# CWE-640.

Every Advisory and CVE whose sources give the weakness CWE-640, newest first.

## Records, newest first (an older page)

- [Open redirect in Oracle Corporation Oracle WebCenter Content](https://agentprime.io/advisories/CVE-2026-60650.md)
  `CVE-2026-60650` · CVE record: Oracle Corporation Oracle WebCenter Content · CVSS 8.0 High · Not analysed yet · Published 21 Jul 2026 · Tags: Cross-site scripting (XSS), Cross-site request forgery (CSRF), Open redirect, CWE-20
- [Open redirect in Oracle Corporation Oracle WebCenter Content](https://agentprime.io/advisories/CVE-2026-60648.md)
  `CVE-2026-60648` · CVE record: Oracle Corporation Oracle WebCenter Content · CVSS 8.0 High · Not analysed yet · Published 21 Jul 2026 · Tags: Weak cryptography or TLS, Cross-site request forgery (CSRF), Open redirect, CWE-20
- [Open redirect in Oracle Corporation Oracle WebCenter Content](https://agentprime.io/advisories/CVE-2026-60646.md)
  `CVE-2026-60646` · CVE record: Oracle Corporation Oracle WebCenter Content · CVSS 8.0 High · Not analysed yet · Published 21 Jul 2026 · Tags: Cross-site scripting (XSS), Cross-site request forgery (CSRF), Open redirect, CWE-640
- [FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL](https://agentprime.io/advisories/CVE-2026-53595.md)
  `CVE-2026-53595` · CVE record: freescout-help-desk freescout · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jul 2026 · Tags: Authentication bypass, CWE-178, CWE-640
- [Capgo - Insufficient Authentication in Email Change Endpoint](https://agentprime.io/advisories/CVE-2026-56308.md)
  `CVE-2026-56308` · CVE record: Capgo Capgo · CVSS 8.4 High · Not analysed yet · Published 12 Jul 2026 · Tags: CWE-640
- [H3C NX15 Administrator Password Modification Endpoint modify change_passwd password recovery](https://agentprime.io/advisories/CVE-2026-15479.md)
  `CVE-2026-15479` · CVE record: H3C NX15 · CVSS 6.9 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: CWE-640
- [Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection](https://agentprime.io/advisories/CVE-2026-15155.md)
  `CVE-2026-15155` · CVE record: wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets · CVSS 8.8 High · Not analysed yet · Published 11 Jul 2026 · Tags: CWE-640
- [SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook](https://agentprime.io/advisories/CVE-2026-7655.md)
  `CVE-2026-7655` · CVE record: surecart SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments · CVSS 8.1 High · Not analysed yet · Published 11 Jul 2026 · Tags: CWE-640
- [Missing Authentication](https://agentprime.io/advisories/CVE-2026-13019.md)
  `CVE-2026-13019` · CVE record: Esri Portal for ArcGIS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Jul 2026 · Tags: CWE-640
- [Weak Password Recovery Mechanism in Portal for ArcGIS](https://agentprime.io/advisories/CVE-2026-13020.md)
  `CVE-2026-13020` · CVE record: Esri Portal for ArcGIS · CVSS 8.1 High · Not analysed yet · Published 7 Jul 2026 · Tags: CWE-640
- [Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing](https://agentprime.io/advisories/CVE-2026-34198.md)
  `CVE-2026-34198` · CVE record: coollabsio coolify · CVSS 5.3 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: CWE-346, CWE-640
- [FOSSBilling: Client password reset token reuse allows persistent account takeover](https://agentprime.io/advisories/CVE-2026-53646.md)
  `CVE-2026-53646` · CVE record: FOSSBilling FOSSBilling · CVSS 7.7 High · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-640
- [Kimai Password Reset Link Remains Valid After Password Change](https://agentprime.io/advisories/GHSA-m492-gv72-xvxj.md)
  `GHSA-m492-gv72-xvxj`, `CVE-2026-80196`, `PKSA-rxqm-xvx5-ktw1` · Packagist `kimai/kimai`: affected `<2.58.0`, fixed in `2.58.0` · CVSS 8.7 High · Not analysed yet · Published 1 Jul 2026 · Tags: CWE-640
- [Account Denial of Service in MCO](https://agentprime.io/advisories/CVE-2026-53904.md)
  `CVE-2026-53904` · CVE record: MyComplianceOffice MCO · CVSS 6.3 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Authentication bypass, CWE-640
- [An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php.](https://agentprime.io/advisories/CVE-2026-37106.md)
  `CVE-2026-37106` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-640
- [Invoice Generator <= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter](https://agentprime.io/advisories/CVE-2026-12416.md)
  `CVE-2026-12416` · CVE record: pravel Invoice Generator · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-640
- [SignUp & SignIn <= 1.0.0 - Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset_activation_code' Leading to Account Takeover](https://agentprime.io/advisories/CVE-2026-12417.md)
  `CVE-2026-12417` · CVE record: pravel SignUp & SignIn · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-640
- [Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover](https://agentprime.io/advisories/CVE-2026-11551.md)
  `CVE-2026-11551` · CVE record: wpmudev Branda – White Label & Branding, Free Login Page Customizer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-640
- [Cap-go - Account Lockout via 2FA Misconfiguration on Unverified Email](https://agentprime.io/advisories/CVE-2026-56081.md)
  `CVE-2026-56081` · CVE record: Cap-go capgo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Jun 2026 · Tags: CWE-640
- [Open redirect in Oracle Corporation Oracle iSupplier Portal](https://agentprime.io/advisories/CVE-2026-46894.md)
  `CVE-2026-46894` · CVE record: Oracle Corporation Oracle iSupplier Portal · CVSS 8.0 High · Not analysed yet · Published 16 Jun 2026 · Tags: Cross-site request forgery (CSRF), Open redirect, CWE-640
- [PbootCMS Password MemberController.php retrieve password recovery](https://agentprime.io/advisories/CVE-2026-12066.md)
  `CVE-2026-12066` · CVE record: PbootCMS · CVSS 6.9 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: CWE-640
- [LimeSurvey constructs account password-reset links from the client-supplied HTTP Host header without validating it.](https://agentprime.io/advisories/GHSA-5c37-5j7w-8mh8.md)
  `GHSA-5c37-5j7w-8mh8`, `CVE-2026-50635`, `PKSA-bgzx-wwbd-v2zr` · Packagist `limesurvey/limesurvey`: affected `<=7.0.0-beta1`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-640
- [OUSL-GROUP-BrinaryBrains School Student Management System Forgot Password Endpoint Login.php ajax_forgot_password password recovery](https://agentprime.io/advisories/CVE-2026-10169.md)
  `CVE-2026-10169` · CVE record: OUSL-GROUP-BrinaryBrains School Student Management System · CVSS 6.3 Medium · Not analysed yet · Published 31 May 2026 · Tags: CWE-640
- [Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint](https://agentprime.io/advisories/CVE-2026-7459.md)
  `CVE-2026-7459` · CVE record: eskapism Simple History – Track, Log, and Audit WordPress Changes · CVSS 7.5 High · Not analysed yet · Published 30 May 2026 · Tags: CWE-640
- [QianFox FoxCMS Admin.php edit password recovery](https://agentprime.io/advisories/CVE-2026-9609.md)
  `CVE-2026-9609` · CVE record: QianFox FoxCMS · CVSS 5.1 Medium · Not analysed yet · Published 27 May 2026 · Tags: CWE-640
- [Tiandy Easy7 Integrated Management Platform API Endpoint updateUserPassword password recovery](https://agentprime.io/advisories/CVE-2026-9466.md)
  `CVE-2026-9466` · CVE record: Tiandy Easy7 Integrated Management Platform · CVSS 6.9 Medium · Not analysed yet · Published 25 May 2026 · Tags: CWE-640
- [phpMyFAQ: Missing Password Reset Token Allows Account Takeover via Username/Email Enumeration](https://agentprime.io/advisories/GHSA-w9xh-5f39-vq89.md)
  `GHSA-w9xh-5f39-vq89`, `CVE-2026-35675`, `PKSA-527c-n963-c1j5`, `PKSA-x1b3-f9q9-1brm` · Packagist `phpmyfaq/phpmyfaq` and 1 more: affected `<4.1.3`, fixed in `4.1.3` · CVSS 8.8 High · Not analysed yet · Published 20 May 2026 · Tags: Authentication bypass, Information disclosure, CWE-640
- [phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation](https://agentprime.io/advisories/GHSA-9qv9-8xv6-5p35.md)
  `GHSA-9qv9-8xv6-5p35`, `CVE-2026-35676`, `PKSA-1ckg-7bmf-xkmp`, `PKSA-64xv-jbdm-pg2q` · Packagist `phpmyfaq/phpmyfaq` and 1 more: affected `<4.1.3`, fixed in `4.1.3` · CVSS 8.8 High · Not analysed yet · Published 20 May 2026 · Tags: CWE-640
- [An issue in Intelbras VIP-1230-D-G4 Version V2.800.00IB00C.0.T allows a remote attacker to obtain sensitive information via password reset functionality under /OutsideCmd](https://agentprime.io/advisories/CVE-2026-36438.md)
  `CVE-2026-36438` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 18 May 2026 · Tags: CWE-640
- [Apostrophe has a Weak Password Recovery Mechanism for Forgotten Password and Improper Input Validation](https://agentprime.io/advisories/GHSA-gf43-24g3-5hw2.md)
  `GHSA-gf43-24g3-5hw2`, `CVE-2026-45013` · npm `apostrophe`: affected `<=4.29.0`, no fixed version yet · CVSS 8.1 High · Not analysed yet · Published 14 May 2026 · Tags: CWE-20, CWE-640
- [LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism](https://agentprime.io/advisories/CVE-2026-7652.md)
  `CVE-2026-7652` · CVE record: latepoint LatePoint – Calendar Booking Plugin for Appointments and Events · CVSS 5.3 Medium · Not analysed yet · Published 9 May 2026 · Tags: CWE-640
- [An issue was discovered in Gambio 4.9.2.0 (patched in 2024-02 v1.0.0 for GX4 v4.0.0.0 to v4.9.2.0).](https://agentprime.io/advisories/CVE-2026-34408.md)
  `CVE-2026-34408` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2026 · Tags: CWE-640
- [AzuraCast has Password Reset Poisoning via Untrusted X-Forwarded-Host Header that Leads to Account Takeover and 2FA Bypass](https://agentprime.io/advisories/GHSA-gv7r-3mr9-h5x8.md)
  `GHSA-gv7r-3mr9-h5x8`, `CVE-2026-42606`, `PKSA-8467-6xvh-v57b` · Packagist `azuracast/azuracast`: affected `<0.23.6`, fixed in `0.23.6` · CVSS 8.1 High · Not analysed yet · Published 4 May 2026 · Tags: CWE-640
- [phpBB has Password Reset Link Poisoning via Host Header injection](https://agentprime.io/advisories/GHSA-7gm6-w7mx-58cr.md)
  `GHSA-7gm6-w7mx-58cr`, `CVE-2026-29199`, `PKSA-k9cm-sh3f-xrxt` · Packagist `phpbb/phpbb`: affected `>=3.0.0, <3.3.16 || >=4.0.0-a1, <4.0.0-a2`, fixed in `3.3.16`, `4.0.0-a2` · CVSS 8.1 High · Not analysed yet · Published 4 May 2026 · Tags: CWE-640
- [D-Link M60 httpd password recovery](https://agentprime.io/advisories/CVE-2026-7554.md)
  `CVE-2026-7554` · CVE record: D-Link M60 · CVSS 6.3 Medium · Not analysed yet · Published 1 May 2026 · Tags: CWE-640
- [blueprintUE: Password Reset Tokens Have No Expiry Window](https://agentprime.io/advisories/CVE-2026-40585.md)
  `CVE-2026-40585` · CVE record: blueprintue blueprintue-self-hosted-edition · CVSS 7.4 High · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-640
- [OpenAEV's Improper Password Reset Token Management Leads to Unauthenticated Account Takeover and Platform Compromise](https://agentprime.io/advisories/CVE-2026-24467.md)
  `CVE-2026-24467` · CVE record: OpenAEV-Platform openaev · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Apr 2026 · Tags: CWE-640
- [Weak password recovery in Dell Pro 14 Essential PV14250 and others](https://agentprime.io/advisories/CVE-2025-36579.md)
  `CVE-2025-36579` · CVE record: Dell Dell Pro 14 Essential PV14250 and 4 more · CVSS 5.1 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: CWE-640
- [An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-m…](https://agentprime.io/advisories/CVE-2026-30459.md)
  `CVE-2026-30459` · CVE record · CVSS 7.1 High · Not analysed yet · Published 16 Apr 2026 · Tags: CWE-640
- [Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms](https://agentprime.io/advisories/CVE-2026-33707.md)
  `CVE-2026-33707` · CVE record: chamilo chamilo-lms · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-640
- [Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery](https://agentprime.io/advisories/GHSA-hp5w-3hxx-vmwf.md)
  `GHSA-hp5w-3hxx-vmwf`, `CVE-2026-34751` · npm `payload` and 1 more: affected `<3.79.1`, fixed in `3.79.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-472, CWE-640
- [Membership Plugin – Restrict Content <= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp_redirect](https://agentprime.io/advisories/CVE-2026-4136.md)
  `CVE-2026-4136` · CVE record: stellarwp Membership Plugin – Restrict Content · CVSS 4.3 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-640
- [OPEXUS eComplaint and eCase insecure password reset](https://agentprime.io/advisories/CVE-2026-32865.md)
  `CVE-2026-32865` · CVE record: OPEXUS eComplaint and 1 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Mar 2026 · Tags: Information disclosure, CWE-640
- [StudioCMS: IDOR — Admin-to-Owner Account Takeover via Password Reset Link Generation](https://agentprime.io/advisories/GHSA-h7vr-cg25-jf8c.md)
  `GHSA-h7vr-cg25-jf8c`, `CVE-2026-32103` · npm `studiocms`: affected `<0.4.3`, fixed in `0.4.3` · CVSS 6.8 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Broken access control, CWE-640
- [Incorrect Access Control via activation token reuse on the password-reset endpoint allowing unauthorized password resets and full account takeover.](https://agentprime.io/advisories/CVE-2025-69614.md)
  `CVE-2025-69614` · CVE record · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-640
- [Cloudfoundry UAA has logic error in the token revocation endpoint implementation](https://agentprime.io/advisories/GHSA-6wcw-r64p-qrrw.md)
  `GHSA-6wcw-r64p-qrrw`, `CVE-2026-22723` · Maven `org.cloudfoundry.identity:cloudfoundry-identity-server`: affected `>=77.30.0, <78.8.0`, fixed in `78.8.0` · CVSS 6.5 Medium · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-640, CWE-693
- [IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links](https://agentprime.io/advisories/GHSA-22m3-c7vp-49fj.md)
  `GHSA-22m3-c7vp-49fj`, `CVE-2026-28681`, `PYSEC-2026-2186` · PyPI `irrd`: affected `>=4.4.0, <4.4.5 || >=4.5.0, <4.5.1`, fixed in `4.4.5`, `4.5.1` · CVSS 8.1 High · Not analysed yet · Published 4 Mar 2026 · Tags: Open redirect, CWE-640
- [Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse](https://agentprime.io/advisories/GHSA-rfjg-6m84-crj2.md)
  `GHSA-rfjg-6m84-crj2`, `CVE-2026-28268`, `GO-2026-4575` · Go `code.vikunja.io/api`: affected `<=0.24.6`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Feb 2026 · Tags: CWE-459, CWE-640
- [EverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API Response](https://agentprime.io/advisories/CVE-2026-28213.md)
  `CVE-2026-28213` · CVE record: evershopcommerce evershop · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Feb 2026 · Tags: Information disclosure, CWE-640
- [Statamic is vulnerable to account takeover via password reset link injection](https://agentprime.io/advisories/GHSA-jxq9-79vj-rgvw.md)
  `GHSA-jxq9-79vj-rgvw`, `CVE-2026-27593`, `PKSA-w3y4-x9d3-9t28` · Packagist `statamic/cms`: affected `<5.73.10 || >=6.0.0-alpha.1, <6.7.1`, fixed in `5.73.10`, `6.7.1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Feb 2026 · Tags: CWE-640
- [funadmin has Weak Password Recovery Mechanism for Forgotten Password](https://agentprime.io/advisories/GHSA-fmr2-m7gc-577w.md)
  `GHSA-fmr2-m7gc-577w`, `CVE-2026-2895`, `PKSA-j1rx-v5j5-4zrh` · Packagist `funadmin/funadmin`: affected `<=7.1.0-rc4`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 22 Feb 2026 · Tags: CWE-640
- [Intelbras VIP 3260 Z IA OutsideCmd password recovery](https://agentprime.io/advisories/CVE-2026-2564.md)
  `CVE-2026-2564` · CVE record: Intelbras VIP 3260 Z IA · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Feb 2026 · Tags: CWE-640
- [vichan-devel vichan Password Change pages.php unverified password change](https://agentprime.io/advisories/CVE-2026-2543.md)
  `CVE-2026-2543` · CVE record: vichan-devel vichan · CVSS 5.1 Medium · Not analysed yet · Published 16 Feb 2026 · Tags: CWE-620, CWE-640
- [Known affected by Account Takeover via Password Reset Token Leakage](https://agentprime.io/advisories/GHSA-78wq-6gcv-w28r.md)
  `GHSA-78wq-6gcv-w28r`, `CVE-2026-26273`, `PKSA-mcts-z5dp-tgk3` · Packagist `idno/known`: affected `<1.6.3`, fixed in `1.6.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Feb 2026 · Tags: Information disclosure, CWE-640
- [AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)](https://agentprime.io/advisories/CVE-2020-37158.md)
  `CVE-2020-37158` · CVE record: AVideo AVideo Platform · CVSS 8.5 High · Not analysed yet · Published 11 Feb 2026 · Tags: Cross-site request forgery (CSRF), CWE-640
- [AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)](https://agentprime.io/advisories/CVE-2020-37172.md)
  `CVE-2020-37172` · CVE record: AVideo AVideo Platform · CVSS 8.5 High · Not analysed yet · Published 11 Feb 2026 · Tags: CWE-640
- [macrozheng mall <= 1.0.3 Unauthenticated Password Reset via OTP Disclosure](https://agentprime.io/advisories/CVE-2026-25858.md)
  `CVE-2026-25858` · CVE record: macrozheng mall · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Feb 2026 · Tags: CWE-640
- [Information Disclosure in Birebirsoft's Sufirmam](https://agentprime.io/advisories/CVE-2025-4320.md)
  `CVE-2025-4320` · CVE record: Birebirsoft Software and Technology Solutions Sufirmam · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jan 2026 · Tags: CWE-305, CWE-640
- [Improper Access Control in Birebirsoft's Sufirmam](https://agentprime.io/advisories/CVE-2025-4319.md)
  `CVE-2025-4319` · CVE record: Birebirsoft Software and Technology Solutions Sufirmam · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jan 2026 · Tags: Authentication bypass, CWE-640
- [Sangfor Operation and Maintenance Security Management System edit_pwd_mall password recovery](https://agentprime.io/advisories/CVE-2026-1325.md)
  `CVE-2026-1325` · CVE record: Sangfor Operation and Maintenance Security Management System · CVSS 6.9 Medium · Not analysed yet · Published 22 Jan 2026 · Tags: CWE-640

Newest: <https://agentprime.io/advisories/tag/cwe-640.md>
Older: <https://agentprime.io/advisories/tag/cwe-640.md?cursor=WyIyMDI2LTAxLTIyVDEzOjAyOjExLjExNTAwMFoiLCJDVkUtMjAyNi0xMzI1Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-640&cursor=WyIyMDI2LTA3LTIxVDIxOjM2OjI1LjIwMTAwMFoiLCJDVkUtMjAyNi02MDY1OCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-640/?cursor=WyIyMDI2LTA3LTIxVDIxOjM2OjI1LjIwMTAwMFoiLCJDVkUtMjAyNi02MDY1OCJd>. Everything for agents: <https://agentprime.io/llms.txt>.