# CWE-436.

Every Advisory and CVE whose sources give the weakness CWE-436, newest first.

## Records, newest first

- [ModSecurity: RFC 2231 \`filename\*\` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)](https://agentprime.io/advisories/CVE-2026-104269.md)
  `CVE-2026-104269` · CVE record: owasp-modsecurity ModSecurity · CVSS 8.6 High · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-436
- [Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling](https://agentprime.io/advisories/CVE-2026-103866.md)
  `CVE-2026-103866` · CVE record: Apache Software Foundation Apache Sling Engine · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: HTTP request smuggling, CWE-436
- [Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath](https://agentprime.io/advisories/CVE-2026-122310.md)
  `CVE-2026-122310` · CVE record: kyverno kyverno · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-436
- [CVE-2026-118517: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority: Incomplete Fix for CVE-2026-45066](https://agentprime.io/advisories/PKSA-n87g-t5cn-m1yq.md)
  `PKSA-n87g-t5cn-m1yq`, `CVE-2026-118517` · Packagist `symfony/html-sanitizer`: affected `>=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11`, fixed in `6.2.0`, `6.3.0`, `6.4.0`, `6.4.50`, `7.1.0`, `7.2.0`, `7.3.0`, `7.4.0`, `7.4.23`, `8.1.0`, `8.1.11` · CVSS 2.3 Low · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-184, CWE-436
- [CVE-2026-118517: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority: Incomplete Fix for CVE-2026-45066](https://agentprime.io/advisories/PKSA-66zq-5hky-mbzt.md)
  `PKSA-66zq-5hky-mbzt`, `CVE-2026-118517` · Packagist `symfony/symfony`: affected `>=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11`, fixed in `6.2.0`, `6.3.0`, `6.4.0`, `6.4.50`, `7.1.0`, `7.2.0`, `7.3.0`, `7.4.0`, `7.4.23`, `8.1.0`, `8.1.11` · CVSS 2.3 Low · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-184, CWE-436
- [CVE-2026-118516: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control](https://agentprime.io/advisories/PKSA-y8c5-1b7f-r1gj.md)
  `PKSA-y8c5-1b7f-r1gj`, `CVE-2026-118516` · Packagist `symfony/routing`: affected `>=4.1.0, <4.2.0 || >=4.2.0, <4.3.0 || >=4.3.0, <4.4.0 || >=4.4.0, <5.0.0 || >=5.0.0, <5.1.0 || >=5.1.0, <5.2.0 || >=5.2.0, <5.3.0 || >=5.3.0, <5.4.0 || >=5.4.0, <5.4.56 || >=6.0.0, <6.1.0 || >=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11`, fixed in `4.2.0`, `4.3.0`, `4.4.0`, `5.0.0`, `5.1.0`, `5.2.0`, `5.3.0`, `5.4.0`, `5.4.56`, `6.1.0`, `6.2.0`, `6.3.0`, `6.4.0`, `6.4.50`, `7.1.0`, `7.2.0`, `7.3.0`, `7.4.0`, `7.4.23`, `8.1.0`, `8.1.11` · CVSS 6.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control, CWE-436
- [CVE-2026-118516: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control](https://agentprime.io/advisories/PKSA-py6w-7ynw-bn9j.md)
  `PKSA-py6w-7ynw-bn9j`, `CVE-2026-118516` · Packagist `symfony/symfony`: affected `>=4.1.0, <4.2.0 || >=4.2.0, <4.3.0 || >=4.3.0, <4.4.0 || >=4.4.0, <5.0.0 || >=5.0.0, <5.1.0 || >=5.1.0, <5.2.0 || >=5.2.0, <5.3.0 || >=5.3.0, <5.4.0 || >=5.4.0, <5.4.56 || >=6.0.0, <6.1.0 || >=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11`, fixed in `4.2.0`, `4.3.0`, `4.4.0`, `5.0.0`, `5.1.0`, `5.2.0`, `5.3.0`, `5.4.0`, `5.4.56`, `6.1.0`, `6.2.0`, `6.3.0`, `6.4.0`, `6.4.50`, `7.1.0`, `7.2.0`, `7.3.0`, `7.4.0`, `7.4.23`, `8.1.0`, `8.1.11` · CVSS 6.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control, CWE-436
- [CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs](https://agentprime.io/advisories/CVE-2026-120635.md)
  `CVE-2026-120635` · CVE record · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-436
- [Google Chrome: Security issue in Platform in Google Chrome prior to 157.0.8103.38 allowed a remote…](https://agentprime.io/advisories/CVE-2026-121135.md)
  `CVE-2026-121135` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-436
- [DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation](https://agentprime.io/advisories/GHSA-j656-3hf2-fvjc.md)
  `GHSA-j656-3hf2-fvjc`, `CVE-2026-61789` · npm `@bytebase/dbhub`: affected `<0.22.6`, fixed in `0.22.6` · CVSS 6.1 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control, CWE-436
- [@fastify/http-proxy vulnerable to prefix escape via decoded route parameters](https://agentprime.io/advisories/CVE-2026-120213.md)
  `CVE-2026-120213` · CVE record: @fastify/http-proxy @fastify/http-proxy · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Path traversal, CWE-436
- [Nuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParam](https://agentprime.io/advisories/CVE-2026-120309.md)
  `CVE-2026-120309` · CVE record: nuxt nuxt · CVSS 6.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-436
- [Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13](https://agentprime.io/advisories/GHSA-5x38-2vff-x55p.md)
  `GHSA-5x38-2vff-x55p`, `CVE-2026-119190` · npm `node-forge`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 7.4 High · Not analysed yet · Published 30 Oct 2026 · Tags: Weak cryptography or TLS, CWE-436
- [Nuxt: Dot segments in the request path bypass \`server/middleware\` path checks and server route rules on page routes](https://agentprime.io/advisories/GHSA-9v7c-q64q-vv33.md)
  `GHSA-9v7c-q64q-vv33`, `CVE-2026-119200` · npm `nuxt` and 1 more: affected `>=4.6.0, <4.6.3`, fixed in `4.6.3` · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control, CWE-41, CWE-436
- [Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass](https://agentprime.io/advisories/GHSA-pq4g-8rxf-4g29.md)
  `GHSA-pq4g-8rxf-4g29`, `CVE-2026-116695` · RubyGems `crass`: affected `<1.0.8`, fixed in `1.0.8` · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-436
- [zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE](https://agentprime.io/advisories/GHSA-m665-v7pm-7grj.md)
  `GHSA-m665-v7pm-7grj`, `CVE-2026-115905` · crates.io `zip`: affected `<9.0.5`, fixed in `9.0.5` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-20, CWE-436
- [MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested comment](https://agentprime.io/advisories/CVE-2026-116272.md)
  `CVE-2026-116272` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-436
- [MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filename](https://agentprime.io/advisories/CVE-2026-116269.md)
  `CVE-2026-116269` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-436
- [MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguous](https://agentprime.io/advisories/CVE-2026-116266.md)
  `CVE-2026-116266` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-436
- [MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuations](https://agentprime.io/advisories/CVE-2026-116265.md)
  `CVE-2026-116265` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-436
- [MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary](https://agentprime.io/advisories/CVE-2026-116264.md)
  `CVE-2026-116264` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-436
- [Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped](https://agentprime.io/advisories/GHSA-g73g-hqqh-jr95.md)
  `GHSA-g73g-hqqh-jr95`, `CVE-2026-110870` · npm `nodemailer`: affected `>=3.0.0, <10.0.13`, fixed in `10.0.13` · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-20, CWE-436
- [@fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets](https://agentprime.io/advisories/CVE-2026-112362.md)
  `CVE-2026-112362` · CVE record: @fastify/express @fastify/express · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-436
- [SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney](https://agentprime.io/advisories/EEF-CVE-2026-115700.md)
  `EEF-CVE-2026-115700`, `CVE-2026-115700` · Hex `hackney`: affected `>=4.0.1, <4.9.0`, fixed in `4.9.0` · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Server-side request forgery (SSRF), CWE-436
- [adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names](https://agentprime.io/advisories/CVE-2026-116137.md)
  `CVE-2026-116137` · CVE record: cthackers adm-zip · CVSS 6.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: CWE-436
- [Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient](https://agentprime.io/advisories/GHSA-8c8m-p3m8-cjg8.md)
  `GHSA-8c8m-p3m8-cjg8`, `CVE-2026-121424` · npm `nodemailer`: affected `>=3.0.0, <10.1.4`, fixed in `10.1.4` · CVSS 8.3 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-20, CWE-436
- [Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient](https://agentprime.io/advisories/GHSA-m943-m63m-w62w.md)
  `GHSA-m943-m63m-w62w`, `CVE-2026-121425` · npm `nodemailer`: affected `>=3.0.0, <10.1.4`, fixed in `10.1.4` · CVSS 8.3 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-20, CWE-436
- [Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name](https://agentprime.io/advisories/GHSA-85x2-q946-cp5h.md)
  `GHSA-85x2-q946-cp5h`, `CVE-2026-121426` · npm `nodemailer`: affected `>=3.0.0, <10.1.4`, fixed in `10.1.4` · CVSS 8.3 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-20, CWE-436
- [fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization](https://agentprime.io/advisories/GHSA-wjr9-j795-jxcr.md)
  `GHSA-wjr9-j795-jxcr`, `CVE-2026-110180` · npm `fast-uri`: affected `>=2.4.2, <2.4.8 || >=3.1.3, <3.1.9 || >=4.0.1, <4.2.3`, fixed in `2.4.8`, `3.1.9`, `4.2.3` · CVSS 4.8 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-20, CWE-436
- [Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass \`appMiddleware\` on dynamic and catch-all routes](https://agentprime.io/advisories/GHSA-6gq8-jgmh-3ffp.md)
  `GHSA-6gq8-jgmh-3ffp`, `CVE-2026-114131` · npm `nuxt`: affected `>=3.11.0, <3.21.4 || >=4.0.0, <4.4.4`, fixed in `3.21.4`, `4.4.4` · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control, CWE-436
- [Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher](https://agentprime.io/advisories/CVE-2026-114656.md)
  `CVE-2026-114656` · CVE record: traefik traefik · CVSS 6.9 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-436
- [Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segments](https://agentprime.io/advisories/CVE-2026-84747.md)
  `CVE-2026-84747` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-436
- [Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators](https://agentprime.io/advisories/CVE-2026-114116.md)
  `CVE-2026-114116` · CVE record: vyperlang vyper · CVSS 6.0 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-436
- [@fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch](https://agentprime.io/advisories/CVE-2026-112712.md)
  `CVE-2026-112712` · CVE record: @fastify/middie @fastify/middie · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-436
- [Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse](https://agentprime.io/advisories/CVE-2026-110682.md)
  `CVE-2026-110682` · CVE record · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-436
- [kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion](https://agentprime.io/advisories/GHSA-23vg-4cjm-66q5.md)
  `GHSA-23vg-4cjm-66q5`, `CVE-2026-100351`, `GO-2026-6769` · Go `github.com/getkin/kin-openapi`: affected `>=0.144.0, <0.147.0`, fixed in `0.147.0` · CVSS 7.4 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-289, CWE-436
- [NGINX ngx_http_js_module vulnerability](https://agentprime.io/advisories/CVE-2026-101019.md)
  `CVE-2026-101019` · CVE record: F5 NGINX JavaScript · CVSS 8.3 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-436
- [Roo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Position](https://agentprime.io/advisories/CVE-2026-110206.md)
  `CVE-2026-110206` · CVE record: RooCodeInc Roo-Code · CVSS 7.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-436
- [Roo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitution](https://agentprime.io/advisories/CVE-2026-110204.md)
  `CVE-2026-110204` · CVE record: RooCodeInc Roo-Code · CVSS 7.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-436
- [Roo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronization](https://agentprime.io/advisories/CVE-2026-110203.md)
  `CVE-2026-110203` · CVE record: RooCodeInc Roo-Code · CVSS 7.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-436
- [Roo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Stripping](https://agentprime.io/advisories/CVE-2026-110202.md)
  `CVE-2026-110202` · CVE record: RooCodeInc Roo-Code · CVSS 7.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-436
- [Mistral Vibe < 2.25.4 Bash Permission Bypass via ${var@P} Prompt-Transform](https://agentprime.io/advisories/CVE-2026-109429.md)
  `CVE-2026-109429` · CVE record: mistralai mistral-vibe · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-436
- [Mistral Vibe < 2.25.5 Permission Bypass via Bash Line Continuation](https://agentprime.io/advisories/CVE-2026-109428.md)
  `CVE-2026-109428` · CVE record: mistralai mistral-vibe · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-436
- [Network-AI 5.14.0 before 5.15.2 Deny Pattern Bypass via ClaudeHookBridge extractFullTarget](https://agentprime.io/advisories/CVE-2026-109331.md)
  `CVE-2026-109331` · CVE record: Jovancoding Network-AI · CVSS 7.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-436
- [Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Rules](https://agentprime.io/advisories/CVE-2026-109297.md)
  `CVE-2026-109297` · CVE record: open-webui open-webui · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Denial of service, CWE-436
- [Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver](https://agentprime.io/advisories/CVE-2026-106430.md)
  `CVE-2026-106430` · CVE record: MongoDB C++ Driver · CVSS 6.0 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-436
- [Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection](https://agentprime.io/advisories/GHSA-w253-m66g-rx24.md)
  `GHSA-w253-m66g-rx24`, `CVE-2026-114100`, `GO-2026-6698` · Go `github.com/corazawaf/coraza/v3`: affected `>=3.0.4, <3.8.1`, fixed in `3.8.1` · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-20, CWE-436
- [Coraza: Multipart filename\* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules](https://agentprime.io/advisories/GHSA-3wr7-993q-jrff.md)
  `GHSA-3wr7-993q-jrff`, `CVE-2026-114101`, `GO-2026-6691` · Go `github.com/corazawaf/coraza/v3`: affected `<3.8.1`, fixed in `3.8.1` · CVSS 6.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-20, CWE-436
- [Coraza has Cookie Parser Confusion](https://agentprime.io/advisories/GHSA-g4qm-m288-5cp9.md)
  `GHSA-g4qm-m288-5cp9`, `CVE-2026-107835`, `GO-2026-6694` · Go `github.com/corazawaf/coraza/v3`: affected `<3.8.1`, fixed in `3.8.1` · CVSS 4.0 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-436
- [Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations](https://agentprime.io/advisories/GHSA-x26q-wvhg-fh4m.md)
  `GHSA-x26q-wvhg-fh4m`, `CVE-2026-107825`, `GO-2026-6699` · Go `github.com/corazawaf/coraza/v3`: affected `>=3.0.0, <3.8.0`, fixed in `3.8.0` · CVSS 4.0 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-20, CWE-436
- [Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection](https://agentprime.io/advisories/GHSA-5gj4-9gm7-2fx2.md)
  `GHSA-5gj4-9gm7-2fx2`, `CVE-2026-114099`, `GO-2026-6692` · Go `github.com/corazawaf/coraza/v3`: affected `>=3.0.0, <3.8.1`, fixed in `3.8.1` · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-20, CWE-436
- [Backstage: Bypass of MkDocs configuration sanitizer in TechDocs backend](https://agentprime.io/advisories/GHSA-p75x-jh7p-ppcx.md)
  `GHSA-p75x-jh7p-ppcx`, `CVE-2026-106505` · npm `@backstage/plugin-techdocs-node`: affected `<1.15.4`, fixed in `1.15.4` · CVSS 7.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-426, CWE-436
- [@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets](https://agentprime.io/advisories/GHSA-9c5c-9qcx-q35q.md)
  `GHSA-9c5c-9qcx-q35q` · npm `@nestjs/platform-fastify`: affected `<11.2.4 || >=12.0.0, <12.0.2`, fixed in `11.2.4`, `12.0.2` · CVSS 7.4 High · Not analysed yet · Published 30 Sept 2026 · Tags: Authentication bypass, CWE-436
- [fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization](https://agentprime.io/advisories/GHSA-jvvf-x445-j334.md)
  `GHSA-jvvf-x445-j334`, `CVE-2026-86818` · npm `fast-uri`: affected `>=4.1.3, <4.1.5`, fixed in `4.1.5` · CVSS 4.8 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-172, CWE-436
- [Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing](https://agentprime.io/advisories/GHSA-g57g-f23g-4646.md)
  `GHSA-g57g-f23g-4646`, `CVE-2026-100699` · npm `nodemailer`: affected `>=9.1.0, <10.0.9`, fixed in `10.0.9` · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-20, CWE-436
- [adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content](https://agentprime.io/advisories/GHSA-p634-w6r4-rjp2.md)
  `GHSA-p634-w6r4-rjp2`, `CVE-2026-114104` · npm `adm-zip`: affected `<0.6.1`, fixed in `0.6.1` · CVSS 8.2 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-436, CWE-696
- [fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority](https://agentprime.io/advisories/GHSA-58mr-gqgx-xq4g.md)
  `GHSA-58mr-gqgx-xq4g`, `CVE-2026-84394` · npm `fast-uri`: affected `>=2.4.5, <2.4.6 || >=3.1.6, <3.1.7 || >=4.1.3, <4.1.4`, fixed in `2.4.6`, `3.1.7`, `4.1.4` · CVSS 7.5 High · Not analysed yet · Published 28 Sept 2026 · Tags: CWE-436
- [elysia has Inefficient Algorithmic Complexity and Interpretation Conflict](https://agentprime.io/advisories/GHSA-9643-4qgh-g8mx.md)
  `GHSA-9643-4qgh-g8mx`, `CVE-2026-56669` · npm `elysia`: affected `<1.4.29`, fixed in `1.4.29` · CVSS 7.5 High · Not analysed yet · Published 23 Sept 2026 · Tags: Denial of service, CWE-436
- [Envoy: Potential path-matching/authentication bypass when using Envoy in combination with a backend stripping per-segment path (matrix) parameters (e.g. Apache Tomcat)](https://agentprime.io/advisories/CVE-2026-73511.md)
  `CVE-2026-73511` · CVE record: envoyproxy envoy · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-289, CWE-436
- [Envoy: RBAC Authorization Bypass via Path Parameters](https://agentprime.io/advisories/CVE-2026-73553.md)
  `CVE-2026-73553` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-436

Older: <https://agentprime.io/advisories/tag/cwe-436.md?cursor=WyIyMDI2LTA5LTIxVDIwOjE4OjQ3LjY1MDAwMFoiLCJDVkUtMjAyNi03MzU1MyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-436>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-436/>. Everything for agents: <https://agentprime.io/llms.txt>.