# CWE-697.

Every Advisory and CVE whose sources give the weakness CWE-697, newest first.

## Records, newest first

- [Certificate Name Authorization Bypass](https://agentprime.io/advisories/CVE-2026-115732.md)
  `CVE-2026-115732` · CVE record: Perforce Puppet Enterprise · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control, CWE-697
- [ZoneMinder failed token handling bypasses web authentication](https://agentprime.io/advisories/CVE-2026-104198.md)
  `CVE-2026-104198` · CVE record: ZoneMinder zoneminder · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass, CWE-697
- [itsmeravitejak Online-Examination-System Session session.php checkLogin comparison](https://agentprime.io/advisories/CVE-2026-108969.md)
  `CVE-2026-108969` · CVE record: itsmeravitejak Online-Examination-System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-697
- [Incorrect comparison in Google Chrome](https://agentprime.io/advisories/CVE-2026-106252.md)
  `CVE-2026-106252` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-697
- [proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet](https://agentprime.io/advisories/GHSA-jqcg-44mw-7w3h.md)
  `GHSA-jqcg-44mw-7w3h`, `CVE-2026-90711` · npm `proxy-addr`: affected `>=1.1.0, <2.0.8`, fixed in `2.0.8` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass, CWE-348, CWE-697
- [CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys](https://agentprime.io/advisories/CVE-2026-71892.md)
  `CVE-2026-71892` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: CWE-697
- [ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range](https://agentprime.io/advisories/GHSA-j6r3-76f7-8jcv.md)
  `GHSA-j6r3-76f7-8jcv`, `CVE-2026-101912` · npm `ip-address`: affected `<10.7.1`, fixed in `10.7.1` · CVSS 6.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption, CWE-697
- [mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet](https://agentprime.io/advisories/CVE-2026-102715.md)
  `CVE-2026-102715` · CVE record: Eclipse Foundation Eclipse ThreadX NetX Duo · CVSS 7.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption, CWE-697
- [ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts](https://agentprime.io/advisories/GHSA-rpw4-54j3-4h4q.md)
  `GHSA-rpw4-54j3-4h4q`, `CVE-2026-101913` · npm `ip-address`: affected `<10.5.1`, fixed in `10.5.1` · CVSS 6.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-697
- [InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth)](https://agentprime.io/advisories/CVE-2026-85292.md)
  `CVE-2026-85292` · CVE record: InvoicePlane InvoicePlane · CVSS 4.8 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-697
- [Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses](https://agentprime.io/advisories/GHSA-jvh5-97xg-v99f.md)
  `GHSA-jvh5-97xg-v99f`, `CVE-2026-79913`, `GO-2026-6572` · Go `github.com/cloudreve/Cloudreve/v4`: affected `<4.0.0-20260715072853-1c5cad6dec7e`, fixed in `4.0.0-20260715072853-1c5cad6dec7e` · CVSS 6.5 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-697
- [olivier-ls PHP-FTS Filter Matching SearchEngine.php matchesSingleFilter comparison](https://agentprime.io/advisories/CVE-2026-93957.md)
  `CVE-2026-93957` · CVE record: olivier-ls PHP-FTS · CVSS 5.3 Medium · Not analysed yet · Published 20 Sept 2026 · Tags: CWE-697
- [Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state](https://agentprime.io/advisories/CVE-2026-71855.md)
  `CVE-2026-71855` · CVE record: OISF suricata · CVSS 5.9 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-697
- [Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6](https://agentprime.io/advisories/CVE-2026-57222.md)
  `CVE-2026-57222` · CVE record: OISF suricata · CVSS 5.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-697
- [Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation](https://agentprime.io/advisories/GHSA-f94q-w3w8-cj67.md)
  `GHSA-f94q-w3w8-cj67`, `CVE-2026-61795`, `GO-2026-6519` · Go `github.com/projectcapsule/capsule`: affected `>=0.13.0, <0.13.7`, fixed in `0.13.7` · CVSS 6.8 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-697
- [Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement](https://agentprime.io/advisories/GHSA-gjw4-3v3v-rqxg.md)
  `GHSA-gjw4-3v3v-rqxg`, `CVE-2026-61672`, `GO-2026-6520` · Go `github.com/projectcapsule/capsule`: affected `<0.13.7`, fixed in `0.13.7` · CVSS 7.1 High · Not analysed yet · Published 18 Sept 2026 · Tags: Broken access control, CWE-697
- [Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison](https://agentprime.io/advisories/CVE-2026-90977.md)
  `CVE-2026-90977` · CVE record: Unknown Clean Login · CVSS 5.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-697
- [Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Incorrect Comparison Vulnerabilities](https://agentprime.io/advisories/CVE-2026-20333.md)
  `CVE-2026-20333` · CVE record: Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and 2 more · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-697
- [@fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet](https://agentprime.io/advisories/CVE-2026-92395.md)
  `CVE-2026-92395` · CVE record: @fastify/proxy-addr @fastify/proxy-addr · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass, CWE-348, CWE-697
- [@fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth](https://agentprime.io/advisories/CVE-2026-92087.md)
  `CVE-2026-92087` · CVE record: @fastify/auth @fastify/auth · CVSS 8.1 High · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control, CWE-697
- [evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass](https://agentprime.io/advisories/CVE-2026-91997.md)
  `CVE-2026-91997` · CVE record: evolution-foundation evolution-api · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-697
- [MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison](https://agentprime.io/advisories/CVE-2026-91851.md)
  `CVE-2026-91851` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control, CWE-697
- [libks has path traversal in kws HTTP parser via URI segment overflow](https://agentprime.io/advisories/CVE-2026-49846.md)
  `CVE-2026-49846` · CVE record: signalwire libks · CVSS 7.5 High · Not analysed yet · Published 11 Sept 2026 · Tags: Path traversal, CWE-697
- [ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement](https://agentprime.io/advisories/CVE-2026-64836.md)
  `CVE-2026-64836` · CVE record: ICEcoder ICEcoder · CVSS 8.7 High · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal, CWE-697
- [OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS](https://agentprime.io/advisories/CVE-2026-56101.md)
  `CVE-2026-56101` · CVE record: OpenBSD OpenBSD · CVSS 6.0 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-697
- [XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint](https://agentprime.io/advisories/CVE-2026-73309.md)
  `CVE-2026-73309` · CVE record: XenForo XenForo · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-697
- [SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql](https://agentprime.io/advisories/GHSA-76wx-w7ww-5xfq.md)
  `GHSA-76wx-w7ww-5xfq`, `CVE-2026-80227`, `EEF-CVE-2026-80227` · Hex `ash_sql`: affected `>=0.1.0, <0.7.1`, fixed in `0.7.1` · CVSS 2.1 Low · Not analysed yet · Published 30 Aug 2026 · Tags: CWE-697
- [Wrong interpretation of ACL ranges](https://agentprime.io/advisories/CVE-2026-18664.md)
  `CVE-2026-18664` · CVE record: NLnet Labs NSD · CVSS 8.2 High · Not analysed yet · Published 26 Aug 2026 · Tags: Broken access control, CWE-697
- [Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart](https://agentprime.io/advisories/CVE-2026-73258.md)
  `CVE-2026-73258` · CVE record: cesanta mongoose · CVSS 6.5 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-697
- [MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET](https://agentprime.io/advisories/CVE-2026-75110.md)
  `CVE-2026-75110` · CVE record: MemTensor MemOS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-697
- [Incorrect comparison in Intel(R) TDX Guest software](https://agentprime.io/advisories/CVE-2026-20765.md)
  `CVE-2026-20765` · CVE record: Intel(R) TDX Guest software · CVSS 4.6 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-697
- [Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreController](https://agentprime.io/advisories/CVE-2026-67207.md)
  `CVE-2026-67207` · CVE record: wolfcms wolfcms · CVSS 8.7 High · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-697
- [Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities](https://agentprime.io/advisories/GHSA-4r9r-4425-74p7.md)
  `GHSA-4r9r-4425-74p7`, `CVE-2026-55771` · Maven `com.cedarpolicy:cedar-java`: affected `<2.3.6 || >=3.1.2, <3.4.1 || >=4.0.0, <4.9.0`, fixed in `2.3.6`, `3.4.1`, `4.9.0` · CVSS 8.8 High · Not analysed yet · Published 28 Jul 2026 · Tags: Code injection, Memory corruption, CWE-697
- [setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+](https://agentprime.io/advisories/GHSA-h35f-9h28-mq5c.md)
  `GHSA-h35f-9h28-mq5c`, `BIT-setuptools-2026-59890`, `CVE-2026-59890`, `PYSEC-2026-3447` · PyPI `setuptools`: affected `<83.0.0`, fixed in `83.0.0` · CVSS 6.1 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-176, CWE-697
- [FlaskBB Logic Flaw Authorization Group Deletion via Bulk AJAX Endpoint](https://agentprime.io/advisories/CVE-2026-22660.md)
  `CVE-2026-22660` · CVE record: flaskbb flaskbb · CVSS 8.6 High · Not analysed yet · Published 10 Jul 2026 · Tags: CWE-697
- [666ghj BettaFish InsightEngine search-result Deduplication agent.py \_deduplicate_results partial string comparison](https://agentprime.io/advisories/CVE-2026-14687.md)
  `CVE-2026-14687` · CVE record: 666ghj BettaFish · CVSS 6.9 Medium · Not analysed yet · Published 5 Jul 2026 · Tags: CWE-187, CWE-697
- [HdrHistogram Range Check DoubleHistogram.java org.HdrHistogram.DoubleHistogram.recordValue comparison](https://agentprime.io/advisories/CVE-2026-14686.md)
  `CVE-2026-14686` · CVE record: HdrHistogram · CVSS 4.8 Medium · Not analysed yet · Published 5 Jul 2026 · Tags: CWE-697
- [NousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer.\_filter_and_accumulate case sensitivity](https://agentprime.io/advisories/CVE-2026-14617.md)
  `CVE-2026-14617` · CVE record: NousResearch hermes-agent · CVSS 2.3 Low · Not analysed yet · Published 3 Jul 2026 · Tags: CWE-178, CWE-697
- [gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host](https://agentprime.io/advisories/GHSA-4gxv-p5g5-j7w7.md)
  `GHSA-4gxv-p5g5-j7w7`, `CVE-2026-49340`, `GO-2026-5827` · Go `go.senan.xyz/gonic`: affected `<0.21.0`, fixed in `0.21.0` · CVSS 8.1 High · Not analysed yet · Published 26 Jun 2026 · Tags: Path traversal, Broken access control, CWE-697
- [js-toml has silent type confusion via falsy-primitive duplicate-key bypass](https://agentprime.io/advisories/GHSA-m34p-749j-x6m6.md)
  `GHSA-m34p-749j-x6m6`, `CVE-2026-50029` · npm `js-toml`: affected `<1.1.2`, fixed in `1.1.2` · CVSS 5.3 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-697
- [ML-KEM-1024 x64 AVX2 incomplete cipher text comparison enables IND-CCA2 break and static private-key recovery](https://agentprime.io/advisories/CVE-2026-10097.md)
  `CVE-2026-10097` · CVE record: wolfSSL wolfSSL · CVSS 8.3 High · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-697
- [Roxy-WI: Path-traversal patch in commit d4d10006 is a no-op (tuple-membership bug)](https://agentprime.io/advisories/CVE-2026-45569.md)
  `CVE-2026-45569` · CVE record: roxy-wi roxy-wi · CVSS 8.1 High · Not analysed yet · Published 10 Jun 2026 · Tags: Path traversal, CWE-697
- [Roxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gpt](https://agentprime.io/advisories/CVE-2026-45567.md)
  `CVE-2026-45567` · CVE record: roxy-wi roxy-wi · CVSS 8.3 High · Not analysed yet · Published 10 Jun 2026 · Tags: Authentication bypass, CWE-697
- [@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers](https://agentprime.io/advisories/GHSA-g759-4pxw-6692.md)
  `GHSA-g759-4pxw-6692`, `CVE-2026-48032` · npm `@hulumi/policies`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 8.3 High · Not analysed yet · Published 10 Jun 2026 · Tags: CWE-697
- [Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking](https://agentprime.io/advisories/GHSA-3qp7-7mw8-wx86.md)
  `GHSA-3qp7-7mw8-wx86`, `CVE-2026-44249` · Maven `io.netty:netty-handler`: affected `>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final`, fixed in `4.2.15.Final`, `4.1.135.Final` · CVSS 8.1 High · Not analysed yet · Published 8 Jun 2026 · Tags: Broken access control, CWE-697, CWE-1287
- [Kavita: Pre-Auth Account Takeover](https://agentprime.io/advisories/CVE-2026-47202.md)
  `CVE-2026-47202` · CVE record: Kareadita Kavita · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 May 2026 · Tags: Authentication bypass, CWE-345, CWE-697
- [hermes-agent has an Incorrect Comparison](https://agentprime.io/advisories/GHSA-cv5c-mh6j-wvp9.md)
  `GHSA-cv5c-mh6j-wvp9`, `CVE-2026-9369`, `PYSEC-2026-2512` · PyPI `hermes-agent`: affected `<0.15.0`, fixed in `0.15.0` · CVSS 4.8 Medium · Not analysed yet · Published 26 May 2026 · Tags: CWE-697
- [Pingvin Share X: TOTP Authentication Bypass via Password-only Login](https://agentprime.io/advisories/CVE-2026-44196.md)
  `CVE-2026-44196` · CVE record: smp46 pingvin-share-x · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Authentication bypass, CWE-697
- [DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation](https://agentprime.io/advisories/GHSA-39q2-94rc-95cp.md)
  `GHSA-39q2-94rc-95cp`, `CVE-2026-65903` · npm `dompurify`: affected `<3.4.0`, fixed in `3.4.0` · CVSS 5.1 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: CWE-697, CWE-783
- [fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)](https://agentprime.io/advisories/GHSA-3j8v-cgw4-2g6q.md)
  `GHSA-3j8v-cgw4-2g6q`, `CVE-2026-35040` · npm `fast-jwt`: affected `<6.2.1`, fixed in `6.2.1` · CVSS 5.3 Medium · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-440, CWE-697
- [Parse Server has a session field immutability bypass via falsy-value guard](https://agentprime.io/advisories/GHSA-f6j3-w9v3-cq22.md)
  `GHSA-f6j3-w9v3-cq22`, `BIT-parse-2026-34574`, `CVE-2026-34574` · npm `parse-server`: affected `<8.6.69 || >=9.0.0, <9.7.0-alpha.14`, fixed in `8.6.69`, `9.7.0-alpha.14` · CVSS 5.3 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-697
- [mppx has Stripe charge credential replay via missing idempotency check](https://agentprime.io/advisories/GHSA-8mhj-rffc-rcvw.md)
  `GHSA-8mhj-rffc-rcvw`, `CVE-2026-34210` · npm `mppx`: affected `<0.4.11`, fixed in `0.4.11` · CVSS 6.0 Medium · Not analysed yet · Published 29 Mar 2026 · Tags: CWE-697
- [rs-soroban-sdk: \`Fr\` scalar field equality comparison bypasses modular reduction](https://agentprime.io/advisories/GHSA-x2hw-px52-wp4m.md)
  `GHSA-x2hw-px52-wp4m`, `CVE-2026-32322` · crates.io `soroban-sdk`: affected `<22.0.11 || >=23.0.0, <23.5.3 || >=25.0.0, <25.3.0`, fixed in `22.0.11`, `23.5.3`, `25.3.0` · CVSS 5.3 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-697
- [Improper Digest Verification in httpsig-hyper May Allow Message Integrity Bypass](https://agentprime.io/advisories/GHSA-7v42-g35v-xrch.md)
  `GHSA-7v42-g35v-xrch`, `CVE-2026-26275` · crates.io `httpsig-hyper`: affected `<0.0.23`, fixed in `0.0.23` · CVSS 7.5 High · Not analysed yet · Published 17 Feb 2026 · Tags: CWE-354, CWE-697
- [Bug fixes in hpke-rs, hpke-rs-rust-crypto](https://agentprime.io/advisories/GHSA-g433-pq76-6cmf.md)
  `GHSA-g433-pq76-6cmf`, `RUSTSEC-2026-0069`, `RUSTSEC-2026-0070`, `RUSTSEC-2026-0071`, `RUSTSEC-2026-0072` · crates.io `hpke-rs` and 1 more: affected `<0.6.0`, fixed in `0.6.0` · CVSS 4.0, no score published · Not analysed yet · Published 13 Feb 2026 · Tags: Memory corruption, CWE-20, CWE-697
- [iccDEV has Type Confusion in CIccTag:IsTypeCompressed()](https://agentprime.io/advisories/CVE-2026-21691.md)
  `CVE-2026-21691` · CVE record: InternationalColorConsortium iccDEV · CVSS 5.4 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: Memory corruption, CWE-20, CWE-140, CWE-697
- [Cisco Identity Services Engine Radius Suppression Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2025-20343.md)
  `CVE-2025-20343` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 8.6 High · Not analysed yet · Published 5 Nov 2025 · Tags: CWE-697
- [The Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure](https://agentprime.io/advisories/CVE-2025-12192.md)
  `CVE-2025-12192` · CVE record: stellarwp The Events Calendar · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2025 · Tags: CWE-697
- [MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling](https://agentprime.io/advisories/GHSA-4v8w-gg5j-ph37.md)
  `GHSA-4v8w-gg5j-ph37`, `CVE-2025-47776`, `PKSA-gxs3-7yhj-kxf3` · Packagist `mantisbt/mantisbt`: affected `<2.27.2`, fixed in `2.27.2` · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2025 · Tags: CWE-305, CWE-697
- [ConsoleFindCommandMatchList](https://agentprime.io/advisories/CVE-2025-47416.md)
  `CVE-2025-47416` · CVE record: CRESTRON TOUCHSCREEN x70 and 1 more · CVSS 5.9 Medium · Not analysed yet · Published 9 Sept 2025 · Tags: CWE-697

Older: <https://agentprime.io/advisories/tag/cwe-697.md?cursor=WyIyMDI1LTA5LTA5VDEzOjUyOjQ1Ljg1NTAwMFoiLCJDVkUtMjAyNS00NzQxNiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-697>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-697/>. Everything for agents: <https://agentprime.io/llms.txt>.