agentprime: CWE-610

CVE-2026-119342: Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass

Fri, 30 Oct 2026 20:28:30 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-67077: HCL BigFix AEX is affected by multiple security vulnerabilities.

Wed, 28 Oct 2026 12:26:30 GMT

CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-95376: Google Chrome: Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57…

Tue, 29 Sep 2026 17:31:46 GMT

CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.

jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider Resolution

Mon, 28 Sep 2026 20:19:19 GMT

com.fasterxml.jackson.core:jackson-databind >=2.8.0, <2.18.10 || >=2.19.0, <2.21.6 || >=2.22.0, <2.22.2, fixed in 2.18.10, 2.21.6, 2.22.2. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-81375: Confused Deputy in Application Integration allows Internal File Read

Mon, 28 Sep 2026 10:58:46 GMT

CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-21810: HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and downloading code without integrity checking

Wed, 26 Aug 2026 21:55:07 GMT

CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-79256: Google Chrome: Externally controlled reference in WebView in Google Chrome on on Android prior to…

Tue, 25 Aug 2026 20:10:16 GMT

CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-78966: Google Chrome: Externally controlled reference in QUIC in Google Chrome prior to 152.0.7977.65 allowed a…

Tue, 25 Aug 2026 20:10:14 GMT

CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-62960: Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows

Fri, 21 Aug 2026 20:05:45 GMT

CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-76572: pkp pkp-lib XSLTransformer.php _transformPHP xml external entity reference

Wed, 19 Aug 2026 19:30:10 GMT

CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-68562: Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure via leapp report tampering

Thu, 30 Jul 2026 21:13:08 GMT

CVSS 6.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

Tue, 28 Jul 2026 21:49:34 GMT

datamodel-code-generator <0.62.0, fixed in 0.62.0. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

Tue, 28 Jul 2026 21:26:41 GMT

datamodel-code-generator >=0.59.0, <0.62.0, fixed in 0.62.0. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-15583: SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header

Wed, 15 Jul 2026 07:29:48 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-12879: Cross-Tenant Data Exfiltration in Apigee via BigQuery Confused Deputy

Thu, 09 Jul 2026 12:56:51 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Jenkins OWASP ZAP Plugin: Builds executed on the Jenkins controller can lead to RCE

Wed, 24 Jun 2026 15:31:48 GMT

org.jenkins-ci.plugins:zapper <=1.0.7, no fixed version yet. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-12788: zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 XML Parser import xml external entity reference

Sun, 21 Jun 2026 07:45:35 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Apache Camel K: Kubernetes namespace authorized users can create a Build resource

Thu, 21 May 2026 15:34:09 GMT

github.com/apache/camel-k/v2 <2.8.1 || >=2.9.0, <2.9.2 || >=2.10.0, <2.10.1, fixed in 2.8.1, 2.9.2, 2.10.1. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-47358: Server-side request forgery in tenable Terrascan

Tue, 19 May 2026 15:53:09 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-47357: Server-side request forgery in tenable Terrascan

Tue, 19 May 2026 15:53:05 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-34327: Microsoft Partner Center Spoofing Vulnerability

Thu, 07 May 2026 20:58:54 GMT

CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

OpenClaw: Workspace dotenv files cannot override connector endpoint hosts

Mon, 04 May 2026 20:22:15 GMT

openclaw <2026.4.22, fixed in 2026.4.22. CVSS 4.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-0522: Local File Inclusion in the File Upload/Download Process

Wed, 01 Apr 2026 13:11:13 GMT

CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-28722: Local privilege escalation due to improper soft link handling.

Thu, 05 Mar 2026 23:55:18 GMT

CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-28721: Local privilege escalation due to improper soft link handling.

Thu, 05 Mar 2026 23:55:01 GMT

CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files

Tue, 03 Mar 2026 21:37:59 GMT

openclaw <2026.2.21, fixed in 2026.2.21. CVSS 7.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-48654: In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code.

Mon, 02 Mar 2026 18:42:29 GMT

CVSS 7.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-3404: thinkgem JeeSite Endpoint CasOutHandler.java xml external entity reference

Mon, 02 Mar 2026 01:32:10 GMT

CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-2536: opencc JFlow Workflow WF_Admin_AttrFlow.java Imp_Done xml external entity reference

Mon, 16 Feb 2026 05:02:14 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-2074: O2OA HTTP POST Request check xml external entity reference

Sat, 07 Feb 2026 04:02:06 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-1218: Bjskzy Zhiyou ERP com.artery.richclient.RichClientService RichClientService.class initRCForm xml external entity reference

Tue, 20 Jan 2026 05:32:07 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration in github.com/hashicorp/nomad

Mon, 12 Jan 2026 17:39:39 GMT

github.com/hashicorp/nomad <1.11.1, fixed in 1.11.1. CVSS 7.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-15251: beecue FastBee SIP Message ReqAbstractHandler.java getRootElement xml external entity reference

Tue, 30 Dec 2025 14:02:10 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

External Control of File Name or Path in Langflow

Fri, 19 Dec 2025 22:53:13 GMT

langflow <1.7.1, fixed in 1.7.1. CVSS 7.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-13209: bestfeng oa_git_free WorkflowPredefineController.java updateWriteBack xml external entity reference

Sat, 15 Nov 2025 18:32:06 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-11341: Jinher OA type xml external entity reference

Mon, 06 Oct 2025 17:02:05 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-11140: Bjskzy Zhiyou ERP com.artery.richclient.RichClientService openForm xml external entity reference

Mon, 29 Sep 2025 04:02:05 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-11035: Jinher OA text xml external entity reference

Fri, 26 Sep 2025 18:32:07 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-10816: Jinher OA XML text xml external entity reference

Mon, 22 Sep 2025 21:32:07 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-8057: IDOR in Patika Global Technologies' HumanSuite

Tue, 16 Sep 2025 14:02:47 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-9065: Rockwell Automation ThinManager® Server-Side Request Forgery Vulnerability

Tue, 09 Sep 2025 12:51:42 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-10092: Jinher OA XML Type xml external entity reference

Mon, 08 Sep 2025 11:32:06 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-10091: Jinher OA XML Type xml external entity reference

Mon, 08 Sep 2025 11:02:06 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-49728: In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy.

Tue, 02 Sep 2025 22:11:06 GMT

CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-49722: In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy.

Tue, 02 Sep 2025 22:11:05 GMT

CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-48963: Local privilege escalation due to improper soft link handling.

Thu, 28 Aug 2025 09:49:57 GMT

CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-26417: In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage due to a confused deputy.

Tue, 26 Aug 2025 22:48:58 GMT

CVSS 4.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-0082: In multiple functions of StatusHint.java and TelecomServiceImpl.java, there is a possible way to reveal images across users due to a confused deputy.

Tue, 26 Aug 2025 22:48:41 GMT

CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2015-10142: Sitecore XP < 8.0 and CMS < 7.2 and < 7.5 File Read via Known Path

Fri, 25 Jul 2025 15:55:07 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-7824: Jinher OA XmlHttp.aspx xml external entity reference

Sat, 19 Jul 2025 13:02:05 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.