agentprime: CWE-424Every new CWE-424 Advisory and CVE.https://agentprime.io/CVE-2026-112917: Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcallhttps://agentprime.io/advisories/CVE-2026-112917/https://agentprime.io/advisories/CVE-2026-112917/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 19:08:11 GMTCVEcriticalCVE-2026-89419: OpenStack Ironic: OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting…https://agentprime.io/advisories/CVE-2026-89419/https://agentprime.io/advisories/CVE-2026-89419/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 23 Oct 2026 03:44:09 GMTCVECVE-2026-114659: Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routeshttps://agentprime.io/advisories/CVE-2026-114659/https://agentprime.io/advisories/CVE-2026-114659/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 22 Oct 2026 01:43:44 GMTCVECVE-2026-76529: Improper Protection of Alternate Path in Splunk SOARhttps://agentprime.io/advisories/CVE-2026-76529/https://agentprime.io/advisories/CVE-2026-76529/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 22:52:18 GMTCVEcritical`wasi-http` p3: forwarded trailers aren't checked against `is_forbidden_header` hookhttps://agentprime.io/advisories/GHSA-jxcf-8qw5-5c33/https://agentprime.io/advisories/GHSA-jxcf-8qw5-5c33/wasmtime-wasi-http >=46.0.0, <48.0.7 || >=49.0.0, <49.0.4, fixed in 48.0.7, 49.0.4. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Mon, 19 Oct 2026 12:00:00 GMTcrates.iowasmtime-wasi-httpCVE-2026-110865: Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presetshttps://agentprime.io/advisories/CVE-2026-110865/https://agentprime.io/advisories/CVE-2026-110865/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 22:52:52 GMTCVECVE-2026-69979: Windows AppX Deployment Service Security Feature Bypass Vulnerabilityhttps://agentprime.io/advisories/CVE-2026-69979/https://agentprime.io/advisories/CVE-2026-69979/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 18:59:35 GMTCVECVE-2026-107352: Missing authorization checks in Amazon Athena engine version 3 request handlinghttps://agentprime.io/advisories/CVE-2026-107352/https://agentprime.io/advisories/CVE-2026-107352/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 07 Oct 2026 20:14:30 GMTCVECVE-2026-89039: Arbitrary file read via the convert_playwright_script prompt in mcp-k6https://agentprime.io/advisories/CVE-2026-89039/https://agentprime.io/advisories/CVE-2026-89039/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 14:52:41 GMTCVECVE-2026-93353: copyparty SFTP Volume Restriction Bypass via mkdir/rmdir/chattr Handlershttps://agentprime.io/advisories/CVE-2026-93353/https://agentprime.io/advisories/CVE-2026-93353/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 20:29:36 GMTCVECVE-2026-37008: CrewAI: CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level…https://agentprime.io/advisories/CVE-2026-37008/https://agentprime.io/advisories/CVE-2026-37008/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Sun, 13 Sep 2026 00:00:00 GMTCVEAshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributeshttps://agentprime.io/advisories/GHSA-37jv-wc37-fhcw/https://agentprime.io/advisories/GHSA-37jv-wc37-fhcw/ash_lua >=0.1.0, <0.2.1, fixed in 0.2.1. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Mon, 07 Sep 2026 22:34:14 GMTHexash_luaash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controlshttps://agentprime.io/advisories/GHSA-wwxg-h779-3wf4/https://agentprime.io/advisories/GHSA-wwxg-h779-3wf4/ash_authentication_oauth2_server >=0.1.0, <0.3.1, fixed in 0.3.1. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Mon, 07 Sep 2026 22:23:56 GMTHexash_authentication_oauth2_serverCVE-2026-86145: PCRE2: PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached…https://agentprime.io/advisories/CVE-2026-86145/https://agentprime.io/advisories/CVE-2026-86145/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 05 Sep 2026 05:09:25 GMTCVECVE-2026-66756: Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=falsehttps://agentprime.io/advisories/CVE-2026-66756/https://agentprime.io/advisories/CVE-2026-66756/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 30 Jul 2026 19:18:07 GMTCVEGitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)https://agentprime.io/advisories/GHSA-25gq-j9jx-43pg/https://agentprime.io/advisories/GHSA-25gq-j9jx-43pg/code.gitea.io/gitea <1.27.0, fixed in 1.27.0. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 21 Jul 2026 20:18:44 GMTGocode.gitea.io/giteaCVE-2026-54423: OpenStack Ironic: In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using…https://agentprime.io/advisories/CVE-2026-54423/https://agentprime.io/advisories/CVE-2026-54423/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Jul 2026 03:10:54 GMTCVECVE-2026-0268: Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linuxhttps://agentprime.io/advisories/CVE-2026-0268/https://agentprime.io/advisories/CVE-2026-0268/CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 10 Jun 2026 20:40:11 GMTCVECVE-2026-0237: Prisma Browser: Improperly Restricted Automation Bridge Allows Security Bypasshttps://agentprime.io/advisories/CVE-2026-0237/https://agentprime.io/advisories/CVE-2026-0237/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 13 May 2026 17:48:17 GMTCVECVE-2026-4913: Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled.https://agentprime.io/advisories/CVE-2026-4913/https://agentprime.io/advisories/CVE-2026-4913/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 14:10:30 GMTCVEImproper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9 on all platforms may allow the bypass of intended file acc...https://agentprime.io/advisories/GHSA-2cpp-j2fc-qhp7/https://agentprime.io/advisories/GHSA-2cpp-j2fc-qhp7/awslabs-aws-api-mcp-server >=0.2.14, <1.3.9, fixed in 1.3.9. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Mon, 16 Mar 2026 17:16:32 GMTPyPIawslabs-aws-api-mcp-serverGitea allows attackers to add attachments with forbidden file extensionshttps://agentprime.io/advisories/GHSA-263q-5cv3-xq9g/https://agentprime.io/advisories/GHSA-263q-5cv3-xq9g/code.gitea.io/gitea <1.23.0-rc0, fixed in 1.23.0-rc0. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 26 Dec 2025 03:30:15 GMTGocode.gitea.io/giteaCVE-2025-4617: Prisma Browser: Insufficient Policy Enforcement Vulnerability in Prisma Browserhttps://agentprime.io/advisories/CVE-2025-4617/https://agentprime.io/advisories/CVE-2025-4617/CVSS 1.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 14 Nov 2025 17:51:36 GMTCVECVE-2025-58079: NEOJAPAN Inc. desknet's NEO: Improper Protection of Alternate Path (CWE-424) in the AppSuite of desknet's NEO V4.0R1.0…https://agentprime.io/advisories/CVE-2025-58079/https://agentprime.io/advisories/CVE-2025-58079/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 16 Oct 2025 10:03:35 GMTCVECVE-2025-6250: Privilege Management for Windows - Elevation of Privilegehttps://agentprime.io/advisories/CVE-2025-6250/https://agentprime.io/advisories/CVE-2025-6250/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 28 Jul 2025 15:40:28 GMTCVECVE-2025-49163: Arris VIP1113: Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow booting an arbitrary image…https://agentprime.io/advisories/CVE-2025-49163/https://agentprime.io/advisories/CVE-2025-49163/CVSS 6.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Jun 2025 00:00:00 GMTCVECVE-2025-49162: Arris VIP1113: Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow file overwrite via TFTP…https://agentprime.io/advisories/CVE-2025-49162/https://agentprime.io/advisories/CVE-2025-49162/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Jun 2025 00:00:00 GMTCVECVE-2025-48828: vBulletin: Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing…https://agentprime.io/advisories/CVE-2025-48828/https://agentprime.io/advisories/CVE-2025-48828/CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. CVSS score 9.0 (7.0 or more) and EPSS 0.57 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 May 2025 00:00:00 GMTCVEcriticalCVE-2025-48827: vBulletin: vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to…https://agentprime.io/advisories/CVE-2025-48827/https://agentprime.io/advisories/CVE-2025-48827/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. CVSS score 10.0 (7.0 or more) and EPSS 0.76 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 May 2025 00:00:00 GMTCVEcriticalCVE-2025-46655: HackMD CodiMD: CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded…https://agentprime.io/advisories/CVE-2025-46655/https://agentprime.io/advisories/CVE-2025-46655/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Apr 2025 00:00:00 GMTCVECVE-2025-46654: HackMD CodiMD: CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded…https://agentprime.io/advisories/CVE-2025-46654/https://agentprime.io/advisories/CVE-2025-46654/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Apr 2025 00:00:00 GMTCVEyiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Keyhttps://agentprime.io/advisories/GHSA-ggwg-cmwp-46r5/https://agentprime.io/advisories/GHSA-ggwg-cmwp-46r5/yiisoft/yii2 <2.0.52, fixed in 2.0.52. CVSS 9.0 (Critical). Critical: In CISA’s KEV catalogue since 2 May 2025: it is known to be exploited. CVSS score 9.0: 9.0 or more. CVSS score 9.0 (7.0 or more) and EPSS 0.88 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the GitHub Advisory Database. Not analysed by agentprime yet.Thu, 10 Apr 2025 03:31:32 GMTPackagistyiisoft/yii2criticalKEVCVE-2025-0113: Cortex XDR Broker VM: Unauthorized Access to Broker VM Docker Containershttps://agentprime.io/advisories/CVE-2025-0113/https://agentprime.io/advisories/CVE-2025-0113/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Feb 2025 21:05:08 GMTCVECVE-2024-8781: Container Escape Vulnerability in TR7's Application Security Platform (ASP)https://agentprime.io/advisories/CVE-2024-8781/https://agentprime.io/advisories/CVE-2024-8781/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 18 Nov 2024 14:00:49 GMTCVECVE-2023-52952: Siemens HiMed Cockpit 12 pro: A vulnerability has been identified in HiMed Cockpit 12 pro (J31032-K2017-H259) (All…https://agentprime.io/advisories/CVE-2023-52952/https://agentprime.io/advisories/CVE-2023-52952/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 08 Oct 2024 08:40:09 GMTCVEcriticalCVE-2024-8311: Improper Protection of Alternate Path in GitLabhttps://agentprime.io/advisories/CVE-2024-8311/https://agentprime.io/advisories/CVE-2024-8311/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 12 Sep 2024 18:27:24 GMTCVECVE-2024-3927: Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email Bypasshttps://agentprime.io/advisories/CVE-2024-3927/https://agentprime.io/advisories/CVE-2024-3927/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 22 May 2024 06:50:33 GMTCVECVE-2024-3460: Kioware: In KioWare for Windows (versions all through 8.34) it is possible to exit this software…https://agentprime.io/advisories/CVE-2024-3460/https://agentprime.io/advisories/CVE-2024-3460/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 May 2024 10:13:37 GMTCVECVE-2024-3459: Kioware: KioWare for Windows (versions all through 8.34) allows to escape the environment by…https://agentprime.io/advisories/CVE-2024-3459/https://agentprime.io/advisories/CVE-2024-3459/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 May 2024 10:13:03 GMTCVECVE-2023-20272: A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to upload malicious files to the web root of the application.https://agentprime.io/advisories/CVE-2023-20272/https://agentprime.io/advisories/CVE-2023-20272/CVSS 6.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 21 Nov 2023 18:49:16 GMTCVECVE-2023-46176: IBM MQ privilege escalationhttps://agentprime.io/advisories/CVE-2023-46176/https://agentprime.io/advisories/CVE-2023-46176/CVSS 6.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 03 Nov 2023 00:06:38 GMTCVECVE-2023-5165: Docker Desktop before 4.23.0 allows Enhanced Container Isolation bypass via debug shellhttps://agentprime.io/advisories/CVE-2023-5165/https://agentprime.io/advisories/CVE-2023-5165/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 25 Sep 2023 15:29:12 GMTCVECVE-2023-0629: Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation restrictions via the raw Docker socket and launch privileged containershttps://agentprime.io/advisories/CVE-2023-0629/https://agentprime.io/advisories/CVE-2023-0629/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 13 Mar 2023 11:16:41 GMTCVECVE-2022-1742: 2.2.4 IMPROPER PROTECTION OF ALTERNATE PATH CWE-424https://agentprime.io/advisories/CVE-2022-1742/https://agentprime.io/advisories/CVE-2022-1742/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 24 Jun 2022 15:00:26 GMTCVECVE-2022-28782: Improper access control vulnerability in Contents To Window prior to SMR May-2022 Release 1 allows physical attacker to install package before completion of Setup wizard.https://agentprime.io/advisories/CVE-2022-28782/https://agentprime.io/advisories/CVE-2022-28782/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 May 2022 19:40:19 GMTCVECVE-2022-24932: Improper Protection of Alternate Path vulnerability in Setup wizard process prior to SMR Mar-2022 Release 1 allows physical attacker package installation before finishing Setup wizard.https://agentprime.io/advisories/CVE-2022-24932/https://agentprime.io/advisories/CVE-2022-24932/CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 08 Mar 2022 13:46:36 GMTCVECVE-2021-3793: Motorola Binatone Hubble Cameras: An improper access control vulnerability was reported in some Motorola-branded Binatone…https://agentprime.io/advisories/CVE-2021-3793/https://agentprime.io/advisories/CVE-2021-3793/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 12 Nov 2021 22:05:52 GMTCVECVE-2019-18996: ABB PB610 HMIStudio accepts malicious DLL file in an applicationhttps://agentprime.io/advisories/CVE-2019-18996/https://agentprime.io/advisories/CVE-2019-18996/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 Dec 2019 20:24:44 GMTCVECVE-2019-18997: PB610 HMISimulator provides interface with access to arbitrary fileshttps://agentprime.io/advisories/CVE-2019-18997/https://agentprime.io/advisories/CVE-2019-18997/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 Dec 2019 20:22:47 GMTCVE