agentprime: CWE-488

CVE-2026-122233: FrankenPHP before 1.13.4 Cross-Request Response Header Leak in Worker Mode

Wed, 04 Nov 2026 21:06:41 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-121966: Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak

Wed, 04 Nov 2026 15:33:28 GMT

CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-120634: CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer

Tue, 03 Nov 2026 23:40:08 GMT

Published by the CVE Program. Not analysed by agentprime yet.

Strands Agents SDK: Exposure of data element to wrong session in the A2A Server

Fri, 23 Oct 2026 20:48:29 GMT

@strands-agents/sdk <1.5.0, fixed in 1.5.0. CVSS 8.6 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-114637: Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak

Thu, 22 Oct 2026 01:43:37 GMT

CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-112921: Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request

Wed, 21 Oct 2026 21:37:54 GMT

CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-107929: local interface connection reuse mixup

Tue, 20 Oct 2026 20:29:28 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-86411: FTP connection reuse inherits client-certificate

Tue, 20 Oct 2026 20:02:03 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-85296: Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State

Mon, 19 Oct 2026 10:38:11 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-85245: Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target

Mon, 19 Oct 2026 10:32:44 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module

Thu, 15 Oct 2026 20:14:29 GMT

github.com/dunglas/frankenphp <1.12.5, fixed in 1.12.5. CVSS 7.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-103869: Pulp-ansible: bearer tokens are reused across remotes in a worker

Wed, 07 Oct 2026 05:46:15 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-103868: Pulp-container: registry credentials are reused across remotes in a worker

Wed, 07 Oct 2026 05:46:12 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-82806: Apache APISIX: cross-request permission pollution via static permission list mutation

Thu, 01 Oct 2026 10:58:32 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-103544: datadrivenconstruction OpenConstructionERP Al Provider Configuration ai_client.py wrong session

Thu, 01 Oct 2026 06:15:12 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

rclone: FTP cross-session auth-proxy backend confusion

Thu, 10 Sep 2026 22:46:33 GMT

github.com/rclone/rclone >=1.64.0, <1.75.1, fixed in 1.75.1. CVSS 7.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-84685: Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management

Tue, 08 Sep 2026 20:18:48 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-86492: JetBrains YouTrack: In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft…

Mon, 07 Sep 2026 16:26:46 GMT

CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-80231: native CA store conn reuse

Sun, 06 Sep 2026 17:48:38 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-19931: Negotiate ambient user conn reuse

Sun, 06 Sep 2026 17:47:43 GMT

CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-18489: IBM ContextForge Translate is affected by cross-client credential context confusion

Fri, 04 Sep 2026 16:23:08 GMT

CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic

Sun, 30 Aug 2026 18:17:13 GMT

ash_graphql >=1.4.0, <1.11.0, fixed in 1.11.0. CVSS 2.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure

Fri, 07 Aug 2026 18:42:01 GMT

hono >=3.8.0, <4.12.34, fixed in 4.12.34. CVSS 4.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-16326: consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

Wed, 29 Jul 2026 18:40:08 GMT

CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-16498: terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

Tue, 28 Jul 2026 17:57:45 GMT

CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

ViewComponent: Reused Component Instances Retain Stale Render Context

Wed, 15 Jul 2026 22:51:33 GMT

view_component >=4.0.0, <4.12.0, fixed in 4.12.0. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-14621: FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong session

Sat, 04 Jul 2026 08:15:08 GMT

CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-8458: wrong reuse for different services

Fri, 03 Jul 2026 06:14:42 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

n8n: Merge Node SQL Mode Prototype Pollution

Tue, 16 Jun 2026 19:01:16 GMT

n8n <2.25.7 || >=2.26.0, <2.26.2, fixed in 2.25.7, 2.26.2. CVSS 6.0 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-9831: ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race Condition

Fri, 29 May 2026 21:19:17 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Casdoor SAML callback handler accepts any well-formed SAMLResponse sent to /api/acs without verifying that it corresponds to an AuthnRequest

Thu, 28 May 2026 18:30:32 GMT

github.com/casdoor/casdoor <=1.1000.1-0.20260321120606-239e8bd69487, no fixed version yet. CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-46416: Microsoft UFO shared WebSocket handler state causes cross-client response hijacking

Wed, 27 May 2026 21:56:14 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-5773: wrong reuse of SMB connection

Wed, 13 May 2026 08:27:42 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-34391: Fleet Vulnerable to Windows MDM cross-device command disclosure

Fri, 27 Mar 2026 19:19:48 GMT

CVSS 6.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

NATS is vulnerable to MQTT hijacking via Client ID

Tue, 24 Mar 2026 21:39:52 GMT

github.com/nats-io/nats-server/v2 <2.11.15 || >=2.12.0-RC.1, <2.12.6, fixed in 2.11.15, 2.12.6. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-23919: Insufficient isolation of JavaScript (Duktape) execution context on Zabbix Server

Tue, 24 Mar 2026 18:26:43 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-15576: Jail chroot escape via fd exchange with a different jail

Mon, 09 Mar 2026 11:54:20 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused

Fri, 20 Feb 2026 21:14:49 GMT

lettermint <1.5.1, fixed in 1.5.1. CVSS 4.7 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-23844: Whisper Money has IDOR Vulnerability on sync/balances endpoint

Mon, 19 Jan 2026 20:43:29 GMT

CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-23646: OpenProject users can delete other user's session, causing them to be logged out

Mon, 19 Jan 2026 17:48:03 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-24934: SO_REUSEPORT_LB breaks connect(2) for UDP sockets

Wed, 22 Oct 2025 17:43:12 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-47928: Spotipy repo vulnerable to secrets exfiltration via `pull_request_target`

Thu, 15 May 2025 20:09:48 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-30073: An issue was discovered in OPC cardsystems Webapp Aufwertung 2.1.0.

Wed, 26 Mar 2025 00:00:00 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-2312: cifs.upcall makes an upcall to the wrong namespace in containerized environments

Tue, 25 Mar 2025 18:08:02 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-8314: Improper session handling in B&R APROL

Tue, 25 Mar 2025 04:30:17 GMT

CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-27606: Element Android PIN autologout bypass

Fri, 14 Mar 2025 16:56:23 GMT

CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Quarkus REST Endpoint Request Parameter Leakage Due to Shared Instance

Thu, 13 Feb 2025 15:31:25 GMT

io.quarkus:quarkus-rest >=3.16.0.CR1, <3.18.2 || >=3.9.0.CR1, <3.15.3.1 || <3.8.6.1, fixed in 3.18.2, 3.15.3.1, 3.8.6.1. CVSS 8.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

pgAdmin has Incorrect Default Permissions

Thu, 09 Jan 2025 09:31:42 GMT

pgadmin4 <7.0, fixed in 7.0. CVSS 8.0 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2024-11094: 404 Solution <= 2.35.17 - Missing Authentication to Sensitive Information Exposure

Sat, 16 Nov 2024 09:36:36 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-5148: Gnome-remote-desktop: inadequate validation of session agents using d-bus methods may expose rdp tls certificate

Mon, 02 Sep 2024 11:03:18 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.