agentprime: CWE-526

CVE-2026-54146: OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE primitive)

Thu, 05 Nov 2026 16:41:31 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-116246: pgAdmin 4: Server passwords are left in pgAdmin's process environment

Fri, 30 Oct 2026 19:55:16 GMT

CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-77938: Letta through 0.16.8 Credential Exposure via Tool Sandbox Environment Inheritance

Tue, 20 Oct 2026 00:46:15 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-108592: mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironment

Sat, 10 Oct 2026 18:16:56 GMT

CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CodeWhale: js_execution leaks parent environment to model context via missing env scrub

Fri, 04 Sep 2026 18:03:08 GMT

codewhale-tui >=0.8.41, <0.8.64, fixed in 0.8.64. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-72648: Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information Disclosure

Thu, 13 Aug 2026 19:13:31 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-49377: In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters

Fri, 29 May 2026 18:15:50 GMT

CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

hermes-agent has a sandbox issue

Tue, 26 May 2026 13:30:32 GMT

hermes-agent <0.11.0, fixed in 0.11.0. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection

Thu, 14 May 2026 20:56:07 GMT

utcp-cli <1.1.2, fixed in 1.1.2. CVSS 7.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

PraisonAIAgents: Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool

Fri, 10 Apr 2026 19:24:27 GMT

praisonaiagents <1.5.128, fixed in 1.5.128. CVSS 7.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-36105: IBM Planning Analytics Advanced Certified Containers is vulnerable to a sensitive information disclosure vulnerability

Tue, 10 Mar 2026 00:50:05 GMT

CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-27899: Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows

Tue, 17 Feb 2026 19:50:33 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Child processes spawned by Renovate incorrectly have full access to environment variables

Fri, 13 Feb 2026 20:53:58 GMT

renovate >=42.68.1, <42.96.3 || >=43.0.0, <43.4.4, fixed in 42.96.3, 43.4.4. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-36017: IBM Controller Information Disclosure

Mon, 08 Dec 2025 21:37:10 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Keycloak Potential Variable Reference in Model Storage Services

Wed, 08 Oct 2025 23:32:36 GMT

org.keycloak:keycloak-model-storage-services * || >=26.3.0, <26.3.4, fixed in 26.3.4. CVSS 4.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Duplicate Advisory: Keycloak Potential Variable Reference in Model Storage Services

Thu, 21 Aug 2025 18:31:27 GMT

org.keycloak:keycloak-model-storage-services <=26.3.3, no fixed version yet. CVSS 4.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers.

Fri, 13 Jun 2025 14:15:20 GMT

openc3 <=6.0.0, no fixed version yet. CVSS 7.5 (High). Published by OSV. Not analysed by agentprime yet.

Mautic does not shield .env files from web traffic

Wed, 28 May 2025 17:38:38 GMT

mautic/core >=4.4.0, <4.4.16 || >=5.0.0-alpha, <5.2.6 || >=6.0.0-alpha, <6.0.2, fixed in 4.4.16, 5.2.6, 6.0.2. CVSS 5.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2023-43029: IBM Storage Virtualize vSphere Remote Plug-in information disclosure

Fri, 21 Mar 2025 15:33:51 GMT

CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-12604: Improper Authentication in Tapandsign Technologies Tap and Sign App

Mon, 10 Mar 2025 14:28:12 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-0985: IBM MQ information disclosure

Fri, 28 Feb 2025 16:21:35 GMT

CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Keycloak allows unrestricted admin use of system and environment variables

Mon, 13 Jan 2025 16:58:08 GMT

org.keycloak:keycloak-quarkus-server <26.0.8, fixed in 26.0.8. CVSS 4.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2024-4369: Cluster-image-registry-operator: exposes a secret via env variable in pod definition on azure

Tue, 30 Apr 2024 23:49:02 GMT

CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

quarkus-core leaks local environment variables from Quarkus namespace during application's build

Thu, 04 Apr 2024 15:30:34 GMT

io.quarkus:quarkus-core >=3.9.0.CR1, <3.9.2 || >=3.3.0.CR1, <3.8.4 || <3.2.12.Final, fixed in 3.9.2, 3.8.4, 3.2.12.Final. CVSS 7.0 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Quarkus does not properly sanitize artifacts created from its use of the Gradle plugin, allowing certain build system information to remain

Wed, 15 Nov 2023 15:30:21 GMT

io.quarkus:quarkus-project >=3.0.0.CR1, <=3.5.1, no fixed version yet. CVSS 7.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2023-47615: Telit Cinterion BGS5: A CWE-526: Exposure of Sensitive Information Through Environmental Variables…

Thu, 09 Nov 2023 12:47:43 GMT

CVSS 3.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.

Shescape potential environment variable exposure on Windows with CMD

Thu, 22 Jun 2023 20:01:39 GMT

shescape <1.7.1, fixed in 1.7.1. CVSS 3.1 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2014-2377: Ecava IntegraXor SCADA Server Information Exposure Through Environmental Variables

Mon, 15 Sep 2014 14:00:00 GMT

CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.