agentprime: CWE-647

CVE-2026-76530: Use of Non-Canonical URL Paths for Authorization Decisions in Splunk SOAR

Wed, 21 Oct 2026 22:52:19 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-94269: Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch

Thu, 01 Oct 2026 11:02:20 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-71178: Dell Secure Connect Gateway (SCG) Policy Manager: Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16…

Wed, 23 Sep 2026 14:05:22 GMT

CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-73551: Envoy: Path normalization does not handle dot and dotdot segments with parameters

Mon, 21 Sep 2026 20:17:02 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-80515: Incorrect authorization in Eclipse Foundation Eclipse Arrowhead

Thu, 03 Sep 2026 13:41:00 GMT

CVSS 8.9 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-15970: L7 intention authorization bypass via custom public listener

Fri, 07 Aug 2026 19:20:13 GMT

CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources

Fri, 24 Jul 2026 21:47:16 GMT

github.com/zxh326/kite >=0.6.9, <0.14.1, fixed in 0.14.1. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Eclipse Jetty: Path parameter traversal

Wed, 22 Jul 2026 22:57:36 GMT

org.eclipse.jetty:jetty-util >=12.0.0, <12.0.35 || >=12.1.0, <12.1.9, fixed in 12.0.35, 12.1.9. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

File Browser: Colliding username normalization gives two users the same home directory

Mon, 20 Jul 2026 22:19:10 GMT

github.com/filebrowser/filebrowser/v2 <2.63.17, fixed in 2.63.17. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

Mon, 20 Jul 2026 21:58:27 GMT

astro >=6.4.7, <6.4.8, fixed in 6.4.8. CVSS 8.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Cargo can be coerced to share credentials between registries

Fri, 26 Jun 2026 21:47:54 GMT

cargo <0.97.0, fixed in 0.97.0. CVSS 2.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-9909: Aap-gateway: improper path validation in gateway allows credential exfiltration

Fri, 27 Feb 2026 07:30:00 GMT

CVSS 6.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765

Mon, 08 Dec 2025 16:26:43 GMT

astro <5.15.8, fixed in 5.15.8. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

Wed, 12 Nov 2025 21:50:37 GMT

symfony/http-foundation <5.4.50 || >=6.0.0, <6.4.29 || >=7.0.0, <7.3.7, fixed in 5.4.50, 6.4.29, 7.3.7. CVSS 7.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL

Mon, 05 May 2025 18:25:04 GMT

browser-use <0.1.45, fixed in 0.1.45. CVSS 4.0 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Duplicate Advisory: `allowed_domains` can be bypassed by putting a decoy domain in http auth username portion of a URL

Sat, 03 May 2025 21:30:23 GMT

browser-use <0.1.45, fixed in 0.1.45. CVSS 9.3 (Critical). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-43916: api.sonos.com: Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used…

Mon, 21 Apr 2025 00:00:00 GMT

CVSS 3.4 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2022-43939: Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions

Mon, 03 Apr 2023 18:10:32 GMT

CVSS 8.6 (High). Critical: In CISA’s KEV catalogue since 3 Mar 2025: it is known to be exploited. CVSS score 8.6 (7.0 or more) and EPSS 0.92 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.