agentprime: CWE-436Every new CWE-436 Advisory and CVE.https://agentprime.io/CVE-2026-104269: ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)https://agentprime.io/advisories/CVE-2026-104269/https://agentprime.io/advisories/CVE-2026-104269/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 15:51:18 GMTCVECVE-2026-103866: Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smugglinghttps://agentprime.io/advisories/CVE-2026-103866/https://agentprime.io/advisories/CVE-2026-103866/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 12:33:00 GMTCVECVE-2026-122310: Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPathhttps://agentprime.io/advisories/CVE-2026-122310/https://agentprime.io/advisories/CVE-2026-122310/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 02:25:12 GMTCVEcriticalCVE-2026-118517: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority: Incomplete Fix for CVE-2026-45066https://agentprime.io/advisories/PKSA-n87g-t5cn-m1yq/https://agentprime.io/advisories/PKSA-n87g-t5cn-m1yq/symfony/html-sanitizer >=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11, fixed in 6.2.0, 6.3.0, 6.4.0, 6.4.50, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.23, 8.1.0, 8.1.11. CVSS 2.3 (Low). Published by Packagist. Not analysed by agentprime yet.Wed, 04 Nov 2026 11:23:22 GMTPackagistsymfony/html-sanitizerCVE-2026-118517: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority: Incomplete Fix for CVE-2026-45066https://agentprime.io/advisories/PKSA-66zq-5hky-mbzt/https://agentprime.io/advisories/PKSA-66zq-5hky-mbzt/symfony/symfony >=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11, fixed in 6.2.0, 6.3.0, 6.4.0, 6.4.50, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.23, 8.1.0, 8.1.11. CVSS 2.3 (Low). Published by Packagist. Not analysed by agentprime yet.Wed, 04 Nov 2026 11:23:22 GMTPackagistsymfony/symfonyCVE-2026-118516: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Controlhttps://agentprime.io/advisories/PKSA-y8c5-1b7f-r1gj/https://agentprime.io/advisories/PKSA-y8c5-1b7f-r1gj/symfony/routing >=4.1.0, <4.2.0 || >=4.2.0, <4.3.0 || >=4.3.0, <4.4.0 || >=4.4.0, <5.0.0 || >=5.0.0, <5.1.0 || >=5.1.0, <5.2.0 || >=5.2.0, <5.3.0 || >=5.3.0, <5.4.0 || >=5.4.0, <5.4.56 || >=6.0.0, <6.1.0 || >=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11, fixed in 4.2.0, 4.3.0, 4.4.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.56, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.50, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.23, 8.1.0, 8.1.11. CVSS 6.3 (Medium). Published by Packagist. Not analysed by agentprime yet.Wed, 04 Nov 2026 10:45:07 GMTPackagistsymfony/routingCVE-2026-118516: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Controlhttps://agentprime.io/advisories/PKSA-py6w-7ynw-bn9j/https://agentprime.io/advisories/PKSA-py6w-7ynw-bn9j/symfony/symfony >=4.1.0, <4.2.0 || >=4.2.0, <4.3.0 || >=4.3.0, <4.4.0 || >=4.4.0, <5.0.0 || >=5.0.0, <5.1.0 || >=5.1.0, <5.2.0 || >=5.2.0, <5.3.0 || >=5.3.0, <5.4.0 || >=5.4.0, <5.4.56 || >=6.0.0, <6.1.0 || >=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11, fixed in 4.2.0, 4.3.0, 4.4.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.56, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.50, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.23, 8.1.0, 8.1.11. CVSS 6.3 (Medium). Published by Packagist. Not analysed by agentprime yet.Wed, 04 Nov 2026 10:45:07 GMTPackagistsymfony/symfonyCVE-2026-120635: CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCshttps://agentprime.io/advisories/CVE-2026-120635/https://agentprime.io/advisories/CVE-2026-120635/Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 23:40:15 GMTCVECVE-2026-121135: Google Chrome: Security issue in Platform in Google Chrome prior to 157.0.8103.38 allowed a remote…https://agentprime.io/advisories/CVE-2026-121135/https://agentprime.io/advisories/CVE-2026-121135/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 20:42:53 GMTCVEDBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validationhttps://agentprime.io/advisories/GHSA-j656-3hf2-fvjc/https://agentprime.io/advisories/GHSA-j656-3hf2-fvjc/@bytebase/dbhub <0.22.6, fixed in 0.22.6. CVSS 6.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Mon, 02 Nov 2026 17:57:51 GMTnpm@bytebase/dbhubCVE-2026-120213: @fastify/http-proxy vulnerable to prefix escape via decoded route parametershttps://agentprime.io/advisories/CVE-2026-120213/https://agentprime.io/advisories/CVE-2026-120213/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 10:15:08 GMTCVEcriticalCVE-2026-120309: Nuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParamhttps://agentprime.io/advisories/CVE-2026-120309/https://agentprime.io/advisories/CVE-2026-120309/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 02:01:09 GMTCVEForge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13https://agentprime.io/advisories/GHSA-5x38-2vff-x55p/https://agentprime.io/advisories/GHSA-5x38-2vff-x55p/node-forge <1.4.1, fixed in 1.4.1. CVSS 7.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 30 Oct 2026 23:01:46 GMTnpmnode-forgeNuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routeshttps://agentprime.io/advisories/GHSA-9v7c-q64q-vv33/https://agentprime.io/advisories/GHSA-9v7c-q64q-vv33/nuxt >=4.6.0, <4.6.3, fixed in 4.6.3. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 30 Oct 2026 23:00:53 GMTnpmnuxt@nuxt/nitro-serverCrass: Incorrect tokenization of bad URLs enables CSS sanitizer bypasshttps://agentprime.io/advisories/GHSA-pq4g-8rxf-4g29/https://agentprime.io/advisories/GHSA-pq4g-8rxf-4g29/crass <1.0.8, fixed in 1.0.8. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Wed, 28 Oct 2026 22:42:53 GMTRubyGemscrasszip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCEhttps://agentprime.io/advisories/GHSA-m665-v7pm-7grj/https://agentprime.io/advisories/GHSA-m665-v7pm-7grj/zip <9.0.5, fixed in 9.0.5. CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.Wed, 28 Oct 2026 21:09:50 GMTcrates.iozipcriticalCVE-2026-116272: MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate boundary parameter whose name contains a nested commenthttps://agentprime.io/advisories/CVE-2026-116272/https://agentprime.io/advisories/CVE-2026-116272/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 17:34:25 GMTCVECVE-2026-116269: MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename with a hyphenated language tag into an empty recommended filenamehttps://agentprime.io/advisories/CVE-2026-116269/https://agentprime.io/advisories/CVE-2026-116269/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 17:33:22 GMTCVECVE-2026-116266: MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded multipart boundary without flagging the parse as ambiguoushttps://agentprime.io/advisories/CVE-2026-116266/https://agentprime.io/advisories/CVE-2026-116266/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 17:32:28 GMTCVECVE-2026-116265: MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous multipart boundary written as RFC 2231 continuationshttps://agentprime.io/advisories/CVE-2026-116265/https://agentprime.io/advisories/CVE-2026-116265/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 17:32:11 GMTCVECVE-2026-116264: MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundaryhttps://agentprime.io/advisories/CVE-2026-116264/https://agentprime.io/advisories/CVE-2026-116264/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 17:31:52 GMTCVENodemailer: RFC 5322 comment inside an angle-bracket address is never strippedhttps://agentprime.io/advisories/GHSA-g73g-hqqh-jr95/https://agentprime.io/advisories/GHSA-g73g-hqqh-jr95/nodemailer >=3.0.0, <10.0.13, fixed in 10.0.13. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 27 Oct 2026 15:04:36 GMTnpmnodemailerCVE-2026-112362: @fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targetshttps://agentprime.io/advisories/CVE-2026-112362/https://agentprime.io/advisories/CVE-2026-112362/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 11:27:59 GMTCVEcriticalSSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackneyhttps://agentprime.io/advisories/EEF-CVE-2026-115700/https://agentprime.io/advisories/EEF-CVE-2026-115700/hackney >=4.0.1, <4.9.0, fixed in 4.9.0. CVSS 6.9 (Medium). Published by OSV. Not analysed by agentprime yet.Mon, 26 Oct 2026 13:49:02 GMTHexhackneyCVE-2026-116137: adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Nameshttps://agentprime.io/advisories/CVE-2026-116137/https://agentprime.io/advisories/CVE-2026-116137/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 25 Oct 2026 11:51:01 GMTCVENodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipienthttps://agentprime.io/advisories/GHSA-8c8m-p3m8-cjg8/https://agentprime.io/advisories/GHSA-8c8m-p3m8-cjg8/nodemailer >=3.0.0, <10.1.4, fixed in 10.1.4. CVSS 8.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 23 Oct 2026 21:53:04 GMTnpmnodemailerNodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipienthttps://agentprime.io/advisories/GHSA-m943-m63m-w62w/https://agentprime.io/advisories/GHSA-m943-m63m-w62w/nodemailer >=3.0.0, <10.1.4, fixed in 10.1.4. CVSS 8.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 23 Oct 2026 21:51:52 GMTnpmnodemailerNodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not namehttps://agentprime.io/advisories/GHSA-85x2-q946-cp5h/https://agentprime.io/advisories/GHSA-85x2-q946-cp5h/nodemailer >=3.0.0, <10.1.4, fixed in 10.1.4. CVSS 8.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 23 Oct 2026 21:51:18 GMTnpmnodemailerfast-uri vulnerable to host confusion via unchecked WHATWG host canonicalizationhttps://agentprime.io/advisories/GHSA-wjr9-j795-jxcr/https://agentprime.io/advisories/GHSA-wjr9-j795-jxcr/fast-uri >=2.4.2, <2.4.8 || >=3.1.3, <3.1.9 || >=4.0.1, <4.2.3, fixed in 2.4.8, 3.1.9, 4.2.3. CVSS 4.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 23 Oct 2026 21:37:59 GMTnpmfast-uriNuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routeshttps://agentprime.io/advisories/GHSA-6gq8-jgmh-3ffp/https://agentprime.io/advisories/GHSA-6gq8-jgmh-3ffp/nuxt >=3.11.0, <3.21.4 || >=4.0.0, <4.4.4, fixed in 3.21.4, 4.4.4. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Thu, 22 Oct 2026 16:50:53 GMTnpmnuxtCVE-2026-114656: Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcherhttps://agentprime.io/advisories/CVE-2026-114656/https://agentprime.io/advisories/CVE-2026-114656/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 22 Oct 2026 01:43:42 GMTCVECVE-2026-84747: Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segmentshttps://agentprime.io/advisories/CVE-2026-84747/https://agentprime.io/advisories/CVE-2026-84747/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 12:13:28 GMTCVECVE-2026-114116: Vyper through 0.5.0b1 Literal Value Manipulation via Line Separatorshttps://agentprime.io/advisories/CVE-2026-114116/https://agentprime.io/advisories/CVE-2026-114116/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 00:37:13 GMTCVECVE-2026-112712: @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatchhttps://agentprime.io/advisories/CVE-2026-112712/https://agentprime.io/advisories/CVE-2026-112712/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 20:43:48 GMTCVEcriticalCVE-2026-110682: Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parsehttps://agentprime.io/advisories/CVE-2026-110682/https://agentprime.io/advisories/CVE-2026-110682/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Oct 2026 18:12:09 GMTCVEkin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusionhttps://agentprime.io/advisories/GHSA-23vg-4cjm-66q5/https://agentprime.io/advisories/GHSA-23vg-4cjm-66q5/github.com/getkin/kin-openapi >=0.144.0, <0.147.0, fixed in 0.147.0. CVSS 7.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Thu, 15 Oct 2026 20:19:20 GMTGogithub.com/getkin/kin-openapiCVE-2026-101019: NGINX ngx_http_js_module vulnerabilityhttps://agentprime.io/advisories/CVE-2026-101019/https://agentprime.io/advisories/CVE-2026-101019/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 14:40:29 GMTCVECVE-2026-110206: Roo-Code through 3.54.0 Auto-Approve Bypass via Command Substitution at Command Positionhttps://agentprime.io/advisories/CVE-2026-110206/https://agentprime.io/advisories/CVE-2026-110206/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 18:49:58 GMTCVECVE-2026-110204: Roo-Code through 3.54.0 Auto-Approve Bypass via Funsub Command Substitutionhttps://agentprime.io/advisories/CVE-2026-110204/https://agentprime.io/advisories/CVE-2026-110204/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 18:49:56 GMTCVECVE-2026-110203: Roo-Code through 3.54.0 Auto-Approve Bypass via Quote Masking Desynchronizationhttps://agentprime.io/advisories/CVE-2026-110203/https://agentprime.io/advisories/CVE-2026-110203/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 18:49:56 GMTCVECVE-2026-110202: Roo-Code through 3.54.0 Auto-Approve Bypass via Redirect Operator Strippinghttps://agentprime.io/advisories/CVE-2026-110202/https://agentprime.io/advisories/CVE-2026-110202/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 18:49:55 GMTCVECVE-2026-109429: Mistral Vibe < 2.25.4 Bash Permission Bypass via ${var@P} Prompt-Transformhttps://agentprime.io/advisories/CVE-2026-109429/https://agentprime.io/advisories/CVE-2026-109429/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 18:22:07 GMTCVECVE-2026-109428: Mistral Vibe < 2.25.5 Permission Bypass via Bash Line Continuationhttps://agentprime.io/advisories/CVE-2026-109428/https://agentprime.io/advisories/CVE-2026-109428/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 18:17:05 GMTCVECVE-2026-109331: Network-AI 5.14.0 before 5.15.2 Deny Pattern Bypass via ClaudeHookBridge extractFullTargethttps://agentprime.io/advisories/CVE-2026-109331/https://agentprime.io/advisories/CVE-2026-109331/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:05:20 GMTCVECVE-2026-109297: Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence Ruleshttps://agentprime.io/advisories/CVE-2026-109297/https://agentprime.io/advisories/CVE-2026-109297/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:04:56 GMTCVECVE-2026-106430: Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driverhttps://agentprime.io/advisories/CVE-2026-106430/https://agentprime.io/advisories/CVE-2026-106430/CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 08 Oct 2026 18:45:56 GMTCVECoraza: URL-encoded form Content-Type parameters bypass Coraza body inspectionhttps://agentprime.io/advisories/GHSA-w253-m66g-rx24/https://agentprime.io/advisories/GHSA-w253-m66g-rx24/github.com/corazawaf/coraza/v3 >=3.0.4, <3.8.1, fixed in 3.8.1. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Thu, 08 Oct 2026 17:51:53 GMTGogithub.com/corazawaf/coraza/v3Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based ruleshttps://agentprime.io/advisories/GHSA-3wr7-993q-jrff/https://agentprime.io/advisories/GHSA-3wr7-993q-jrff/github.com/corazawaf/coraza/v3 <3.8.1, fixed in 3.8.1. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Thu, 08 Oct 2026 17:51:36 GMTGogithub.com/corazawaf/coraza/v3Coraza has Cookie Parser Confusionhttps://agentprime.io/advisories/GHSA-g4qm-m288-5cp9/https://agentprime.io/advisories/GHSA-g4qm-m288-5cp9/github.com/corazawaf/coraza/v3 <3.8.1, fixed in 3.8.1. CVSS 4.0 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Thu, 08 Oct 2026 17:51:30 GMTGogithub.com/corazawaf/coraza/v3Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrationshttps://agentprime.io/advisories/GHSA-x26q-wvhg-fh4m/https://agentprime.io/advisories/GHSA-x26q-wvhg-fh4m/github.com/corazawaf/coraza/v3 >=3.0.0, <3.8.0, fixed in 3.8.0. CVSS 4.0 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Thu, 08 Oct 2026 17:46:00 GMTGogithub.com/corazawaf/coraza/v3