agentprime: CWE-551

CVE-2026-106579: ImageMagick: Policy Bypass when using coder as the domain.

Wed, 07 Oct 2026 15:45:06 GMT

CVSS 6.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-87743: Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

Fri, 18 Sep 2026 09:38:27 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-89060: Stolostron/multicluster-observability-addon: cross-namespace secret disclosure in multicluster-observability-addon via unvalidated configuration references

Fri, 11 Sep 2026 04:22:47 GMT

CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-16102: Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

Wed, 05 Aug 2026 13:50:50 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-15573: Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher

Wed, 05 Aug 2026 13:50:03 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

Wed, 29 Jul 2026 15:40:05 GMT

io.quarkus:quarkus-vertx-http <3.20.6.2 || >=3.21.0.CR1, <3.27.4.1 || >=3.28.0.CR1, <3.33.2.1 || >=3.34.0.CR1, <3.36.3 || >=3.37.0.CR1, <3.37.0, fixed in 3.20.6.2, 3.27.4.1, 3.33.2.1, 3.36.3, 3.37.0. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

fast-uri vulnerable to host confusion via failed IDN canonicalization

Tue, 21 Jul 2026 19:03:11 GMT

fast-uri >=2.3.1, <2.4.2 || >=3.0.0, <3.1.3 || >=4.0.0, <4.0.1, fixed in 2.4.2, 3.1.3, 4.0.1. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-57920: Peplink InControl: Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass…

Fri, 26 Jun 2026 12:20:52 GMT

CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-45832: Insecure direct object reference in ChromaDB

Fri, 12 Jun 2026 15:11:46 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Mon, 11 May 2026 15:54:24 GMT

next >=15.2.0, <15.5.16 || >=16.0.0, <16.2.5, fixed in 15.5.16, 16.2.5. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Next.js has a Middleware / Proxy bypass through dynamic route parameter injection

Mon, 11 May 2026 15:54:08 GMT

next >=15.4.0, <15.5.16 || >=16.0.0, <16.2.5, fixed in 15.5.16, 16.2.5. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n

Mon, 11 May 2026 15:53:51 GMT

next >=12.2.0, <15.5.16 || >=16.0.0, <16.2.5, fixed in 15.5.16, 16.2.5. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Quarkus has Authentication/Authorization bypasses

Mon, 04 May 2026 17:20:20 GMT

io.quarkus:quarkus-vertx-http <3.20.6.1 || >=3.21.0, <3.27.3.1 || >=3.30.0, <3.33.1.1 || >=3.34.0, <3.35.1.1, fixed in 3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Apache Camel Vulnerable to Authentication Bypass Using an Alternate Path or Channel

Mon, 27 Apr 2026 12:30:38 GMT

org.apache.camel:camel-platform-http-main >=4.14.1, <4.14.6 || >=4.18.0, <4.18.2 || >=4.19.0, <4.20.0, fixed in 4.14.6, 4.18.2, 4.20.0. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Spring Security Doesn't Correctly Include Servlet Path in Path Matching of XML Authorization Rules

Wed, 22 Apr 2026 06:30:29 GMT

org.springframework.security:spring-security-config >=7.0.0, <7.0.5, fixed in 7.0.5. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-28808: ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)

Tue, 07 Apr 2026 12:28:16 GMT

CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants

Thu, 02 Apr 2026 15:31:39 GMT

org.keycloak:keycloak-services <26.5.7, fixed in 26.5.7. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

gRPC-Go has an authorization bypass via missing leading slash in :path

Wed, 18 Mar 2026 20:10:29 GMT

google.golang.org/grpc <1.79.3, fixed in 1.79.3. CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2016-20030: ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction

Sun, 15 Mar 2026 13:35:32 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

Nest has a Fastify URL Encoding Middleware Bypass

Mon, 02 Mar 2026 14:34:12 GMT

@nestjs/platform-fastify <11.1.14, fixed in 11.1.14. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Keycloak has Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Thu, 08 Jan 2026 06:31:32 GMT

org.keycloak:keycloak-parent <=26.5.0, no fixed version yet. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Authorization bypass in Quarkus

Sat, 09 Dec 2023 03:30:15 GMT

io.quarkus:quarkus-smallrye-graphql-client >=2.14.0, <3.5.3 || <2.13.9.Final, fixed in 3.5.3, 2.13.9.Final. CVSS 7.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Dompdf vulnerable to URI validation failure on SVG parsing

Wed, 01 Feb 2023 01:37:56 GMT

dompdf/dompdf <2.0.2, fixed in 2.0.2. CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2021-31384: Junos OS: SRX Series: Under a specific device configuration an attacker can access the devices J-Web management services from any interface, regardless of security settings protecting the service

Tue, 19 Oct 2021 18:17:28 GMT

CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2021-32779: Incorrectly handling of URI '#fragment' element as part of the path element

Tue, 24 Aug 2021 20:45:09 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2021-32777: Incorrect concatenation of multiple value request headers in ext-authz extension

Tue, 24 Aug 2021 20:25:09 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

Encoded URIs can access WEB-INF directory in Eclipse Jetty

Mon, 19 Jul 2021 15:15:24 GMT

org.eclipse.jetty:jetty-webapp >=9.4.37, <9.4.43 || >=10.0.1, <10.0.6 || >=11.0.1, <11.0.6, fixed in 9.4.43, 10.0.6, 11.0.6. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

Tue, 06 Apr 2021 17:31:30 GMT

org.eclipse.jetty:jetty-server >=7.2.2, <9.4.39 || >=10.0.0, <10.0.2 || >=11.0.0, <11.0.2, fixed in 9.4.39, 10.0.2, 11.0.2. CVSS 7.5 (High). Critical: CVSS score 7.5 (7.0 or more) and EPSS 0.54 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Authorization Before Parsing and Canonicalization in jetty

Tue, 06 Apr 2021 17:31:01 GMT

org.eclipse.jetty:jetty-webapp >=9.4.37, <9.4.39, fixed in 9.4.39. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.