agentprime: CWE-697

CVE-2026-115732: Certificate Name Authorization Bypass

Tue, 03 Nov 2026 20:38:24 GMT

CVSS 9.0 (Critical). Critical: CVSS score 9.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-104198: ZoneMinder failed token handling bypasses web authentication

Thu, 15 Oct 2026 19:48:52 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-108969: itsmeravitejak Online-Examination-System Session session.php checkLogin comparison

Tue, 13 Oct 2026 05:15:16 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-106252: Incorrect comparison in Google Chrome

Tue, 06 Oct 2026 18:41:35 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

Mon, 05 Oct 2026 23:30:26 GMT

proxy-addr >=1.1.0, <2.0.8, fixed in 2.0.8. CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-71892: CMS key-transport recipient key-size validation never runs for RFC 9709 HKDF-derived keys

Sat, 03 Oct 2026 08:30:26 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range

Tue, 29 Sep 2026 23:46:52 GMT

ip-address <10.7.1, fixed in 10.7.1. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-102715: mDNS string-cache lookup matches on slot size, so a peer name aliases a shorter one and the response encoder writes past the packet

Tue, 29 Sep 2026 17:42:35 GMT

CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts

Mon, 28 Sep 2026 20:43:55 GMT

ip-address <10.5.1, fixed in 10.5.1. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-85292: InvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth)

Fri, 25 Sep 2026 15:25:26 GMT

CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Cloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addresses

Tue, 22 Sep 2026 20:40:41 GMT

github.com/cloudreve/Cloudreve/v4 <4.0.0-20260715072853-1c5cad6dec7e, fixed in 4.0.0-20260715072853-1c5cad6dec7e. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-93957: olivier-ls PHP-FTS Filter Matching SearchEngine.php matchesSingleFilter comparison

Sun, 20 Sep 2026 01:00:10 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-71855: Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state

Fri, 18 Sep 2026 20:25:58 GMT

CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-57222: Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6

Fri, 18 Sep 2026 20:05:15 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

Capsule: hostnameRegexHandler.OnUpdate validates stale (old) Tenant regex, allowing invalid AllowedHostnames regex to bypass webhook validation

Fri, 18 Sep 2026 17:14:43 GMT

github.com/projectcapsule/capsule >=0.13.0, <0.13.7, fixed in 0.13.7. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement

Fri, 18 Sep 2026 17:14:31 GMT

github.com/projectcapsule/capsule <0.13.7, fixed in 0.13.7. CVSS 7.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-90977: Clean Login < 1.19 - Unauthenticated CAPTCHA Bypass via Empty Session Comparison

Fri, 18 Sep 2026 06:11:40 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-20333: Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Incorrect Comparison Vulnerabilities

Wed, 16 Sep 2026 20:14:31 GMT

CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-92395: @fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

Wed, 16 Sep 2026 14:35:05 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-92087: @fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth

Wed, 16 Sep 2026 14:21:23 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-91997: evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass

Tue, 15 Sep 2026 11:35:51 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-91851: MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison

Tue, 15 Sep 2026 08:50:01 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-49846: libks has path traversal in kws HTTP parser via URI segment overflow

Fri, 11 Sep 2026 21:25:40 GMT

CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-64836: ICEcoder through 8.1 Path Traversal via Ineffective File::check() Confinement

Thu, 10 Sep 2026 13:51:05 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-56101: OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS

Tue, 08 Sep 2026 16:00:30 GMT

CVSS 6.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-73309: XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint

Tue, 08 Sep 2026 13:15:50 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

SQL string_trim removes only spaces, diverging from in-memory trimming in AshSql

Sun, 30 Aug 2026 11:53:35 GMT

ash_sql >=0.1.0, <0.7.1, fixed in 0.7.1. CVSS 2.1 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-18664: Wrong interpretation of ACL ranges

Wed, 26 Aug 2026 08:34:22 GMT

CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-73258: Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart

Thu, 20 Aug 2026 17:36:39 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-75110: MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRET

Mon, 17 Aug 2026 20:36:04 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-20765: Incorrect comparison in Intel(R) TDX Guest software

Tue, 11 Aug 2026 16:26:04 GMT

CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-67207: Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreController

Thu, 30 Jul 2026 19:30:45 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities

Tue, 28 Jul 2026 14:50:25 GMT

com.cedarpolicy:cedar-java <2.3.6 || >=3.1.2, <3.4.1 || >=4.0.0, <4.9.0, fixed in 2.3.6, 3.4.1, 4.9.0. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+

Tue, 21 Jul 2026 19:09:21 GMT

setuptools <83.0.0, fixed in 83.0.0. CVSS 6.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-22660: FlaskBB Logic Flaw Authorization Group Deletion via Bulk AJAX Endpoint

Fri, 10 Jul 2026 13:26:31 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-14687: 666ghj BettaFish InsightEngine search-result Deduplication agent.py _deduplicate_results partial string comparison

Sun, 05 Jul 2026 00:30:09 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-14686: HdrHistogram Range Check DoubleHistogram.java org.HdrHistogram.DoubleHistogram.recordValue comparison

Sun, 05 Jul 2026 00:00:10 GMT

CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-14617: NousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivity

Fri, 03 Jul 2026 21:45:10 GMT

CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.

gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host

Fri, 26 Jun 2026 23:21:42 GMT

go.senan.xyz/gonic <0.21.0, fixed in 0.21.0. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

js-toml has silent type confusion via falsy-primitive duplicate-key bypass

Fri, 26 Jun 2026 22:49:28 GMT

js-toml <1.1.2, fixed in 1.1.2. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-10097: ML-KEM-1024 x64 AVX2 incomplete cipher text comparison enables IND-CCA2 break and static private-key recovery

Thu, 25 Jun 2026 19:59:30 GMT

CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-45569: Roxy-WI: Path-traversal patch in commit d4d10006 is a no-op (tuple-membership bug)

Wed, 10 Jun 2026 15:38:17 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-45567: Roxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gpt

Wed, 10 Jun 2026 15:37:35 GMT

CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers

Wed, 10 Jun 2026 13:37:08 GMT

@hulumi/policies <1.4.0, fixed in 1.4.0. CVSS 8.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

Mon, 08 Jun 2026 19:00:33 GMT

io.netty:netty-handler >=4.2.0.Final, <4.2.15.Final || <4.1.135.Final, fixed in 4.2.15.Final, 4.1.135.Final. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-47202: Kavita: Pre-Auth Account Takeover

Tue, 26 May 2026 17:30:55 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

hermes-agent has an Incorrect Comparison

Tue, 26 May 2026 13:30:32 GMT

hermes-agent <0.15.0, fixed in 0.15.0. CVSS 4.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-44196: Pingvin Share X: TOTP Authentication Bypass via Password-only Login

Tue, 12 May 2026 17:40:28 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation

Thu, 16 Apr 2026 00:46:35 GMT

dompurify <3.4.0, fixed in 3.4.0. CVSS 5.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)

Thu, 09 Apr 2026 16:41:20 GMT

fast-jwt <6.2.1, fixed in 6.2.1. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.