agentprime: CWE-636

CVE-2026-109408: vault-java-driver: SslConfig silently disables requested TLS verification

Thu, 05 Nov 2026 07:36:07 GMT

CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-102280: Sandboxie-Plus: Sandbox containment bypass

Wed, 04 Nov 2026 21:54:47 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-95860: node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions

Tue, 03 Nov 2026 20:11:38 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-109593: An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.

Tue, 03 Nov 2026 16:25:11 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-110985: Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured

Wed, 28 Oct 2026 16:37:45 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-108142: A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.

Tue, 27 Oct 2026 16:16:58 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-105933: Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization

Wed, 21 Oct 2026 18:07:43 GMT

CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-114479: Not Failing Securely ('Failing Open') in hMailServer

Wed, 21 Oct 2026 15:12:50 GMT

CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-74048: Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up

Tue, 20 Oct 2026 13:36:36 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25

Mon, 12 Oct 2026 13:15:29 GMT

hex_core >=0.1.0, <0.20.0, fixed in 0.20.0. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-78022: Dell Secure Connect Gateway (SCG) Policy Manager: Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16…

Fri, 09 Oct 2026 08:59:07 GMT

CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-107735: SumatraPDF: `sumatrapdfrestrict.ini` never revokes any permission (fail-open policy initialization)

Thu, 08 Oct 2026 22:26:00 GMT

CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-101998: Fail-open response masking in Docker Sandboxes can expose proxy-managed credentials

Thu, 08 Oct 2026 18:47:28 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-107584: Not Failing Securely ('Failing Open') in hMailServer

Thu, 08 Oct 2026 11:49:16 GMT

CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-107314: pgjdbc does not enforce requireAuth when the value excludes every authentication method

Wed, 07 Oct 2026 23:03:01 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-103510: Authentication bypass via blank auth token in P4Search

Mon, 05 Oct 2026 08:44:56 GMT

CVSS 9.5 (Critical). Critical: CVSS score 9.5: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-100860: heym before 0.0.105 Authentication Bypass via Redis Node

Sun, 27 Sep 2026 01:28:50 GMT

CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-100304: TDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check

Fri, 25 Sep 2026 18:47:39 GMT

CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

@bytebase/dbhub's read-only mode does not prevent database writes

Thu, 24 Sep 2026 19:37:59 GMT

@bytebase/dbhub <0.22.6, fixed in 0.22.6. CVSS 7.4 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-88831: Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths

Wed, 23 Sep 2026 17:45:23 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug

Wed, 23 Sep 2026 16:11:18 GMT

io.moquette:moquette-broker <0.18.1, fixed in 0.18.1. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-95676: AuthPoint Gateway Improper Authentication in LDAP Sync Allows First-Factor Authentication Bypass

Wed, 23 Sep 2026 12:52:04 GMT

CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on the allowlist for

Tue, 22 Sep 2026 20:37:08 GMT

github.com/tinyauthapp/tinyauth <1.0.1-0.20260720133915-80bc87188ec3, fixed in 1.0.1-0.20260720133915-80bc87188ec3. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-92591: Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer

Wed, 16 Sep 2026 21:46:57 GMT

CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

Wed, 16 Sep 2026 15:32:10 GMT

djust <1.0.7, fixed in 1.0.7. CVSS 7.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-53459: Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints

Tue, 15 Sep 2026 17:25:27 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts

Tue, 15 Sep 2026 15:38:15 GMT

safeurl >=0.1.0, no fixed version yet. CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by OSV. Not analysed by agentprime yet.

CVE-2026-81379: Visual Studio Code Security Feature Bypass Vulnerability

Tue, 08 Sep 2026 17:13:59 GMT

CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-86120: APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard

Sat, 05 Sep 2026 09:59:09 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-85649: Unchecked return value in chewkeanho software-actualizer

Fri, 04 Sep 2026 12:59:59 GMT

CVSS 7.9 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-18329: NGINX ngx_http_js_module vulnerability

Wed, 02 Sep 2026 15:40:54 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

Ash.Reactor change step fails open, skipping a change when its where guard raises

Tue, 01 Sep 2026 03:39:42 GMT

ash >=3.0.0-rc.17, <3.32.2, fixed in 3.32.2. CVSS 2.1 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-82018: IGEL OS 12 / 11 Secure Boot Bypass via Unsigned igel.conf File

Fri, 28 Aug 2026 21:11:24 GMT

CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

AIIR verification and policy gates could report success without enforcing the control (fail-open)

Fri, 28 Aug 2026 19:20:32 GMT

aiir <1.7.0, fixed in 1.7.0. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-46482: MyBB: Security Question insufficient validation

Tue, 18 Aug 2026 15:44:59 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-70452: rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure

Thu, 13 Aug 2026 14:46:50 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-69306: Visual Studio Code Security Feature Bypass Vulnerability

Tue, 11 Aug 2026 17:05:18 GMT

CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access

Wed, 05 Aug 2026 19:43:38 GMT

livebook >=0.19.7, <0.19.9, fixed in 0.19.9. CVSS 7.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-44094: Fallback to second RAUC slot with default credentials

Thu, 30 Jul 2026 06:48:37 GMT

CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

nono-cli'scregistry pack verification can fail open when provenance metadata is absent

Tue, 28 Jul 2026 15:51:30 GMT

nono-cli <0.61.3, fixed in 0.61.3. CVSS 6.6 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

Thu, 23 Jul 2026 14:52:23 GMT

next-auth >=5.0.0-beta.0, <5.0.0-beta.32, fixed in 5.0.0-beta.32. CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`)

Wed, 22 Jul 2026 23:12:22 GMT

jupyterlab <4.5.10 || >=4.6.0, <4.6.2, fixed in 4.5.10, 4.6.2. CVSS 7.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms

Tue, 21 Jul 2026 17:47:39 GMT

org.postgresql:postgresql >=42.7.4, <42.7.12, fixed in 42.7.12. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability

Mon, 20 Jul 2026 22:52:09 GMT

Microsoft.NetCore.App.Runtime.linux-arm >=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10, fixed in 8.0.29, 9.0.18, 10.0.10. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-62235: Grav Flex-Objects < 1.4.3 Authorization Bypass via API

Fri, 17 Jul 2026 00:07:10 GMT

CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.

Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities

Mon, 06 Jul 2026 09:30:30 GMT

org.apache.camel:camel-keycloak >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0, fixed in 4.18.3, 4.21.0. CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OpenClaw: Mattermost handlers could fall open when channel type was missing

Thu, 02 Jul 2026 16:45:14 GMT

openclaw <2026.5.6, fixed in 2026.5.6. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OnGres SCRAM silent channel-binding authentication downgrade via unsupported certificate algorithms

Wed, 01 Jul 2026 21:51:17 GMT

com.ongres.scram:scram-client <3.3, fixed in 3.3. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Traefik Kubernetes Ingress NGINX provider fails open when auth-secret resolution fails

Fri, 19 Jun 2026 21:15:56 GMT

github.com/traefik/traefik/v3 >=3.7.0-ea.1, <3.7.5, fixed in 3.7.5. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext

Fri, 19 Jun 2026 14:17:59 GMT

guzzlehttp/guzzle <7.12.1, fixed in 7.12.1. CVSS 5.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.