agentprime: CWE-441Every new CWE-441 Advisory and CVE.https://agentprime.io/CVE-2026-88983: Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validationhttps://agentprime.io/advisories/CVE-2026-88983/https://agentprime.io/advisories/CVE-2026-88983/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 21:58:53 GMTCVECVE-2026-121198: Google Chrome: Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote…https://agentprime.io/advisories/CVE-2026-121198/https://agentprime.io/advisories/CVE-2026-121198/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 20:42:59 GMTCVECVE-2026-121171: Google Chrome: Confused deputy in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote…https://agentprime.io/advisories/CVE-2026-121171/https://agentprime.io/advisories/CVE-2026-121171/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 20:42:47 GMTCVECVE-2026-121108: Google Chrome: Confused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a…https://agentprime.io/advisories/CVE-2026-121108/https://agentprime.io/advisories/CVE-2026-121108/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 20:42:40 GMTCVECVE-2026-49906: Google Android: An unprivileged application can bypass the…https://agentprime.io/advisories/CVE-2026-49906/https://agentprime.io/advisories/CVE-2026-49906/CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 20:21:08 GMTCVECVE-2026-59028: In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy.https://agentprime.io/advisories/CVE-2026-59028/https://agentprime.io/advisories/CVE-2026-59028/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 19:55:06 GMTCVECVE-2026-59015: In multiple locations, there is a possible permission bypass due to a confused deputy.https://agentprime.io/advisories/CVE-2026-59015/https://agentprime.io/advisories/CVE-2026-59015/CVSS 4.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 19:55:01 GMTCVECVE-2026-59000: In multiple locations, there is a possible permission bypass due to a confused deputy.https://agentprime.io/advisories/CVE-2026-59000/https://agentprime.io/advisories/CVE-2026-59000/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 19:54:48 GMTCVECVE-2026-58970: In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy.https://agentprime.io/advisories/CVE-2026-58970/https://agentprime.io/advisories/CVE-2026-58970/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 19:54:32 GMTCVECVE-2026-58965: In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy.https://agentprime.io/advisories/CVE-2026-58965/https://agentprime.io/advisories/CVE-2026-58965/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 19:54:28 GMTCVECVE-2026-58957: In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launch due to a confused deputy.https://agentprime.io/advisories/CVE-2026-58957/https://agentprime.io/advisories/CVE-2026-58957/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 19:54:23 GMTCVECVE-2026-58944: In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background application launch (bal) issue due to a confused deputy.https://agentprime.io/advisories/CVE-2026-58944/https://agentprime.io/advisories/CVE-2026-58944/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 19:54:14 GMTCVECVE-2026-58943: In run of AddAccountSettings.java, there is a possible background activity launch due to a confused deputy.https://agentprime.io/advisories/CVE-2026-58943/https://agentprime.io/advisories/CVE-2026-58943/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 19:54:13 GMTCVECVE-2026-58885: In multiple locations, there is a possible permission bypass due to a confused deputy.https://agentprime.io/advisories/CVE-2026-58885/https://agentprime.io/advisories/CVE-2026-58885/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 19:54:05 GMTCVECVE-2026-58884: In startTetheredHotspotRequest of WifiServiceImpl.java, there is a possible permission bypass due to a confused deputy.https://agentprime.io/advisories/CVE-2026-58884/https://agentprime.io/advisories/CVE-2026-58884/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 19:54:04 GMTCVECVE-2026-58877: In checkNearbyDevicesPermission of WifiP2pServiceImpl.java, there is a possible permission bypass due to a confused deputy.https://agentprime.io/advisories/CVE-2026-58877/https://agentprime.io/advisories/CVE-2026-58877/CVSS 4.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 19:54:00 GMTCVECVE-2026-55289: In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused deputy.https://agentprime.io/advisories/CVE-2026-55289/https://agentprime.io/advisories/CVE-2026-55289/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 19:53:33 GMTCVECVE-2026-55271: In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused deputy.https://agentprime.io/advisories/CVE-2026-55271/https://agentprime.io/advisories/CVE-2026-55271/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 19:53:27 GMTCVECVE-2026-55264: In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible information leak due to a confused deputy.https://agentprime.io/advisories/CVE-2026-55264/https://agentprime.io/advisories/CVE-2026-55264/CVSS 4.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 19:53:26 GMTCVECVE-2026-49931: In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused deputy.https://agentprime.io/advisories/CVE-2026-49931/https://agentprime.io/advisories/CVE-2026-49931/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 19:53:15 GMTCVECVE-2026-49922: In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confused deputy.https://agentprime.io/advisories/CVE-2026-49922/https://agentprime.io/advisories/CVE-2026-49922/CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Nov 2026 19:53:12 GMTCVECVE-2026-118687: Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authenticationhttps://agentprime.io/advisories/CVE-2026-118687/https://agentprime.io/advisories/CVE-2026-118687/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 18:59:56 GMTCVECVE-2026-67077: HCL BigFix AEX is affected by multiple security vulnerabilities.https://agentprime.io/advisories/CVE-2026-67077/https://agentprime.io/advisories/CVE-2026-67077/CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Oct 2026 12:26:30 GMTCVELiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Keyhttps://agentprime.io/advisories/GHSA-7hp6-4w63-5g45/https://agentprime.io/advisories/GHSA-7hp6-4w63-5g45/litellm >=1.91.0, <1.100.4 || >=1.101.0, <1.101.3 || >=1.102.0, <1.102.2 || >=1.103.0, <1.103.1 || >=1.104.0rc1, <1.104.0rc2, fixed in 1.100.4, 1.101.3, 1.102.2, 1.103.1, 1.104.0rc2. CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 27 Oct 2026 15:04:14 GMTPyPIlitellmcriticalStorybook: Missing origin validation in Storybook preview allows code injection from malicious websiteshttps://agentprime.io/advisories/GHSA-f2ph-cmg5-wxc8/https://agentprime.io/advisories/GHSA-f2ph-cmg5-wxc8/storybook >=8.0.0, <8.6.19 || >=9.0.0, <9.1.21 || >=10.0.0, <10.6.2 || >=11.0.0-alpha.0, <11.0.0-alpha.6, fixed in 8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6. CVSS 8.6 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Wed, 21 Oct 2026 17:23:29 GMTnpmstorybook@storybook/addon-mcp@storybook/addon-vitest@storybook/core@storybook/core-server@storybook/experimental-addon-testCVE-2026-114478: Unintended Proxy or Intermediary ('Confused Deputy') in hMailServerhttps://agentprime.io/advisories/CVE-2026-114478/https://agentprime.io/advisories/CVE-2026-114478/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 15:12:35 GMTCVECVE-2026-113024: Google Chrome: Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a…https://agentprime.io/advisories/CVE-2026-113024/https://agentprime.io/advisories/CVE-2026-113024/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 21:02:43 GMTCVECVE-2026-113152: Google Chrome: Confused deputy in SignIn in Google Chrome prior to 156.0.8078.47 allowed a remote…https://agentprime.io/advisories/CVE-2026-113152/https://agentprime.io/advisories/CVE-2026-113152/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 21:02:42 GMTCVECVE-2026-113247: Google Chrome: Confused deputy in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote…https://agentprime.io/advisories/CVE-2026-113247/https://agentprime.io/advisories/CVE-2026-113247/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 21:02:41 GMTCVECVE-2026-113099: Google Chrome: Confused deputy in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed…https://agentprime.io/advisories/CVE-2026-113099/https://agentprime.io/advisories/CVE-2026-113099/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 21:02:28 GMTCVECVE-2026-113202: Google Chrome: Confused deputy in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote…https://agentprime.io/advisories/CVE-2026-113202/https://agentprime.io/advisories/CVE-2026-113202/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 21:02:21 GMTCVECVE-2026-113190: Google Chrome: Confused deputy in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote…https://agentprime.io/advisories/CVE-2026-113190/https://agentprime.io/advisories/CVE-2026-113190/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 21:02:15 GMTCVECVE-2026-113118: Google Chrome: Confused deputy in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote…https://agentprime.io/advisories/CVE-2026-113118/https://agentprime.io/advisories/CVE-2026-113118/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 21:02:11 GMTCVECVE-2026-113127: Google Chrome: Confused deputy in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote…https://agentprime.io/advisories/CVE-2026-113127/https://agentprime.io/advisories/CVE-2026-113127/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 21:02:05 GMTCVECVE-2026-113301: Google Chrome: Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a…https://agentprime.io/advisories/CVE-2026-113301/https://agentprime.io/advisories/CVE-2026-113301/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 21:02:00 GMTCVECVE-2026-105311: Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputyhttps://agentprime.io/advisories/CVE-2026-105311/https://agentprime.io/advisories/CVE-2026-105311/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 11:30:09 GMTCVECVE-2026-101897: Angular DevTools (Local DoS)https://agentprime.io/advisories/CVE-2026-101897/https://agentprime.io/advisories/CVE-2026-101897/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 15:03:36 GMTCVECVE-2026-70148: Windows Broadcast DVR User Service Information Disclosure Vulnerabilityhttps://agentprime.io/advisories/CVE-2026-70148/https://agentprime.io/advisories/CVE-2026-70148/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 19:01:08 GMTCVECVE-2026-83837: Windows Kernel-Mode Drivers Elevation of Privilege Vulnerabilityhttps://agentprime.io/advisories/CVE-2026-83837/https://agentprime.io/advisories/CVE-2026-83837/CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 19:00:56 GMTCVECVE-2026-93294: Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIshttps://agentprime.io/advisories/CVE-2026-93294/https://agentprime.io/advisories/CVE-2026-93294/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 17:05:49 GMTCVECVE-2026-109373: ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookiehttps://agentprime.io/advisories/CVE-2026-109373/https://agentprime.io/advisories/CVE-2026-109373/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 16:05:45 GMTCVEcriticalTinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragmenthttps://agentprime.io/advisories/GHSA-x34j-47hf-4xg7/https://agentprime.io/advisories/GHSA-x34j-47hf-4xg7/tinacms <3.14.0, fixed in 3.14.0. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 09 Oct 2026 20:56:48 GMTnpmtinacms@tinacms/appcriticalCVE-2026-107336: Authentication Bypass by Spoofing in Malcolmhttps://agentprime.io/advisories/CVE-2026-107336/https://agentprime.io/advisories/CVE-2026-107336/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 08 Oct 2026 17:20:46 GMTCVEAsyncHttpClient: Replay to a different host sends the original host request and credentials to the new hosthttps://agentprime.io/advisories/GHSA-jmqq-x5g9-9p2w/https://agentprime.io/advisories/GHSA-jmqq-x5g9-9p2w/org.asynchttpclient:async-http-client >=3.0.0, <3.0.13 || >=2.0.0, <2.16.1, fixed in 3.0.13, 2.16.1. CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.Thu, 08 Oct 2026 16:30:46 GMTMavenorg.asynchttpclient:async-http-clientcriticalCVE-2026-107232: AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECThttps://agentprime.io/advisories/CVE-2026-107232/https://agentprime.io/advisories/CVE-2026-107232/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 07 Oct 2026 21:09:03 GMTCVEBackstage's scaffolder credential handling may allow unintended GitHub authentication fallbackhttps://agentprime.io/advisories/GHSA-29gx-h2m3-xw44/https://agentprime.io/advisories/GHSA-29gx-h2m3-xw44/@backstage/plugin-scaffolder-backend <4.1.0, fixed in 4.1.0. CVSS 6.4 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Wed, 07 Oct 2026 18:01:53 GMTnpm@backstage/plugin-scaffolder-backend@backstage/plugin-scaffolder-backend-module-azure@backstage/plugin-scaffolder-backend-module-bitbucket-cloud@backstage/plugin-scaffolder-backend-module-bitbucket-server@backstage/plugin-scaffolder-backend-module-github@backstage/plugin-scaffolder-backend-module-gitlabBackstage: Unsupported catalog cluster authentication mode in kubernetes backendhttps://agentprime.io/advisories/GHSA-h53x-hjx6-25gr/https://agentprime.io/advisories/GHSA-h53x-hjx6-25gr/@backstage/plugin-kubernetes-backend <0.21.10, fixed in 0.21.10. CVSS 3.5 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Wed, 07 Oct 2026 18:01:08 GMTnpm@backstage/plugin-kubernetes-backendCVE-2026-102255: Server-side request forgery in SonicWall SMA1000https://agentprime.io/advisories/CVE-2026-102255/https://agentprime.io/advisories/CVE-2026-102255/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 07 Oct 2026 13:07:13 GMTCVEcriticalCVE-2026-94205: Gitea fork workflow approval bypass through maintainer-triggered eventshttps://agentprime.io/advisories/CVE-2026-94205/https://agentprime.io/advisories/CVE-2026-94205/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 06 Oct 2026 19:25:04 GMTCVEcriticalCVE-2026-106221: Google Chrome: Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed…https://agentprime.io/advisories/CVE-2026-106221/https://agentprime.io/advisories/CVE-2026-106221/CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 06 Oct 2026 18:41:38 GMTCVE