# CWE-669.

Every Advisory and CVE whose sources give the weakness CWE-669, newest first.

## Records, newest first

- [@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim.](https://agentprime.io/advisories/CVE-2026-123010.md)
  `CVE-2026-123010` · CVE record: twilio-labs netlify-okta-auth · CVSS 7.2 High · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-669
- [Yealink UVC40 E2: On Yealink UVC40 E2 devices before 319.410.0.71…](https://agentprime.io/advisories/CVE-2026-122124.md)
  `CVE-2026-122124` · CVE record: Yealink UVC40 E2 · CVSS 6.1 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-669
- [Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping…](https://agentprime.io/advisories/CVE-2026-114722.md)
  `CVE-2026-114722` · CVE record: Roundcube Webmail · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-669
- [OpenStack Cinder: In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the…](https://agentprime.io/advisories/CVE-2026-93856.md)
  `CVE-2026-93856` · CVE record: OpenStack Cinder · CVSS 4.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-669
- [Openwave Messaging (Ireland) Limited Webtop Media Transcoder: Openwave Webtop Media Transcoder does not enforce administrator-defined file type…](https://agentprime.io/advisories/CVE-2026-111793.md)
  `CVE-2026-111793` · CVE record: Openwave Messaging (Ireland) Limited Webtop Media Transcoder · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-669
- [Wheels: Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a…](https://agentprime.io/advisories/CVE-2026-111445.md)
  `CVE-2026-111445` · CVE record: Wheels Wheels · CVSS 8.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-669
- [Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens.](https://agentprime.io/advisories/CVE-2026-110907.md)
  `CVE-2026-110907` · CVE record: BackdropCMS Backdrop · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-669
- [OpenBSD OpenSSH: In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly…](https://agentprime.io/advisories/CVE-2026-106555.md)
  `CVE-2026-106555` · CVE record: OpenBSD OpenSSH · CVSS 2.2 Low · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-669
- [OpenBSD OpenSSH: In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a…](https://agentprime.io/advisories/CVE-2026-106553.md)
  `CVE-2026-106553` · CVE record: OpenBSD OpenSSH · CVSS 2.2 Low · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-669
- [vm2: Incomplete nodejs.\* symbol filtering lets sandbox override host WebStream state checks](https://agentprime.io/advisories/GHSA-jf8q-945g-9q4c.md)
  `GHSA-jf8q-945g-9q4c`, `CVE-2026-92952` · npm `vm2`: affected `>=3.11.4, <3.11.7`, fixed in `3.11.7` · CVSS 8.9 High · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-669
- [NVIDIA Virtual GPU Manager: NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability where an attacker…](https://agentprime.io/advisories/CVE-2026-47574.md)
  `CVE-2026-47574` · CVE record: NVIDIA Virtual GPU Manager · CVSS 7.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-669
- [Pexip Infinity: Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0…](https://agentprime.io/advisories/CVE-2026-103106.md)
  `CVE-2026-103106` · CVE record: Pexip Infinity · CVSS 7.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-669
- [Duplicate Advisory: Incomplete nodejs.\* symbol filtering lets sandbox override host WebStream state checks](https://agentprime.io/advisories/GHSA-hmpr-c9rf-qcrf.md)
  `GHSA-hmpr-c9rf-qcrf` · npm `vm2`: affected `>=3.11.4, <=3.11.6`, no fixed version yet · CVSS 6.8 Medium · Withdrawn · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-669
- [Cisco Identity Services Engine Hardening Release - Incorrect Resource Transfer Vulnerabilities](https://agentprime.io/advisories/CVE-2026-20194.md)
  `CVE-2026-20194` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-669
- [In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0.](https://agentprime.io/advisories/CVE-2026-38924.md)
  `CVE-2026-38924` · CVE record: Oraios AI Serena · CVSS 2.9 Low · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-669
- [TrustedFirmware Mbed TLS: In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2…](https://agentprime.io/advisories/CVE-2026-25832.md)
  `CVE-2026-25832` · CVE record: TrustedFirmware Mbed TLS · CVSS 3.7 Low · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-669
- [An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3.](https://agentprime.io/advisories/CVE-2023-37253.md)
  `CVE-2023-37253` · CVE record: MediaWiki ProofreadPage · CVSS 3.1 Low · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-669
- [An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3.](https://agentprime.io/advisories/CVE-2023-37252.md)
  `CVE-2023-37252` · CVE record: MediaWiki CheckUser · CVSS 3.1 Low · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-669
- [Amazon ca-certificates: The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2)…](https://agentprime.io/advisories/CVE-2023-32803.md)
  `CVE-2023-32803` · CVE record: Amazon ca-certificates · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-669
- [Floodlight 71fe8a7 allows disruption of host communication via link spoofing.](https://agentprime.io/advisories/CVE-2025-45480.md)
  `CVE-2025-45480` · CVE record: projectfloodlight Floodlight · CVSS 3.0 Low · Not analysed yet · Published 13 Sept 2026 · Tags: CWE-669
- [PCRE2: In PCRE2 before 10.48, pcre2_serialize_encode might disclose two bytes to an adversary…](https://agentprime.io/advisories/CVE-2026-89162.md)
  `CVE-2026-89162` · CVE record: PCRE PCRE2 · CVSS 2.9 Low · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-669
- [Tor: Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not…](https://agentprime.io/advisories/CVE-2026-87724.md)
  `CVE-2026-87724` · CVE record: torprject Tor · CVSS 6.5 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-669
- [xmlsoft libxml2: In xinclude in libxml2 before 2.15.4…](https://agentprime.io/advisories/CVE-2026-86144.md)
  `CVE-2026-86144` · CVE record: xmlsoft libxml2 · CVSS 5.6 Medium · Not analysed yet · Published 5 Sept 2026 · Tags: CWE-669
- [Roundcube Webmail: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3…](https://agentprime.io/advisories/CVE-2026-75010.md)
  `CVE-2026-75010` · CVE record: Roundcube Webmail · CVSS 6.4 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-669
- [Roundcube Webmail: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3…](https://agentprime.io/advisories/CVE-2026-75003.md)
  `CVE-2026-75003` · CVE record: Roundcube Webmail · CVSS 5.8 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-669
- [Roundcube Webmail: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3…](https://agentprime.io/advisories/CVE-2026-75000.md)
  `CVE-2026-75000` · CVE record: Roundcube Webmail · CVSS 5.8 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-669
- [Zimbra Collaboration: In Zimbra Collaboration before 10.1.17…](https://agentprime.io/advisories/CVE-2026-73574.md)
  `CVE-2026-73574` · CVE record: Zimbra Collaboration · CVSS 3.1 Low · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-669
- [OpenStack Designate: In OpenStack Designate before 22.0.2…](https://agentprime.io/advisories/CVE-2026-71194.md)
  `CVE-2026-71194` · CVE record: OpenStack Designate · CVSS 6.8 Medium · Not analysed yet · Published 12 Aug 2026 · Tags: CWE-669
- [OpenBSD OpenSSH: In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended…](https://agentprime.io/advisories/CVE-2026-73281.md)
  `CVE-2026-73281` · CVE record: OpenBSD OpenSSH · CVSS 3.5 Low · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-669
- [OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints](https://agentprime.io/advisories/GHSA-mfg3-p6m3-gjgr.md)
  `GHSA-mfg3-p6m3-gjgr`, `CVE-2026-46448`, `PYSEC-2026-2686` · PyPI `nova`: affected `>=18.0.0, <=31.3.0 || >=32.0.0, <32.2.1 || >=33.0.0, <33.0.2`, fixed in `32.2.1`, `33.0.2` · CVSS 5.4 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-669
- [Avira Password Manager credential disclosure via cross-origin autofill in Firefox](https://agentprime.io/advisories/CVE-2026-12068.md)
  `CVE-2026-12068` · CVE record: Gen Digital Avira Password Manager · CVSS 7.4 High · Not analysed yet · Published 12 Jun 2026 · Tags: CWE-669
- [OpenStack Ironic allows Boot Script Injection](https://agentprime.io/advisories/GHSA-jrh2-f5jc-xpgr.md)
  `GHSA-jrh2-f5jc-xpgr`, `CVE-2026-46447`, `PYSEC-2026-3471` · PyPI `ironic`: affected `>=17.0.0, <26.1.7 || >=27.0.0, <29.0.6 || >=30.0.0, <32.0.2 || >=33.0.0, <35.0.2`, fixed in `26.1.7`, `29.0.6`, `32.0.2`, `35.0.2` · CVSS 5.8 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-669
- [OpenStack Ironic: OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager…](https://agentprime.io/advisories/CVE-2026-44917.md)
  `CVE-2026-44917` · CVE record: OpenStack Ironic · CVSS 4.9 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-669
- [Roundcube Webmail: Roundcube Webmail 1.6.x before 1.6.16…](https://agentprime.io/advisories/CVE-2026-48847.md)
  `CVE-2026-48847` · CVE record: Roundcube Webmail · CVSS 3.7 Low · Not analysed yet · Published 25 May 2026 · Tags: CWE-669
- [Roundcube Webmail: In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1…](https://agentprime.io/advisories/CVE-2026-48846.md)
  `CVE-2026-48846` · CVE record: Roundcube Webmail · CVSS 6.5 Medium · Not analysed yet · Published 25 May 2026 · Tags: CWE-669
- [Roundcube Webmail: In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1…](https://agentprime.io/advisories/CVE-2026-48845.md)
  `CVE-2026-48845` · CVE record: Roundcube Webmail · CVSS 6.5 Medium · Not analysed yet · Published 25 May 2026 · Tags: CWE-669
- [Wine: Wine ships a .desktop file that registers itself as a MIME handler for EXE files and…](https://agentprime.io/advisories/CVE-2026-48831.md)
  `CVE-2026-48831` · CVE record: WineHQ Wine · CVSS 7.3 High · Not analysed yet · Published 24 May 2026 · Tags: CWE-669
- [Talos Linux has a local privilege escalation from untrusted workloads](https://agentprime.io/advisories/GHSA-m38g-vww2-mvgx.md)
  `GHSA-m38g-vww2-mvgx` · Go `github.com/siderolabs/talos`: affected `<1.12.7`, fixed in `1.12.7` · CVSS 7.5 High · Not analysed yet · Published 7 May 2026 · Tags: CWE-669
- [Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.](https://agentprime.io/advisories/CVE-2026-44599.md)
  `CVE-2026-44599` · CVE record: torproject Tor · CVSS 3.7 Low · Not analysed yet · Published 7 May 2026 · Tags: CWE-669
- [OpenStack Ironic has an Incorrect Resource Transfer Between Spheres](https://agentprime.io/advisories/GHSA-54w4-233h-x86g.md)
  `GHSA-54w4-233h-x86g`, `CVE-2026-42997`, `PYSEC-2026-2526` · PyPI `ironic-python-agent`: affected `<26.1.6 || >=27.0.0, <29.0.5 || >=30.0.0, <32.0.1 || >=33.0.0, <35.0.1`, fixed in `26.1.6`, `29.0.5`, `32.0.1`, `35.0.1` · CVSS 7.7 High · Not analysed yet · Published 5 May 2026 · Tags: Information disclosure, CWE-669
- [Remote Code Execution in multiple BinSoft products](https://agentprime.io/advisories/CVE-2026-40552.md)
  `CVE-2026-40552` · CVE record: BinSoft mpGabinet and 4 more · CVSS 4.7 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: CWE-669
- [KDE Dolphin: KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor…](https://agentprime.io/advisories/CVE-2026-41525.md)
  `CVE-2026-41525` · CVE record: KDE Dolphin · CVSS 6.5 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: CWE-669
- [crypto: algif_aead - Revert to operating out-of-place](https://agentprime.io/advisories/CVE-2026-31431.md)
  `CVE-2026-31431` · CVE record: Linux Linux · CVSS 7.8 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.98 · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-669, CWE-1288
- [Ascensio ONLYOFFICE DesktopEditors: In ONLYOFFICE DesktopEditors before 9.3.0…](https://agentprime.io/advisories/CVE-2026-41030.md)
  `CVE-2026-41030` · CVE record: Ascensio ONLYOFFICE DesktopEditors · CVSS 6.2 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: CWE-669
- [systemd: In systemd 259, systemd-journald can send ANSI escape sequences to the terminals of…](https://agentprime.io/advisories/CVE-2026-40228.md)
  `CVE-2026-40228` · CVE record: systemd systemd · CVSS 2.9 Low · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-669
- [systemd: In udev in systemd before 260, local root execution can occur via malicious hardware…](https://agentprime.io/advisories/CVE-2026-40225.md)
  `CVE-2026-40225` · CVE record: systemd systemd · CVSS 6.4 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-669
- [Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages](https://agentprime.io/advisories/GHSA-xpqh-grpw-4xmg.md)
  `GHSA-xpqh-grpw-4xmg`, `CVE-2026-35544`, `PKSA-wvxn-8qzx-v8n9` · Packagist `roundcube/roundcubemail`: affected `>=1.7-beta, <1.7-rc5`, fixed in `1.7-rc5` · CVSS 5.3 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-669
- [Roundcube Webmail: Remote image blocking feature can be bypassed via SVG content in an e-mail message](https://agentprime.io/advisories/GHSA-w846-74jr-76cv.md)
  `GHSA-w846-74jr-76cv`, `CVE-2026-35545`, `PKSA-hnx5-g7mc-vpff` · Packagist `roundcube/roundcubemail`: affected `>=1.7-beta, <1.7-rc5`, fixed in `1.7-rc5` · CVSS 5.3 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-669
- [Roundcube Webmail: Insufficient CSS sanitization in HTML e-mail messages](https://agentprime.io/advisories/GHSA-vxg2-hhgr-37fx.md)
  `GHSA-vxg2-hhgr-37fx`, `CVE-2026-35540`, `PKSA-vsf6-6r3q-jc1x` · Packagist `roundcube/roundcubemail`: affected `>=1.7-beta, <1.7-rc5`, fixed in `1.7-rc5` · CVSS 5.4 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: Server-side request forgery (SSRF), CWE-669
- [Roundcube Webmail: Bypass of remote image blocking via SVG content (with animate attributes) in an e-mail message](https://agentprime.io/advisories/GHSA-j2g6-8rvg-7mf6.md)
  `GHSA-j2g6-8rvg-7mf6`, `CVE-2026-35543`, `PKSA-qdpg-77hy-3x5t` · Packagist `roundcube/roundcubemail`: affected `>=1.7-beta, <1.7-rc5`, fixed in `1.7-rc5` · CVSS 5.3 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-669
- [Roundcube: Bypass of remote image blocking via crafted BODY background attribute](https://agentprime.io/advisories/GHSA-5hf6-crg4-fg59.md)
  `GHSA-5hf6-crg4-fg59`, `CVE-2026-35542`, `PKSA-kj9x-s73h-chn8` · Packagist `roundcube/roundcubemail`: affected `>=1.7-beta, <1.7-rc5`, fixed in `1.7-rc5` · CVSS 5.3 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-669
- [CODESYS Control Boot Application Replacement Enables Code Execution](https://agentprime.io/advisories/CVE-2025-41660.md)
  `CVE-2025-41660` · CVE record: CODESYS CODESYS Control RTE (SL) and 4 more · CVSS 8.8 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-669
- [In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.](https://agentprime.io/advisories/CVE-2026-33265.md)
  `CVE-2026-33265` · CVE record: LibreChat LibreChat · CVSS 6.3 Medium · Not analysed yet · Published 18 Mar 2026 · Tags: CWE-669
- [GNU inetutils: telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment…](https://agentprime.io/advisories/CVE-2026-32772.md)
  `CVE-2026-32772` · CVE record: GNU inetutils · CVSS 3.4 Low · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-669
- [OpenStack Nova calls qemu-img without format restrictions for resize](https://agentprime.io/advisories/GHSA-m4f3-qp2w-gwh6.md)
  `GHSA-m4f3-qp2w-gwh6`, `CVE-2026-24708`, `PYSEC-2026-2685` · PyPI `nova`: affected `<=30.2.1 || >=31.0.0.0rc1, <=31.2.0 || >=32.0.0.0rc1, <=32.1.0`, no fixed version yet · CVSS 8.2 High · Not analysed yet · Published 18 Feb 2026 · Tags: Path traversal, CWE-669
- [OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl](https://agentprime.io/advisories/GHSA-g8p2-7wf7-98mq.md)
  `GHSA-g8p2-7wf7-98mq`, `CVE-2026-25253` · npm `clawdbot`: affected `<2026.1.29`, fixed in `2026.1.29` · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.32 · Not analysed yet · Published 2 Feb 2026 · Tags: Information disclosure, CWE-669
- [Duplicate Advisory: 1-Click RCE via Authentication Token Exfiltration From gatewayUrl](https://agentprime.io/advisories/GHSA-r2c6-8jc8-g32w.md)
  `GHSA-r2c6-8jc8-g32w` · npm `clawdbot`: affected `<2026.1.29`, fixed in `2026.1.29` · CVSS 8.8 High · Withdrawn · Not analysed yet · Published 2 Feb 2026 · Tags: CWE-669
- [Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credential...](https://agentprime.io/advisories/PYSEC-2025-103.md)
  `PYSEC-2025-103`, `CVE-2025-63387` · PyPI `dify-client`: affected `<=1.9.1`, no fixed version yet · CVSS 4.3 Medium · EPSS 0.19 · Not analysed yet · Published 18 Dec 2025 · Tags: Broken access control, CWE-669
- [Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context](https://agentprime.io/advisories/GHSA-66h8-3g48-6hx8.md)
  `GHSA-66h8-3g48-6hx8`, `CVE-2025-67895`, `PYSEC-2025-87`, `PYSEC-2026-276` · PyPI `apache-airflow-providers-edge3`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Dec 2025 · Tags: CWE-669
- [Mercku M6a devices through 2.1.0 allow root TELNET logins via the web admin password.](https://agentprime.io/advisories/CVE-2025-62775.md)
  `CVE-2025-62775` · CVE record: Mercku M6a · CVSS 8.0 High · Not analysed yet · Published 22 Oct 2025 · Tags: CWE-669

Older: <https://agentprime.io/advisories/tag/cwe-669.md?cursor=WyIyMDI1LTEwLTIyVDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNS02Mjc3NSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-669>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-669/>. Everything for agents: <https://agentprime.io/llms.txt>.