agentprime: CWE-598

ApostropheCMS: Cross-domain session token in URL confers session takeover

Tue, 20 Oct 2026 18:09:01 GMT

apostrophe <4.33.0, fixed in 4.33.0. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-107370: Improper Request Handling for Active Directory Logins in auth0-lock

Tue, 13 Oct 2026 20:08:09 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-108808: Eleveo Call Recording Software JWT Token logout get request method with sensitive query strings

Mon, 12 Oct 2026 06:30:18 GMT

CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.

Nginx UI: Node Secret Credential Exposure via URL Query Parameter

Fri, 09 Oct 2026 17:07:09 GMT

github.com/0xJacky/Nginx-UI >=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074433-a3999bd78a3b, fixed in 1.9.10-0.20260728074433-a3999bd78a3b. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix

Thu, 17 Sep 2026 13:09:31 GMT

ash_authentication >=3.10.5, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14, fixed in 4.15.0, 5.0.0-rc.14. CVSS 7.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-88897: Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String

Thu, 10 Sep 2026 14:46:36 GMT

CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-61614: SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser history

Fri, 04 Sep 2026 17:48:16 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-82181: Le-yan｜Medical Practice Management System - Sensitive Data in URL

Fri, 28 Aug 2026 11:52:48 GMT

CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-76179: Ebyte NA111-M Use of GET Request Method With Sensitive Query Strings

Thu, 27 Aug 2026 21:22:53 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-63408: Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter

Wed, 19 Aug 2026 15:53:08 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-66832: Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query strings

Tue, 11 Aug 2026 20:49:56 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-14838: Session Token Exposure in URL Leading to Account Takeover in Bilin Software's HUMANIST Digital Human Resources

Tue, 04 Aug 2026 08:42:27 GMT

CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-16207: django-tastypie authentication.py ApiKeyAuthentication get request method with sensitive query strings

Sun, 19 Jul 2026 02:30:08 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-15322: Multiple Vulnerabilities in IBM Engineering AI hub.

Fri, 17 Jul 2026 19:35:19 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-9592: Sensitive Information Disclosure in HTTP header

Fri, 17 Jul 2026 13:51:54 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-62386: Grav < 1.0.0-rc.16 Authentication Bypass via token URL Parameter

Fri, 17 Jul 2026 00:07:13 GMT

CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter

Tue, 14 Jul 2026 19:31:23 GMT

auth0/symfony >=5.0.0-BETA0, <5.9.0, fixed in 5.9.0. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-54652: Frigate viewer can read logs exposing admin and camera credentials

Wed, 08 Jul 2026 14:52:42 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-58656: Grav API Plugin - Cross-Origin Admin Account Takeover via CORS Wildcard and JWT Query Parameter

Wed, 08 Jul 2026 13:49:11 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration

Thu, 02 Jul 2026 20:16:12 GMT

@nuxt/ui <4.8.1, fixed in 4.8.1. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

MLflow authentication requirement bypass can allow a user to arbitrarily create an account

Mon, 29 Jun 2026 11:50:43 GMT

mlflow <2.8.0, fixed in 2.8.0. CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

canto-saas-api: OAuth credentials exposed in URL query string and exception messages

Fri, 19 Jun 2026 14:16:41 GMT

jleehr/canto-saas-api <3.0.0, fixed in 3.0.0. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

nebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)

Wed, 10 Jun 2026 22:13:45 GMT

github.com/juev/nebula-mesh <0.3.2, fixed in 0.3.2. CVSS 5.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-10078: Quay/config-tool: quay/config-tool: gitlab oauth client_secret exposed in url querystring

Fri, 29 May 2026 09:30:30 GMT

CVSS 2.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-2237: Synology Storage Manager: A use of get request method with sensitive query strings vulnerability in volume…

Wed, 27 May 2026 08:44:29 GMT

CVSS 6.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Portainer: JWT accepted in URL query leaks tokens to logs and referers

Thu, 14 May 2026 16:33:48 GMT

github.com/portainer/portainer >=2.33.0, <2.33.8 || >=2.39.0, <2.39.2 || >=2.40.0, <2.41.0, fixed in 2.33.8, 2.39.2, 2.41.0. CVSS 7.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-62317: HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters.

Thu, 14 May 2026 16:13:34 GMT

CVSS 2.6 (Low). Published by the CVE Program. Not analysed by agentprime yet.

AVideo: Password Hash Leak in MobileManager OAuth Redirect URL Enables Account Takeover

Tue, 05 May 2026 19:08:45 GMT

wwbn/avideo <=29.0, no fixed version yet. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-37504: Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4.

Fri, 01 May 2026 00:00:00 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Apache OpenMeetings Uses GET Request Method With Sensitive Query Strings

Thu, 09 Apr 2026 18:31:27 GMT

org.apache.openmeetings:openmeetings-parent >=3.1.3, <9.0.0, fixed in 9.0.0. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-27949: Plane Exposes User Email (PII and part of credential) in GET Parameter

Tue, 07 Apr 2026 20:26:25 GMT

CVSS 2.0 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-25118: immich-server: Insecure Transmission of Authentication Credentials via Password Parameter in HTTP Request Query String When Accessing Shared Albums

Fri, 03 Apr 2026 15:51:07 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Nhost Leaks Refresh Tokens via URL Query Parameter in OAuth Provider Callback

Wed, 01 Apr 2026 23:36:10 GMT

github.com/nhost/nhost <0.0.0-20260330133707-294954e0fc3a, fixed in 0.0.0-20260330133707-294954e0fc3a. CVSS 2.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage

Wed, 01 Apr 2026 21:12:19 GMT

openssl-encrypt <1.4.0, fixed in 1.4.0. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-14808: IBM InfoSphere Information Server is vulnerable due to disclosure of sensitive information

Wed, 25 Mar 2026 20:09:38 GMT

CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.

PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems

Tue, 24 Mar 2026 19:33:23 GMT

github.com/pinchtab/pinchtab >=0.7.8, <0.8.4, fixed in 0.8.4. CVSS 4.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-31381: Gainsight Assist plugin information disclosure

Fri, 20 Mar 2026 13:02:07 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-14811: IBM Sterling Partner Engagement Manager Information Disclosure

Fri, 13 Mar 2026 18:22:00 GMT

CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-13219: Multiple vulnerabilities in IBM Aspera Orchestrator

Tue, 10 Mar 2026 20:08:20 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-41772: wwwupdate.cgi Session token in URL

Mon, 09 Mar 2026 08:18:49 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

Gogs: Access tokens get exposed through URL params in API requests

Thu, 05 Mar 2026 19:50:35 GMT

gogs.io/gogs <=0.13.3, no fixed version yet. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-59873: Session Token Exposure via URL Query Parameters

Mon, 23 Feb 2026 10:56:52 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-26721: An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to obtain sensitive information via the sid query parameter.

Fri, 20 Feb 2026 00:00:00 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-69634: Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field in perms.php NOTE: this is disputed by a third party who in…

Thu, 12 Feb 2026 00:00:00 GMT

CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-23846: Tugtainer vulnerable to Password Exposure via URL Query Parameter

Mon, 19 Jan 2026 19:42:35 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-22644: Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could allow an attacker t…

Thu, 15 Jan 2026 13:14:13 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-69270: Spectrum session token in URL

Mon, 12 Jan 2026 04:20:13 GMT

CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-36371: IBM i Information Disclosure

Wed, 19 Nov 2025 19:45:31 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-31954: HCL iAutomate is susceptible to a sensitive information disclosure

Wed, 05 Nov 2025 18:23:21 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-32916: Sensitive form data in URL query parameters

Thu, 09 Oct 2025 15:00:58 GMT

CVSS 1.0 (Low). Published by the CVE Program. Not analysed by agentprime yet.