# CWE-670.

Every Advisory and CVE whose sources give the weakness CWE-670, newest first.

## Records, newest first

- [Keycloak-services: keycloak-services: par single-use bypass via flow restart](https://agentprime.io/advisories/CVE-2026-117859.md)
  `CVE-2026-117859` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-670
- [Authlib: empty signatures validation in JWS JSON deserialization](https://agentprime.io/advisories/GHSA-6v38-4h7w-rj9h.md)
  `GHSA-6v38-4h7w-rj9h`, `CVE-2026-96760` · PyPI `authlib`: affected `<1.9.0`, fixed in `1.9.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Weak cryptography or TLS, CWE-20, CWE-358, CWE-670
- [x86/AMD: ineffectual Zenbleed workaround](https://agentprime.io/advisories/CVE-2026-79608.md)
  `CVE-2026-79608` · CVE record: Xen Xen · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-670
- [JIT miscompilation in the JavaScript Engine: JIT component](https://agentprime.io/advisories/CVE-2026-109722.md)
  `CVE-2026-109722` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-670
- [AsyncHttpClient: WebSocket handshake continues after a failed Sec-WebSocket-Accept check](https://agentprime.io/advisories/CVE-2026-107284.md)
  `CVE-2026-107284` · CVE record: AsyncHttpClient async-http-client · CVSS 3.7 Low · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-345, CWE-670
- [OpenBSD OpenSSH: In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to…](https://agentprime.io/advisories/CVE-2026-106586.md)
  `CVE-2026-106586` · CVE record: OpenBSD OpenSSH · CVSS 2.5 Low · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-670
- [Vyper: Return inside for loop more than 1 level deep](https://agentprime.io/advisories/GHSA-vg88-3v92-rjx2.md)
  `GHSA-vg88-3v92-rjx2`, `CVE-2020-37288` · PyPI `vyper`: affected `>=0.1.0b10, <0.2.3`, fixed in `0.2.3` · CVSS 6.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-670, CWE-691
- [Missing authentication on a Kiteworks appliance setup function](https://agentprime.io/advisories/CVE-2026-102110.md)
  `CVE-2026-102110` · CVE record: Kiteworks Core · CVSS 5.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Authentication bypass, CWE-670
- [Kiteworks Core Missing Authentication for Critical Function](https://agentprime.io/advisories/CVE-2026-102124.md)
  `CVE-2026-102124` · CVE record: Kiteworks Core · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Authentication bypass, CWE-670
- [MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled](https://agentprime.io/advisories/CVE-2026-92932.md)
  `CVE-2026-92932` · CVE record: misp sachertortephp · CVSS 5.1 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-670
- [Security Advisory 0175](https://agentprime.io/advisories/CVE-2026-73468.md)
  `CVE-2026-73468` · CVE record: Arista Networks EOS · CVSS 7.1 High · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-670
- [MintyItanium Lost-Auction takes items like barrier blocks out from search GUI](https://agentprime.io/advisories/CVE-2026-55624.md)
  `CVE-2026-55624` · CVE record: MintyItanium Lost-Auction · CVSS 5.3 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-670
- [Rocq Prover before 9.2.0 Guard Checker Accepts Fixpoint Passed as a Higher-Order Argument](https://agentprime.io/advisories/CVE-2026-72705.md)
  `CVE-2026-72705` · CVE record: rocq-prover rocq · CVSS 6.8 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-670
- [Rocq Prover through 9.2.0 Guard Checker Trusts Corrupted Recursive Tree After Transport](https://agentprime.io/advisories/CVE-2026-72704.md)
  `CVE-2026-72704` · CVE record: rocq-prover rocq · CVSS 6.8 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-670
- [Rocq Prover 8.20 before 9.2.0 Guard Checker Accepts Non-Terminating Fixpoint via Unchecked Cross-Calls](https://agentprime.io/advisories/CVE-2026-72703.md)
  `CVE-2026-72703` · CVE record: rocq-prover rocq · CVSS 6.8 Medium · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-670
- [Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass](https://agentprime.io/advisories/CVE-2026-19487.md)
  `CVE-2026-19487` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-670
- [OpenBSD OpenSSH: In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to…](https://agentprime.io/advisories/CVE-2026-73283.md)
  `CVE-2026-73283` · CVE record: OpenBSD OpenSSH · CVSS 2.5 Low · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-670
- [Intel(R) Xeon(R) processors may allow an escalation of…: Always-incorrect control flow implementation in some firmware for some Intel(R) Xeon(R)…](https://agentprime.io/advisories/CVE-2026-20713.md)
  `CVE-2026-20713` · CVE record: Intel(R) Xeon(R) processors may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts. · CVSS 4.5 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-670
- [JIT miscompilation in the JavaScript Engine: JIT component](https://agentprime.io/advisories/CVE-2026-16392.md)
  `CVE-2026-16392` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Memory corruption, CWE-670
- [Gstreamer1-plugins-bad-free: gstreamer: webrtcbin accepts remote sdp without a=fingerprint due to inverted presence check](https://agentprime.io/advisories/CVE-2026-14935.md)
  `CVE-2026-14935` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 3.7 Low · Not analysed yet · Published 7 Jul 2026 · Tags: CWE-670
- [cut: -s (only-delimited) ignored when delimiter is a newline](https://agentprime.io/advisories/GHSA-wv33-5pxh-r7j7.md)
  `GHSA-wv33-5pxh-r7j7`, `CVE-2026-35343` · crates.io `uu_cut`: affected `<0.7.0`, fixed in `0.7.0` · CVSS 3.3 Low · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-670
- [Capgo - Integrity Issue in Release Routing via Multiple Public Channels](https://agentprime.io/advisories/CVE-2026-56328.md)
  `CVE-2026-56328` · CVE record: Capgo Capgo · CVSS 7.1 High · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-670
- [Broken IPv6 Neighbor Discovery input validation allows spoofed RA/NS/NA acceptance in Zephyr net stack](https://agentprime.io/advisories/CVE-2026-7656.md)
  `CVE-2026-7656` · CVE record: zephyrproject zephyr · CVSS 8.1 High · Not analysed yet · Published 29 Jun 2026 · Tags: Authentication bypass, CWE-670
- [Apache Tomcat has an Always-Incorrect Control Flow Implementation vulnerability](https://agentprime.io/advisories/GHSA-mqg3-r7h5-24x4.md)
  `GHSA-mqg3-r7h5-24x4`, `BIT-tomcat-2026-55276`, `CVE-2026-55276` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=11.0.0-M1, <11.0.23 || >=10.1.0-M1, <10.1.56 || >=9.0.0.M1, <9.0.119 || >=8.5.0, <=8.5.100`, fixed in `11.0.23`, `10.1.56`, `9.0.119` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-670
- [Apache Tomcat's rewrite valve has an Always-Incorrect Control Flow Implementation vulnerability](https://agentprime.io/advisories/GHSA-h792-v28v-ppgr.md)
  `GHSA-h792-v28v-ppgr`, `BIT-tomcat-2026-53404`, `CVE-2026-53404` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=11.0.0-M1, <11.0.23 || >=10.1.0-M1, <10.1.56 || >=9.0.0.M1, <9.0.119 || >=8.5.0, <=8.5.100`, fixed in `11.0.23`, `10.1.56`, `9.0.119` · CVSS 7.3 High · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-670
- [Cap-go - Broken Cursor Pagination in /private/devices Endpoint](https://agentprime.io/advisories/CVE-2026-56307.md)
  `CVE-2026-56307` · CVE record: Cap-go capgo · CVSS 5.3 Medium · Not analysed yet · Published 20 Jun 2026 · Tags: CWE-670
- [JIT miscompilation in the JavaScript: WebAssembly component](https://agentprime.io/advisories/CVE-2026-12321.md)
  `CVE-2026-12321` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-670
- [Roundcube Webmail: Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation…](https://agentprime.io/advisories/CVE-2026-48844.md)
  `CVE-2026-48844` · CVE record: Roundcube Webmail · CVSS 7.5 High · Not analysed yet · Published 25 May 2026 · Tags: CWE-670
- [Cisco Nexus 3000 and 9000 Series Border Gateway Protocol Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-20171.md)
  `CVE-2026-20171` · CVE record: Cisco Cisco NX-OS Software · CVSS 6.8 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-670
- [An issue in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code via the dash_uploader/httprequesthandler.py, dash_uploader/upload.py in the Upload fu...](https://agentprime.io/advisories/PYSEC-2026-37.md)
  `PYSEC-2026-37`, `CVE-2026-38361` · PyPI `dash-uploader`: affected `>=0.1.0, <0.7.0a1`, fixed in `0.7.0a1` · CVSS 7.5 High · Not analysed yet · Published 8 May 2026 · Tags: Denial of service, CWE-670
- [In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.](https://agentprime.io/advisories/CVE-2026-44928.md)
  `CVE-2026-44928` · CVE record: uriparser uriparser · CVSS 2.9 Low · Not analysed yet · Published 8 May 2026 · Tags: CWE-670
- [ydb-go-sdk's transactions are not committed using the \`options.WithCommit()\` option on last call \`table.Transaction.Execute\` in transaction](https://agentprime.io/advisories/GHSA-28xx-pppm-vqff.md)
  `GHSA-28xx-pppm-vqff`, `GO-2026-4983` · Go `github.com/ydb-platform/ydb-go-sdk/v3`: affected `>=3.104.6, <3.134.2`, fixed in `3.134.2` · CVSS 4.0, no score published · Not analysed yet · Published 30 Apr 2026 · Tags: CWE-670
- [Duplicate Advisory: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided](https://agentprime.io/advisories/GHSA-qmq6-f8pr-cx5x.md)
  `GHSA-qmq6-f8pr-cx5x` · npm `uuid`: affected `<14.0.0`, fixed in `14.0.0` · CVSS 3.2 Low · Withdrawn · Not analysed yet · Published 23 Apr 2026 · Tags: CWE-670
- [uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided](https://agentprime.io/advisories/GHSA-w5hq-g745-h8pq.md)
  `GHSA-w5hq-g745-h8pq`, `CVE-2026-41907`, `CVE-2026-41988` · npm `uuid`: affected `<11.1.1 || >=12.0.0, <12.0.1 || >=13.0.0, <13.0.1`, fixed in `11.1.1`, `12.0.1`, `13.0.1` · CVSS 8.1 High · Not analysed yet · Published 22 Apr 2026 · Tags: Memory corruption, CWE-670, CWE-823, CWE-1285
- [Duplicate Advisory: uutils coreutils has an Issue With its Always-Incorrect Control Flow Implementation](https://agentprime.io/advisories/GHSA-hj9r-8pfm-rmjj.md)
  `GHSA-hj9r-8pfm-rmjj` · crates.io `coreutils`: affected `<0.7.0`, fixed in `0.7.0` · CVSS 3.3 Low · Withdrawn · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-670
- [KDE Kleopatra: KDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a…](https://agentprime.io/advisories/CVE-2026-41527.md)
  `CVE-2026-41527` · CVE record: KDE Kleopatra · CVSS 6.9 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-670
- [FastChat has a Content Moderation Bypass via Arena Side-by-Side Views](https://agentprime.io/advisories/GHSA-f3q6-69f3-vwch.md)
  `GHSA-f3q6-69f3-vwch`, `CVE-2026-6608`, `PYSEC-2026-2485` · PyPI `fschat`: affected `<=0.2.36`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: CWE-670
- [Luanti 5 before 5.15.2 sometimes allows unintended access to an insecure environment.](https://agentprime.io/advisories/CVE-2026-40960.md)
  `CVE-2026-40960` · CVE record: Luanti Luanti · CVSS 8.1 High · Not analysed yet · Published 16 Apr 2026 · Tags: CWE-670
- [Data Sharing Framework has an Inverted Time Comparison in OIDC JWKS and Token Cache](https://agentprime.io/advisories/GHSA-xmj9-7625-f634.md)
  `GHSA-xmj9-7625-f634`, `CVE-2026-40942` · Maven `dev.dsf:dsf-bpe-process-api-v2` and 1 more: affected `*`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 15 Apr 2026 · Tags: CWE-670
- [MaraDNS: Deadwood in MaraDNS 3.5.0036 allows attackers to exhaust connection slots via a zone…](https://agentprime.io/advisories/CVE-2026-40719.md)
  `CVE-2026-40719` · CVE record: MaraDNS MaraDNS · CVSS 7.5 High · Not analysed yet · Published 15 Apr 2026 · Tags: CWE-670
- [varnish-software Varnish Cache: Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon…](https://agentprime.io/advisories/CVE-2026-40396.md)
  `CVE-2026-40396` · CVE record: varnish-software Varnish Cache · CVSS 4.0 Medium · Not analysed yet · Published 12 Apr 2026 · Tags: CWE-670
- [varnish-software Varnish Cache: Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace…](https://agentprime.io/advisories/CVE-2026-40394.md)
  `CVE-2026-40394` · CVE record: varnish-software Varnish Cache · CVSS 4.0 Medium · Not analysed yet · Published 12 Apr 2026 · Tags: CWE-670
- [An issue was discovered in musl libc 0.7.10 through 1.2.6.](https://agentprime.io/advisories/CVE-2026-40200.md)
  `CVE-2026-40200` · CVE record: musl-libc musl · CVSS 8.1 High · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-670
- [Host panic when Winch compiler executes \`table.fill\`](https://agentprime.io/advisories/GHSA-q49f-xg75-m9xw.md)
  `GHSA-q49f-xg75-m9xw`, `CVE-2026-34946`, `RUSTSEC-2026-0089` · crates.io `wasmtime`: affected `>=0.0.0-0, <36.0.7 || >=37.0.0, <42.0.2 || >=43.0.0, <43.0.1`, fixed in `36.0.7`, `42.0.2`, `43.0.1` · CVSS 5.9 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-670
- [OpenClaw: Endpoint persists after trust decline, leaking gateway credentials](https://agentprime.io/advisories/GHSA-9f4w-67g7-mqwv.md)
  `GHSA-9f4w-67g7-mqwv`, `CVE-2026-41300` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 6.9 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-372, CWE-670
- [OpenBSD OpenSSH: OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon…](https://agentprime.io/advisories/CVE-2026-35414.md)
  `CVE-2026-35414` · CVE record: OpenBSD OpenSSH · CVSS 4.2 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-670
- [OpenSSH before 10.3 can use unintended ECDSA algorithms.](https://agentprime.io/advisories/CVE-2026-35387.md)
  `CVE-2026-35387` · CVE record: OpenBSD OpenSSH · CVSS 3.1 Low · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-670
- [Apache Traffic Server: A simple legitimate POST request causes a crash](https://agentprime.io/advisories/CVE-2025-58136.md)
  `CVE-2025-58136` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.5 High · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-670
- [Nest Fastify HEAD Request Middleware Bypass](https://agentprime.io/advisories/GHSA-wf42-42fg-fg84.md)
  `GHSA-wf42-42fg-fg84`, `CVE-2026-33011` · npm `@nestjs/platform-fastify`: affected `<11.1.16`, fixed in `11.1.16` · CVSS 8.7 High · Not analysed yet · Published 17 Mar 2026 · Tags: CWE-670
- [PX4 Autopilot MAVLink FTP Session Validation Logic Error Allows Operations on Invalid File Descriptors](https://agentprime.io/advisories/CVE-2026-32713.md)
  `CVE-2026-32713` · CVE record: PX4 PX4-Autopilot · CVSS 4.3 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-670
- [Cosmos EVM: incorrect state handling during nested EVM execution paths](https://agentprime.io/advisories/GHSA-54gx-3cgr-7mfm.md)
  `GHSA-54gx-3cgr-7mfm`, `GO-2026-4677` · Go `github.com/cosmos/evm`: affected `<0.6.0`, fixed in `0.6.0` · CVSS 4.0, no score published · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-670
- [Denial-of-Service (DoS) vulnerability in Ethernet function of MELSEC iQ-F Series EtherNet/IP module and Ethernet module](https://agentprime.io/advisories/CVE-2026-1874.md)
  `CVE-2026-1874` · CVE record: Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP and 1 more · CVSS 8.7 High · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-670
- [The rs-soroban-sdk #\[contractimpl\] macro calls inherent function instead of trait function when names collide](https://agentprime.io/advisories/GHSA-4chv-4c6w-w254.md)
  `GHSA-4chv-4c6w-w254`, `CVE-2026-26267` · crates.io `soroban-sdk-macros`: affected `<22.0.10 || >=23.0.0, <23.5.2 || >=25.0.0, <25.1.1`, fixed in `22.0.10`, `23.5.2`, `25.1.1` · CVSS 7.5 High · Not analysed yet · Published 17 Feb 2026 · Tags: CWE-670
- [NVIDIA DGX Spark: NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware…](https://agentprime.io/advisories/CVE-2025-33199.md)
  `CVE-2025-33199` · CVE record: NVIDIA DGX Spark · CVSS 3.2 Low · Not analysed yet · Published 25 Nov 2025 · Tags: CWE-670
- [SSH Tectia Server: SSH Tectia Server before 6.6.6 sometimes allows attackers to read and alter a user's…](https://agentprime.io/advisories/CVE-2025-32942.md)
  `CVE-2025-32942` · CVE record: SSH Tectia Server · CVSS 7.2 High · Not analysed yet · Published 2 Oct 2025 · Tags: CWE-670
- [A logic issue was addressed with improved state management.](https://agentprime.io/advisories/CVE-2025-43359.md)
  `CVE-2025-43359` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2025 · Tags: CWE-670
- [KDE Konsole before 25.04.2 allows remote code execution in a certain scenario.](https://agentprime.io/advisories/CVE-2025-49091.md)
  `CVE-2025-49091` · CVE record: KDE Konsole · CVSS 8.2 High · Not analysed yet · Published 11 Jun 2025 · Tags: CWE-670
- [http-proxy-middleware can call writeBody twice because "else if" is not used](https://agentprime.io/advisories/GHSA-4www-5p9h-95mh.md)
  `GHSA-4www-5p9h-95mh`, `CVE-2025-32996` · npm `http-proxy-middleware`: affected `>=1.3.0, <2.0.8 || >=3.0.0, <3.0.4`, fixed in `2.0.8`, `3.0.4` · CVSS 4.0 Medium · Not analysed yet · Published 15 Apr 2025 · Tags: CWE-670
- [tough terminating targets role delegations are not respected](https://agentprime.io/advisories/GHSA-v4wr-j3w6-mxqc.md)
  `GHSA-v4wr-j3w6-mxqc`, `CVE-2025-2886` · crates.io `tough`: affected `<0.20.0`, fixed in `0.20.0` · CVSS 5.7 Medium · Not analysed yet · Published 28 Mar 2025 · Tags: CWE-670
- [An issue in onos v2.7.0 allows attackers to trigger unexpected behavior within a device connected to a legacy switch via changing the link type from indirect to direct.](https://agentprime.io/advisories/CVE-2025-29312.md)
  `CVE-2025-29312` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2025 · Tags: CWE-670

Older: <https://agentprime.io/advisories/tag/cwe-670.md?cursor=WyIyMDI1LTAzLTI0VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNS0yOTMxMiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-670>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-670/>. Everything for agents: <https://agentprime.io/llms.txt>.