agentprime: CWE-501

CVE-2026-62146: Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket

Wed, 30 Sep 2026 11:49:20 GMT

CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-102709: Information disclosure in Eclipse Foundation Eclipse ThreadX

Tue, 29 Sep 2026 17:36:17 GMT

CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-54248: Doco-CD has an OCI Trust Policy Bypass via Artifact-Contained Configuration

Fri, 11 Sep 2026 21:24:26 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-44091: Creation of a new configuration by posting a malicious ID to MQTT

Thu, 30 Jul 2026 06:47:37 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

vLLM: OpenAI auth bypass

Tue, 16 Jun 2026 17:36:41 GMT

vllm >=0.3.0, <0.22.0, fixed in 0.22.0. CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`

Mon, 15 Jun 2026 19:59:09 GMT

dompurify <3.4.7, fixed in 3.4.7. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks

Mon, 15 Jun 2026 19:56:35 GMT

dompurify <3.4.6, fixed in 3.4.6. CVSS 6.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-33828: Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability

Tue, 09 Jun 2026 17:04:29 GMT

CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules

Tue, 05 May 2026 19:23:45 GMT

gix >=0.31.0, <0.83.0, fixed in 0.83.0. CVSS 7.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Traefik's ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass authentication

Fri, 24 Apr 2026 16:31:24 GMT

github.com/traefik/traefik <=1.7.34, no fixed version yet. CVSS 7.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel

Thu, 09 Apr 2026 14:22:23 GMT

openclaw <2026.4.8, fixed in 2026.4.8. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade

Thu, 09 Apr 2026 14:22:14 GMT

openclaw <2026.4.8, fixed in 2026.4.8. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Electron: Context Isolation bypass via contextBridge VideoFrame transfer

Fri, 03 Apr 2026 02:46:56 GMT

electron >=39.0.0-alpha.1, <39.8.0 || >=40.0.0-alpha.1, <40.7.0 || >=41.0.0-alpha.1, <41.0.0-beta.8, fixed in 39.8.0, 40.7.0, 41.0.0-beta.8. CVSS 8.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-24153: NVIDIA Jetson Linux has a vulnerability in initrd, where the nvluks trusted application is not disabled.

Tue, 31 Mar 2026 16:23:14 GMT

CVSS 5.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

vLLM has Hardcoded Trust Override in Model Files Enables RCE Despite Explicit User Opt-Out

Fri, 27 Mar 2026 15:27:20 GMT

vllm >=0.10.1, <0.18.0, fixed in 0.18.0. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-4687: Sandbox escape due to incorrect boundary conditions in the Telemetry component

Tue, 24 Mar 2026 12:30:22 GMT

CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Claude Code has Sandbox Escape via Persistent Configuration Injection in settings.json

Fri, 06 Feb 2026 19:14:33 GMT

@anthropic-ai/claude-code <2.1.2, fixed in 2.1.2. CVSS 7.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Universal Tool Calling Protocol (UTCP) client library for Python vulnerable to Trust Boundary Violation through Manual JSON specification

Sat, 13 Dec 2025 18:30:21 GMT

utcp <1.1.0, fixed in 1.1.0. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events

Fri, 07 Nov 2025 17:37:33 GMT

open-webui <0.6.35, fixed in 0.6.35. CVSS 7.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-61884: Server-side request forgery in Oracle Corporation Oracle Configurator

Sun, 12 Oct 2025 02:34:51 GMT

CVSS 7.5 (High). Critical: In CISA’s KEV catalogue since 20 Oct 2025: it is known to be exploited. CVSS score 7.5 (7.0 or more) and EPSS 0.96 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-49714: Visual Studio Code Python Extension Remote Code Execution Vulnerability

Tue, 08 Jul 2025 16:58:08 GMT

CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

Prevent GitHub CLI and extensions from executing arbitrary commands from compromised GitHub Enterprise Server

Fri, 30 May 2025 15:30:39 GMT

github.com/cli/go-gh/v2 <2.12.1, fixed in 2.12.1. CVSS 2.6 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-1118: Grub2: commands/dump: the dump command is not in lockdown when secure boot is enabled

Wed, 19 Feb 2025 17:54:27 GMT

CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-49050: Visual Studio Code Python Extension Remote Code Execution Vulnerability

Tue, 12 Nov 2024 17:54:26 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-3661: DHCP routing options can manipulate interface-based VPN traffic

Mon, 06 May 2024 18:31:21 GMT

CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-20265: A vulnerability in the boot process of Cisco Access Point (AP) Software could allow an unauthenticated, physical attacker to bypass the Cisco Secure Boot functionality and load a software image that…

Wed, 27 Mar 2024 17:03:54 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

kubevirt-csi: PersistentVolume allows access to HCP's root node

Thu, 07 Mar 2024 21:30:21 GMT

github.com/kubevirt/csi-driver <0.0.0-202403081943-cc28dcbb0afc14, fixed in 0.0.0-202403081943-cc28dcbb0afc14. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Duplicate Advisory: Sandbox escape in Artemis Java Test Sandbox

Fri, 19 Jan 2024 21:30:36 GMT

de.tum.in.ase:artemis-java-test-sandbox <1.8.0, fixed in 1.8.0. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2023-49788: Improper handling of browser-side provided input in richdocuments path handling

Fri, 08 Dec 2023 20:02:07 GMT

CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2023-0627: Docker Desktop 4.11.x allows --no-windows-containers flag bypass

Mon, 25 Sep 2023 15:31:58 GMT

CVSS 6.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2023-28597: Improper trust boundary implementation for SMB in Zoom Clients

Mon, 27 Mar 2023 00:00:00 GMT

CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2023-0629: Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation restrictions via the raw Docker socket and launch privileged containers

Mon, 13 Mar 2023 11:16:41 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2022-20826: Cisco Adaptive Security Appliance (ASA) Software: A vulnerability in the secure boot implementation of Cisco Secure Firewalls 3100 Series…

Thu, 10 Nov 2022 17:31:54 GMT

CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2022-1799: Incorrect signature verification on Google play-services-basement in Google Play SDK

Fri, 29 Jul 2022 09:15:12 GMT

CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Class Loading Vulnerability in Artemis

Wed, 09 Feb 2022 22:30:30 GMT

de.tum.in.ase:artemis-java-test-sandbox <1.8.0, fixed in 1.8.0. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Context isolation bypass via contextBridge in Electron

Tue, 07 Jul 2020 00:01:10 GMT

electron <7.2.4 || >=8.0.0, <8.2.4, fixed in 7.2.4, 8.2.4. CVSS 7.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Context isolation bypass via leaked cross-context objects in Electron

Tue, 07 Jul 2020 00:01:07 GMT

electron <7.2.4 || >=8.0.0, <8.2.4, fixed in 7.2.4, 8.2.4. CVSS 7.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Context isolation bypass via Promise in Electron

Tue, 07 Jul 2020 00:01:05 GMT

electron <6.1.11 || >=7.0.0, <7.2.4 || >=8.0.0, <8.2.4, fixed in 6.1.11, 7.2.4, 8.2.4. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2019-0035: Junos OS: 'set system ports console insecure' allows root password recovery on OAM volumes

Wed, 10 Apr 2019 20:13:51 GMT

CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.