Tags: CWE-348
- [OpenBSD OpenSSH: In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence…](https://agentprime.io/advisories/CVE-2026-59999.md)
  `CVE-2026-59999` · CVE record: OpenBSD OpenSSH · CVSS 5.9 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: CWE-348
- [Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7…](https://agentprime.io/advisories/CVE-2026-46466.md)
  `CVE-2026-46466` · CVE record: Dell PowerProtect Data Domain · CVSS 2.7 Low · Not analysed yet · Published 3 Jul 2026 · Tags: CWE-348
- [LibreTranslate - IP Spoofing via X-Forwarded-For Header](https://agentprime.io/advisories/CVE-2026-57942.md)
  `CVE-2026-57942` · CVE record: LibreTranslate LibreTranslate · CVSS 6.9 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-348
- [chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header](https://agentprime.io/advisories/GHSA-rjr7-jggh-pgcp.md)
  `GHSA-rjr7-jggh-pgcp`, `CVE-2026-72816`, `GO-2026-5777` · Go `github.com/go-chi/chi/middleware` and 4 more: affected `<=1.5.5`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: Authentication bypass, CWE-348
- [Canonical ADSys Uses a Less Trusted Source](https://agentprime.io/advisories/GHSA-crm4-q7v4-c2r2.md)
  `GHSA-crm4-q7v4-c2r2`, `CVE-2026-12249`, `GO-2026-6543` · Go `github.com/ubuntu/adsys`: affected `<0.16.3-0.20250318112551-8b1939f96d38`, fixed in `0.16.3-0.20250318112551-8b1939f96d38` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jun 2026 · Tags: CWE-348
- [ProxySQL: PROXY-Protocol-v1 UNKNOWN parses spoofed source IP, bypassing mysql_query_rules.client_addr ACL](https://agentprime.io/advisories/CVE-2026-48772.md)
  `CVE-2026-48772` · CVE record: sysown proxysql · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Jun 2026 · Tags: Broken access control, CWE-348
- [Apache APISIX: wolf-rbac plugin Identity Spoofing](https://agentprime.io/advisories/CVE-2026-44046.md)
  `CVE-2026-44046` · CVE record: Apache Software Foundation Apache APISIX · CVSS 2.3 Low · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-348
- [hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest](https://agentprime.io/advisories/GHSA-wgpf-jwqj-8h8p.md)
  `GHSA-wgpf-jwqj-8h8p`, `CVE-2026-54289` · npm `hono`: affected `<4.12.25`, fixed in `4.12.25` · CVSS 4.8 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-348
- [Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header](https://agentprime.io/advisories/GHSA-3qmc-cj7q-62hv.md)
  `GHSA-3qmc-cj7q-62hv`, `CVE-2026-48061`, `PYSEC-2026-2603` · PyPI `litestar`: affected `<2.22.0`, fixed in `2.22.0` · CVSS 5.9 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: CWE-348, CWE-644, CWE-807
- [OfflineIMAP: OfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability prior to…](https://agentprime.io/advisories/CVE-2020-37248.md)
  `CVE-2020-37248` · CVE record: OfflineIMAP OfflineIMAP · CVSS 6.5 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: CWE-348
- [Caddy Defender trusted proxy client IP bypass](https://agentprime.io/advisories/GHSA-3h23-rrpc-3p87.md)
  `GHSA-3h23-rrpc-3p87`, `CVE-2026-46415`, `GO-2026-5086` · Go `pkg.jsn.cam/caddy-defender`: affected `<0.10.1`, fixed in `0.10.1` · CVSS 8.2 High · Not analysed yet · Published 19 May 2026 · Tags: Broken access control, CWE-348
- [HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header](https://agentprime.io/advisories/CVE-2026-43634.md)
  `CVE-2026-43634` · CVE record: hestiacp hestiacp · CVSS 8.7 High · Not analysed yet · Published 19 May 2026 · Tags: CWE-348

Older: <https://agentprime.io/advisories/tag/cwe-348.md?cursor=WyIyMDI2LTA1LTE5VDEzOjMzOjA4LjgyNTAwMFoiLCJDVkUtMjAyNi00MzYzNCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-348>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-348/>. Everything for agents: <https://agentprime.io/llms.txt>.