# CWE-349.

Every Advisory and CVE whose sources give the weakness CWE-349, newest first.

## Records, newest first

- [Apache OpenOffice: Carefully crafted documents could display different data when opened with different programs, instead of being reported as corrupt.](https://agentprime.io/advisories/CVE-2026-59263.md)
  `CVE-2026-59263` · CVE record: Apache Software Foundation Apache OpenOffice · CVSS 1.9 Low · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-349
- [Unverified Sign in with Apple callback parameter can override verified ID token claims](https://agentprime.io/advisories/GHSA-9fr5-g44g-9526.md)
  `GHSA-9fr5-g44g-9526`, `CVE-2026-117656`, `EEF-CVE-2026-117656` · Hex `assent`: affected `>=0.1.25, <0.3.2`, fixed in `0.3.2` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass, CWE-349
- [Logon bypass (trust of attacker-controlled completed-methods list)](https://agentprime.io/advisories/CVE-2026-112256.md)
  `CVE-2026-112256` · CVE record: OpenText Advanced Authentication Server · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-349
- [gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()](https://agentprime.io/advisories/GHSA-q54r-jf2p-rfr2.md)
  `GHSA-q54r-jf2p-rfr2` · crates.io `gix`: affected `>=0.88.0, <0.90.0`, fixed in `0.90.0` · CVSS 7.3 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-349
- [Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routes](https://agentprime.io/advisories/GHSA-2x6f-rp82-ppmj.md)
  `GHSA-2x6f-rp82-ppmj`, `CVE-2026-102527` · npm `nuxt-og-image`: affected `>=6.2.5, <6.7.0`, fixed in `6.7.0` · CVSS 6.9 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-349
- [Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab](https://agentprime.io/advisories/CVE-2026-100755.md)
  `CVE-2026-100755` · CVE record: GitLab GitLab · CVSS 4.6 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-349
- [Payy: agg_agg trailing message slots are unconstrained and allow forged burn messages](https://agentprime.io/advisories/CVE-2026-48100.md)
  `CVE-2026-48100` · CVE record: polybase payy · CVSS 8.7 High · Not analysed yet · Published 28 Sept 2026 · Tags: CWE-349
- [Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces](https://agentprime.io/advisories/CVE-2026-95985.md)
  `CVE-2026-95985` · CVE record: Amazon Kiro IDE · CVSS 8.6 High · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-349, CWE-829
- [wlc may disclose API tokens to project-configured URLs](https://agentprime.io/advisories/GHSA-3mqq-hv9c-85hc.md)
  `GHSA-3mqq-hv9c-85hc`, `CVE-2026-62364`, `PYSEC-2026-4180` · PyPI `wlc`: affected `<2.0.1`, fixed in `2.0.1` · CVSS 2.3 Low · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure, CWE-349
- [Unauthenticated IXFR deltas are applied to the live zone before TSIG verification](https://agentprime.io/advisories/CVE-2026-19033.md)
  `CVE-2026-19033` · CVE record: ISC BIND 9 · CVSS 6.5 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-349
- [Out-of-zone database nodes can become authoritative zone cuts](https://agentprime.io/advisories/CVE-2026-78301.md)
  `CVE-2026-78301` · CVE record: ISC BIND 9 · CVSS 5.8 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-349
- [Laci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration Manipulation](https://agentprime.io/advisories/CVE-2026-54047.md)
  `CVE-2026-54047` · CVE record: LaciSynchroni server · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass, CWE-349, CWE-602
- [WP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters](https://agentprime.io/advisories/CVE-2026-74916.md)
  `CVE-2026-74916` · CVE record: Unknown WP Fastest Cache · CVSS 6.5 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-349
- [Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab](https://agentprime.io/advisories/CVE-2026-15387.md)
  `CVE-2026-15387` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-349
- [django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)](https://agentprime.io/advisories/GHSA-fwjf-m4qw-9f2x.md)
  `GHSA-fwjf-m4qw-9f2x`, `CVE-2026-54625`, `PYSEC-2026-3824` · PyPI `django-cms`: affected `<5.0.8`, fixed in `5.0.8` · CVSS 4.8 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-349, CWE-524
- [Possible cache poisoning attack by mapping source port population per thread](https://agentprime.io/advisories/CVE-2026-50252.md)
  `CVE-2026-50252` · CVE record: NLnet Labs Unbound · CVSS 5.7 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-349
- [Dell Wyse Management Suite: Dell Wyse Management Suite, versions prior to WMS 5.5 HF1…](https://agentprime.io/advisories/CVE-2026-41120.md)
  `CVE-2026-41120` · CVE record: Dell Wyse Management Suite · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-349
- [ZoneToCache can poison the cache](https://agentprime.io/advisories/CVE-2026-33612.md)
  `CVE-2026-33612` · CVE record: PowerDNS Recursor · CVSS 7.5 High · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-349
- [Windows Dynamic Host Configuration Protocol (DHCP) Tampering Vulnerability](https://agentprime.io/advisories/CVE-2026-45602.md)
  `CVE-2026-45602` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-229, CWE-349
- [Possible cache poisoning via promiscuous records for the authority section](https://agentprime.io/advisories/CVE-2026-42960.md)
  `CVE-2026-42960` · CVE record: NLnet Labs Unbound · CVSS 5.7 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-349
- [Nuxt: \`\_\_nuxt_island\` endpoint does not bind responses to request props, enabling shared-cache poisoning](https://agentprime.io/advisories/GHSA-g8wj-3cr3-6w7v.md)
  `GHSA-g8wj-3cr3-6w7v`, `CVE-2026-46342` · npm `nuxt` and 1 more: affected `>=3.1.0, <3.21.6 || >=4.0.0-alpha.1, <4.4.6`, fixed in `3.21.6`, `4.4.6` · CVSS 2.3 Low · Not analysed yet · Published 19 May 2026 · Tags: Cross-site scripting (XSS), HTTP request smuggling, CWE-349
- [Next.js's Middleware / Proxy redirects can be cache-poisoned](https://agentprime.io/advisories/GHSA-3g8h-86w9-wvmq.md)
  `GHSA-3g8h-86w9-wvmq`, `CVE-2026-44572` · npm `next`: affected `>=12.2.0, <15.5.16 || >=16.0.0, <16.2.5`, fixed in `15.5.16`, `16.2.5` · CVSS 3.7 Low · Not analysed yet · Published 11 May 2026 · Tags: CWE-349
- [gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules](https://agentprime.io/advisories/GHSA-f26g-jm89-4g65.md)
  `GHSA-f26g-jm89-4g65`, `CVE-2026-40034` · crates.io `gix`: affected `>=0.31.0, <0.83.0`, fixed in `0.83.0` · CVSS 7.3 High · Not analysed yet · Published 5 May 2026 · Tags: Command injection, CWE-183, CWE-349, CWE-501
- [Windows COM Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-32162.md)
  `CVE-2026-32162` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 8.4 High · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-349
- [OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders](https://agentprime.io/advisories/GHSA-rxmx-g7hr-8mx4.md)
  `GHSA-rxmx-g7hr-8mx4`, `CVE-2026-41354` · npm `openclaw`: affected `<2026.4.2`, fixed in `2026.4.2` · CVSS 6.3 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-349, CWE-440, CWE-706
- [OpenClaw has an Arbitrary Malicious Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-m3mh-3mpg-37hw.md)
  `GHSA-m3mh-3mpg-37hw`, `CVE-2026-35641` · npm `openclaw`: affected `<2026.3.24`, fixed in `2026.3.24` · CVSS 8.4 High · Not analysed yet · Published 30 Mar 2026 · Tags: CWE-349, CWE-426
- [NGINX vulnerability](https://agentprime.io/advisories/CVE-2026-1642.md)
  `CVE-2026-1642` · CVE record: F5 NGINX Open Source and 1 more · CVSS 8.2 High · Not analysed yet · Published 4 Feb 2026 · Tags: CWE-349
- [JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of…](https://agentprime.io/advisories/CVE-2025-68269.md)
  `CVE-2025-68269` · CVE record: JetBrains IntelliJ IDEA · CVSS 5.4 Medium · Not analysed yet · Published 16 Dec 2025 · Tags: CWE-349
- [An acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows attackers with administrative privileges to manipulate HTTP Ho…](https://agentprime.io/advisories/CVE-2025-1680.md)
  `CVE-2025-1680` · CVE record: Moxa TN-4500A Series and 3 more · CVSS 0.0 None · Not analysed yet · Published 23 Oct 2025 · Tags: CWE-349
- [Cache poisoning attacks with unsolicited RRs](https://agentprime.io/advisories/CVE-2025-40778.md)
  `CVE-2025-40778` · CVE record: ISC BIND 9 · CVSS 8.6 High · Not analysed yet · Published 22 Oct 2025 · Tags: CWE-349
- [Possible domain hijacking via promiscuous records in the authority section](https://agentprime.io/advisories/CVE-2025-11411.md)
  `CVE-2025-11411` · CVE record: NLnet Labs Unbound · CVSS 5.7 Medium · Not analysed yet · Published 22 Oct 2025 · Tags: CWE-349
- [WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoning](https://agentprime.io/advisories/CVE-2025-11703.md)
  `CVE-2025-11703` · CVE record: wpgmaps WP Go Maps (formerly WP Google Maps) · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2025 · Tags: CWE-349
- [Cache poisoning via the ECS-enabled Rebirthday Attack](https://agentprime.io/advisories/CVE-2025-5994.md)
  `CVE-2025-5994` · CVE record: NLnet Labs Unbound · CVSS 8.7 High · Not analysed yet · Published 16 Jul 2025 · Tags: CWE-349
- [Birthday Attack against Resolvers supporting ECS](https://agentprime.io/advisories/CVE-2025-40776.md)
  `CVE-2025-40776` · CVE record: ISC BIND 9 · CVSS 8.6 High · Not analysed yet · Published 16 Jul 2025 · Tags: CWE-349
- [Windows BitLocker Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-48804.md)
  `CVE-2025-48804` · CVE record: Microsoft Windows 10 Version 1507 and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 8 Jul 2025 · Tags: CWE-349
- [FreshRSS vulnerable to favicon cache poisoning via proxy](https://agentprime.io/advisories/CVE-2025-46339.md)
  `CVE-2025-46339` · CVE record: FreshRSS FreshRSS · CVSS 4.3 Medium · Not analysed yet · Published 4 Jun 2025 · Tags: CWE-349
- [Cisco Webex Meetings: A vulnerability in client join services of Cisco Webex Meetings could allow an…](https://agentprime.io/advisories/CVE-2025-20255.md)
  `CVE-2025-20255` · CVE record: Cisco Cisco Webex Meetings · CVSS 4.3 Medium · Not analysed yet · Published 21 May 2025 · Tags: CWE-349
- [UrlMon Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-29842.md)
  `CVE-2025-29842` · CVE record: Microsoft Windows 10 Version 1507 and 4 more · CVSS 7.5 High · Not analysed yet · Published 13 May 2025 · Tags: CWE-349
- [Microsoft Word Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-29816.md)
  `CVE-2025-29816` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 4 more · CVSS 7.5 High · Not analysed yet · Published 8 Apr 2025 · Tags: CWE-349
- [Nuxt allows DOS via cache poisoning with payload rendering response](https://agentprime.io/advisories/GHSA-jvhm-gjrh-3h93.md)
  `GHSA-jvhm-gjrh-3h93`, `CVE-2025-27415` · npm `nuxt`: affected `>=3.0.0, <3.16.0`, fixed in `3.16.0` · CVSS 7.5 High · Not analysed yet · Published 19 Mar 2025 · Tags: CWE-349
- [check-jsonschema default caching for remote schemas allows for cache confusion](https://agentprime.io/advisories/GHSA-q6mv-284r-mp36.md)
  `GHSA-q6mv-284r-mp36`, `CVE-2024-53848`, `PYSEC-2026-1245` · PyPI `check-jsonschema`: affected `<0.30.0`, fixed in `0.30.0` · CVSS 7.1 High · Not analysed yet · Published 2 Dec 2024 · Tags: CWE-349
- [JetBrains WebStorm: In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible…](https://agentprime.io/advisories/CVE-2024-52555.md)
  `CVE-2024-52555` · CVE record: JetBrains WebStorm · CVSS 6.3 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: CWE-349
- [Next.js Cache Poisoning](https://agentprime.io/advisories/GHSA-gp8f-8m3g-qvj9.md)
  `GHSA-gp8f-8m3g-qvj9`, `CVE-2024-46982` · npm `next`: affected `>=13.5.1, <13.5.7 || >=14.0.0, <14.2.10`, fixed in `13.5.7`, `14.2.10` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.59 · Not analysed yet · Published 17 Sept 2024 · Tags: Broken access control, CWE-349
- [ESP-NOW Replay Attacks Vulnerability](https://agentprime.io/advisories/CVE-2024-42483.md)
  `CVE-2024-42483` · CVE record: espressif esp-now · CVSS 6.5 Medium · Not analysed yet · Published 12 Sept 2024 · Tags: CWE-349
- [Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series.](https://agentprime.io/advisories/CVE-2024-41924.md)
  `CVE-2024-41924` · CVE record: EC-CUBE CO.,LTD. EC-CUBE 4 series · CVSS 7.2 High · Not analysed yet · Published 30 Jul 2024 · Tags: CWE-349
- [DNSJava DNSSEC Bypass](https://agentprime.io/advisories/GHSA-cfxw-4h78-h7fw.md)
  `GHSA-cfxw-4h78-h7fw`, `CVE-2024-25638` · Maven `dnsjava:dnsjava`: affected `<3.6.0`, fixed in `3.6.0` · CVSS 8.9 High · Not analysed yet · Published 22 Jul 2024 · Tags: CWE-345, CWE-349
- [aiosmtpd STARTTLS unencrypted commands injection](https://agentprime.io/advisories/GHSA-wgjv-9j3q-jhg8.md)
  `GHSA-wgjv-9j3q-jhg8`, `CVE-2024-34083`, `PYSEC-2026-1111` · PyPI `aiosmtpd`: affected `<1.4.6`, fixed in `1.4.6` · CVSS 5.4 Medium · Not analysed yet · Published 20 May 2024 · Tags: CWE-349
- [Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot).](https://agentprime.io/advisories/CVE-2024-21094.md)
  `CVE-2024-21094` · CVE record: Oracle Corporation Java SE JDK and JRE · CVSS 3.7 Low · Not analysed yet · Published 16 Apr 2024 · Tags: CWE-349
- [JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted…](https://agentprime.io/advisories/CVE-2023-51655.md)
  `CVE-2023-51655` · CVE record: JetBrains IntelliJ IDEA · CVSS 6.3 Medium · Not analysed yet · Published 21 Dec 2023 · Tags: CWE-349
- [Siemens RUGGEDCOM RM1224 LTE(4G) EU: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2)…](https://agentprime.io/advisories/CVE-2023-44317.md)
  `CVE-2023-44317` · CVE record: Siemens RUGGEDCOM RM1224 LTE(4G) EU and 4 more · CVSS 8.6 High · Not analysed yet · Published 14 Nov 2023 · Tags: CWE-349
- [Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability](https://agentprime.io/advisories/GHSA-cwh2-q44x-5w3c.md)
  `GHSA-cwh2-q44x-5w3c`, `BIT-moodle-2023-5548`, `CVE-2023-5548`, `PKSA-7z8c-xy4p-1ctc` · Packagist `moodle/moodle`: affected `<4.3.0-rc2`, fixed in `4.3.0-rc2` · CVSS 3.3 Low · Not analysed yet · Published 9 Nov 2023 · Tags: CWE-345, CWE-349
- [AsyncSSH Rogue Session Attack](https://agentprime.io/advisories/GHSA-c35q-ffpf-5qpm.md)
  `GHSA-c35q-ffpf-5qpm`, `CVE-2023-46446`, `PYSEC-2023-239` · PyPI `asyncssh`: affected `<2.14.1`, fixed in `2.14.1` · CVSS 8.1 High · Not analysed yet · Published 9 Nov 2023 · Tags: Information disclosure, Broken access control, CWE-345, CWE-349
- [AsyncSSH Rogue Extension Negotiation](https://agentprime.io/advisories/GHSA-cfc2-wr2v-gxm5.md)
  `GHSA-cfc2-wr2v-gxm5`, `CVE-2023-46445`, `PYSEC-2023-237` · PyPI `asyncssh`: affected `<2.14.1`, fixed in `2.14.1` · CVSS 5.3 Medium · Not analysed yet · Published 9 Nov 2023 · Tags: CWE-345, CWE-349, CWE-354
- [VideoEdge config](https://agentprime.io/advisories/CVE-2023-3749.md)
  `CVE-2023-3749` · CVE record: Sensormatic Electronics, a subsidiary of Johnson Controls, Inc. VideoEdge · CVSS 7.1 High · Not analysed yet · Published 3 Aug 2023 · Tags: CWE-349
- [Deserialization of Untrusted Data in Infinispan](https://agentprime.io/advisories/GHSA-qqfc-m9hc-pqv3.md)
  `GHSA-qqfc-m9hc-pqv3`, `CVE-2018-1131` · Maven `org.infinispan:infinispan-core`: affected `>=9.3.0.Alpha1, <9.3.1.Final`, fixed in `9.3.1.Final` · CVSS 8.8 High · Not analysed yet · Published 13 May 2022 · Tags: Insecure deserialization, CWE-349
- [Symfony HTTP Foundation web cache poisoning](https://agentprime.io/advisories/GHSA-8wgj-6wx8-h5hq.md)
  `GHSA-8wgj-6wx8-h5hq`, `CVE-2018-14773`, `PKSA-nqj4-v43p-2gxc`, `PKSA-vh39-74ft-ywr6` · Packagist `symfony/http-foundation` and 1 more: affected `>=2.7.0, <2.7.49 || >=2.8.0, <2.8.44 || >=3.0.0, <3.3.18 || >=3.4.0, <3.4.14 || >=4.0.0, <4.0.14 || >=4.1.0, <4.1.3`, fixed in `2.7.49`, `2.8.44`, `3.3.18`, `3.4.14`, `4.0.14`, `4.1.3` · CVSS 6.5 Medium · EPSS 0.58 · Not analysed yet · Published 13 May 2022 · Tags: CWE-349
- [Nimble fails to validate certificates due to insecure httpClient defaults](https://agentprime.io/advisories/CVE-2021-21374.md)
  `CVE-2021-21374` · CVE record: nim-lang security · CVSS 8.1 High · Not analysed yet · Published 26 Mar 2021 · Tags: CWE-348, CWE-349, CWE-599
- [Local privilege escalation from ldap to root when using OPENLDAP_CONFIG_BACKEND=ldap in openldap2](https://agentprime.io/advisories/CVE-2020-8023.md)
  `CVE-2020-8023` · CVE record: SUSE SUSE Enterprise Storage 5 and 4 more · CVSS 7.7 High · Not analysed yet · Published 1 Sept 2020 · Tags: CWE-349
- [The Linux Foundation kernel: A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7…](https://agentprime.io/advisories/CVE-2020-10751.md)
  `CVE-2020-10751` · CVE record: The Linux Foundation kernel · CVSS 6.1 Medium · Not analysed yet · Published 26 May 2020 · Tags: CWE-349
- [iTerm2, up to and including version 3.3.5, with tmux integration is vulnerable to remote command execution](https://agentprime.io/advisories/CVE-2019-9535.md)
  `CVE-2019-9535` · CVE record: iTerm2 iTerm2 · No CVSS score · Not analysed yet · Published 9 Oct 2019 · Tags: CWE-349

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-349>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-349/>. Everything for agents: <https://agentprime.io/llms.txt>.