# CWE-706.

Every Advisory and CVE whose sources give the weakness CWE-706, newest first.

## Records, newest first (an older page)

- [File Browser: Colliding username normalization gives two users the same home directory](https://agentprime.io/advisories/GHSA-7rc3-g7h6-22m7.md)
  `GHSA-7rc3-g7h6-22m7`, `CVE-2026-62685`, `GO-2026-6024` · Go `github.com/filebrowser/filebrowser/v2`: affected `<2.63.17`, fixed in `2.63.17` · CVSS 8.1 High · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-647, CWE-706
- [nextlevelbuilder GoClaw exec_approval.go extractBin name resolution](https://agentprime.io/advisories/CVE-2026-16120.md)
  `CVE-2026-16120` · CVE record: nextlevelbuilder GoClaw · CVSS 5.3 Medium · Not analysed yet · Published 18 Jul 2026 · Tags: CWE-706
- [OpenClaw < 2026.6.9 Authorization Bypass via flock wrapper](https://agentprime.io/advisories/CVE-2026-62190.md)
  `CVE-2026-62190` · CVE record: OpenClaw OpenClaw · CVSS 8.7 High · Not analysed yet · Published 13 Jul 2026 · Tags: Broken access control, CWE-706
- [Junos OS: MX Series: Web filtering doesn't block specifically formatted URLs](https://agentprime.io/advisories/CVE-2026-57054.md)
  `CVE-2026-57054` · CVE record: Juniper Networks Junos OS · CVSS 6.9 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: CWE-706
- [Use of Incorrectly-Resolved Name or Reference in GitLab](https://agentprime.io/advisories/CVE-2025-12506.md)
  `CVE-2025-12506` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 8 Jul 2026 · Tags: CWE-706
- [cp: -R reads device nodes as streams, destroying device semantics](https://agentprime.io/advisories/GHSA-8vrf-r662-2w2v.md)
  `GHSA-8vrf-r662-2w2v`, `CVE-2026-35358` · crates.io `uu_cp`: affected `<0.7.0`, fixed in `0.7.0` · CVSS 4.4 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service, CWE-706
- [Devolutions Remote Desktop Manager: Incorrect link resolution by display name in the custom PowerShell VPN editor in…](https://agentprime.io/advisories/CVE-2026-13372.md)
  `CVE-2026-13372` · CVE record: Devolutions Remote Desktop Manager · CVSS 7.2 High · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-706
- [Devolutions UniGetUI: Use of an incorrectly resolved name or reference in the pinget backend in Devolutions…](https://agentprime.io/advisories/CVE-2026-10696.md)
  `CVE-2026-10696` · CVE record: Devolutions UniGetUI · CVSS 7.5 High · Not analysed yet · Published 17 Jun 2026 · Tags: CWE-706
- [Open WebUI: Any authenticated user can read other users' private notes via Socket.IO](https://agentprime.io/advisories/GHSA-8788-j68r-3cgh.md)
  `GHSA-8788-j68r-3cgh`, `CVE-2026-54022`, `PYSEC-2026-2712` · PyPI `open-webui`: affected `<0.8.11`, fixed in `0.8.11` · CVSS 5.3 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: Broken access control, CWE-706
- [Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname](https://agentprime.io/advisories/GHSA-jp82-jpqv-5vv3.md)
  `GHSA-jp82-jpqv-5vv3`, `CVE-2026-54282`, `PYSEC-2026-248` · PyPI `starlette`: affected `<1.3.0`, fixed in `1.3.0` · CVSS 3.7 Low · Not analysed yet · Published 15 Jun 2026 · Tags: CWE-20, CWE-706
- [Use of Incorrectly-Resolved Name or Reference in GitLab](https://agentprime.io/advisories/CVE-2026-8716.md)
  `CVE-2026-8716` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 27 May 2026 · Tags: CWE-706
- [pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad](https://agentprime.io/advisories/GHSA-w727-595x-pc3r.md)
  `GHSA-w727-595x-pc3r`, `CVE-2026-45306`, `PYSEC-2026-2998` · PyPI `pyload-ng`: affected `<=0.5.0b3.dev99`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 14 May 2026 · Tags: CWE-706
- [Hickory DNS's Record Cache Accepts AUTHORITY-Section NS from Sibling Zone via Parent-Pool Zone-Context Elevation](https://agentprime.io/advisories/GHSA-83hf-93m4-rgwq.md)
  `GHSA-83hf-93m4-rgwq`, `CVE-2026-42254` · crates.io `hickory-recursor`: affected `>=0.24.0, <0.26.0`, fixed in `0.26.0` · CVSS 4.0 Medium · Not analysed yet · Published 30 Apr 2026 · Tags: CWE-345, CWE-706
- [Traefik has an StripPrefixRegex Middleware Authorization Bypass via Path/RawPath Desync](https://agentprime.io/advisories/GHSA-6jwx-7vp4-9847.md)
  `GHSA-6jwx-7vp4-9847`, `CVE-2026-40912`, `GO-2026-5180` · Go `github.com/traefik/traefik` and 2 more: affected `<=1.7.34`, no fixed version yet · CVSS 7.8 High · Not analysed yet · Published 24 Apr 2026 · Tags: Path traversal, CWE-706
- [Duplicate Advisory: OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders](https://agentprime.io/advisories/GHSA-6477-wvjj-47v6.md)
  `GHSA-6477-wvjj-47v6` · npm `openclaw`: affected `<2026.4.2`, fixed in `2026.4.2` · CVSS 3.7 Low · Withdrawn · Not analysed yet · Published 24 Apr 2026 · Tags: CWE-706
- [OpenFGA has Improper Policy Enforcement](https://agentprime.io/advisories/GHSA-57j5-qwp2-vqp6.md)
  `GHSA-57j5-qwp2-vqp6`, `CVE-2026-41131`, `GO-2026-5136` · Go `github.com/openfga/openfga`: affected `<1.14.1`, fixed in `1.14.1` · CVSS 5.0 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Broken access control, CWE-706
- [Duplicate Advisory: uutils coreutils Uses Incorrectly-Resolved Name or Reference](https://agentprime.io/advisories/GHSA-67hp-f6hq-2h6g.md)
  `GHSA-67hp-f6hq-2h6g` · crates.io `coreutils`: affected `<0.7.0`, fixed in `0.7.0` · CVSS 4.4 Medium · Withdrawn · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-706
- [Duplicate Advisory: OpenClaw Bypasses DM Policy Separation via Synology Chat Webhook Path Collision](https://agentprime.io/advisories/GHSA-g8mc-c5f2-mqg7.md)
  `GHSA-g8mc-c5f2-mqg7` · npm `openclaw`: affected `<2026.3.22`, fixed in `2026.3.22` · CVSS 4.8 Medium · Withdrawn · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-706
- [OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders](https://agentprime.io/advisories/GHSA-rxmx-g7hr-8mx4.md)
  `GHSA-rxmx-g7hr-8mx4`, `CVE-2026-41354` · npm `openclaw`: affected `<2026.4.2`, fixed in `2026.4.2` · CVSS 6.3 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-349, CWE-440, CWE-706
- [fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)](https://agentprime.io/advisories/GHSA-rp9m-7r4c-75qg.md)
  `GHSA-rp9m-7r4c-75qg`, `CVE-2026-35039` · npm `fast-jwt`: affected `>=0.0.1, <6.2.0`, fixed in `6.2.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-345, CWE-706, CWE-1289
- [OpenClaw: Zalo webhook replay cache cross-target messageId scope bypass](https://agentprime.io/advisories/GHSA-hhq4-97c2-p447.md)
  `GHSA-hhq4-97c2-p447`, `CVE-2026-41402` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 2.3 Low · Not analysed yet · Published 2 Apr 2026 · Tags: Authentication bypass, CWE-706
- [OpenClaw Bypasses DM Policy Separation via Synology Chat Webhook Path Collision](https://agentprime.io/advisories/GHSA-rqp8-q22p-5j9q.md)
  `GHSA-rqp8-q22p-5j9q`, `CVE-2026-35635` · npm `openclaw`: affected `<2026.3.22`, fixed in `2026.3.22` · CVSS 6.3 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Broken access control, CWE-706
- [OpenClaw's system.run allowlist can be bypassed through an unregistered time dispatch wrapper](https://agentprime.io/advisories/GHSA-qm9x-v7cx-7rq4.md)
  `GHSA-qm9x-v7cx-7rq4`, `CVE-2026-35666` · npm `openclaw`: affected `<2026.3.22`, fixed in `2026.3.22` · CVSS 7.7 High · Not analysed yet · Published 26 Mar 2026 · Tags: Broken access control, CWE-706
- [OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.](https://agentprime.io/advisories/GHSA-wv46-v6xc-2qhf.md)
  `GHSA-wv46-v6xc-2qhf`, `CVE-2026-35670` · npm `openclaw`: affected `<2026.3.22`, fixed in `2026.3.22` · CVSS 6.0 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Broken access control, CWE-706, CWE-807
- [srvx is vulnerable to middleware bypass via absolute URI in request line](https://agentprime.io/advisories/GHSA-p36q-q72m-gchr.md)
  `GHSA-p36q-q72m-gchr`, `CVE-2026-33732` · npm `srvx`: affected `<0.11.13`, fixed in `0.11.13` · CVSS 4.8 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-706
- [h3: Missing Path Segment Boundary Check in \`mount()\` Causes Middleware Execution on Unrelated Prefix-Matching Routes](https://agentprime.io/advisories/GHSA-2j6q-whv2-gh6w.md)
  `GHSA-2j6q-whv2-gh6w`, `CVE-2026-33490` · npm `h3`: affected `>=2.0.1-alpha.0, <2.0.1-rc.17`, fixed in `2.0.1-rc.17` · CVSS 3.7 Low · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-706
- [Use of Incorrectly-Resolved Name or Reference in GitLab](https://agentprime.io/advisories/CVE-2026-1230.md)
  `CVE-2026-1230` · CVE record: GitLab GitLab · CVSS 4.1 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-706
- [WeKnora Vulnerable to Tool Execution Hijacking via Ambigous Naming Convention In MCP client and Indirect Prompt Injection](https://agentprime.io/advisories/GHSA-67q9-58vj-32qx.md)
  `GHSA-67q9-58vj-32qx`, `CVE-2026-30856`, `GO-2026-4638` · Go `github.com/Tencent/WeKnora`: affected `<0.3.0`, fixed in `0.3.0` · CVSS 5.9 Medium · Not analysed yet · Published 6 Mar 2026 · Tags: CWE-706
- [opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass](https://agentprime.io/advisories/GHSA-c7mq-gh6q-6q7c.md)
  `GHSA-c7mq-gh6q-6q7c`, `CVE-2025-6087`, `CVE-2026-3125`, `GHSA-rvpw-p7vw-wj3m` · npm `@opennextjs/cloudflare`: affected `<1.17.1`, fixed in `1.17.1` · CVSS 7.8 High · Not analysed yet · Published 5 Mar 2026 · Tags: Server-side request forgery (SSRF), CWE-706
- [File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL](https://agentprime.io/advisories/GHSA-4mh3-h929-w968.md)
  `GHSA-4mh3-h929-w968`, `CVE-2026-25890`, `GO-2026-4474` · Go `github.com/filebrowser/filebrowser/v2`: affected `<2.57.1`, fixed in `2.57.1` · CVSS 8.1 High · Not analysed yet · Published 10 Feb 2026 · Tags: Broken access control, CWE-706
- [SmarterTools SmarterMail < Build 9518 Unauthenticated background-of-the-day Path Coercion](https://agentprime.io/advisories/CVE-2026-25067.md)
  `CVE-2026-25067` · CVE record: SmarterTools SmarterMail · CVSS 6.9 Medium · Not analysed yet · Published 29 Jan 2026 · Tags: CWE-706
- [Singularity ineffectively applies of selinux / apparmor LSM process labels in github.com/sylabs/singularity](https://agentprime.io/advisories/GHSA-wwrx-w7c9-rf87.md)
  `GHSA-wwrx-w7c9-rf87`, `CVE-2025-64750`, `GO-2025-4177` · Go `github.com/sylabs/singularity` and 1 more: affected `*`, no fixed version yet · CVSS 4.5 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-61, CWE-706
- [Apptainer ineffectively applies selinux and apparmor --security options in github.com/apptainer/apptainer](https://agentprime.io/advisories/GHSA-j3rw-fx6g-q46j.md)
  `GHSA-j3rw-fx6g-q46j`, `CVE-2025-65105`, `GO-2025-4176` · Go `github.com/apptainer/apptainer`: affected `<1.4.5`, fixed in `1.4.5` · CVSS 4.5 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-61, CWE-706
- [zx Uses Incorrectly-Resolved Name or Reference](https://agentprime.io/advisories/GHSA-w87r-vg9q-crqm.md)
  `GHSA-w87r-vg9q-crqm`, `CVE-2025-13437` · npm `zx`: affected `<8.8.5`, fixed in `8.8.5` · CVSS 5.6 Medium · Not analysed yet · Published 20 Nov 2025 · Tags: CWE-706
- [CommandKit has incorrect command name exposure in context object for message command aliases](https://agentprime.io/advisories/GHSA-fhwm-pc6r-4h2f.md)
  `GHSA-fhwm-pc6r-4h2f`, `CVE-2025-62378` · npm `commandkit`: affected `>=1.2.0-rc.1, <1.2.0-rc.12`, fixed in `1.2.0-rc.12` · CVSS 6.1 Medium · Not analysed yet · Published 13 Oct 2025 · Tags: CWE-706
- [Hono's flaw in URL path parsing could cause path confusion](https://agentprime.io/advisories/GHSA-9hp6-4448-45g2.md)
  `GHSA-9hp6-4448-45g2`, `CVE-2025-58362` · npm `hono`: affected `>=4.8.0, <4.9.6`, fixed in `4.9.6` · CVSS 7.5 High · Not analysed yet · Published 3 Sept 2025 · Tags: CWE-706
- [A10 Networks AX Loadbalancer Path Traversal](https://agentprime.io/advisories/CVE-2014-125125.md)
  `CVE-2014-125125` · CVE record: A10 Networks AX Series Loadbalancer · CVSS 8.8 High · Not analysed yet · Published 31 Jul 2025 · Tags: Path traversal, CWE-706
- [NamelessMC Forum Topic Deletion Triggered by Unrelated User Deletion](https://agentprime.io/advisories/CVE-2025-30357.md)
  `CVE-2025-30357` · CVE record: NamelessMC Nameless · CVSS 7.3 High · Not analysed yet · Published 18 Apr 2025 · Tags: CWE-706
- [OWASP Coraza WAF has parser confusion which leads to wrong URI in \`REQUEST_FILENAME\` in github.com/corazawaf/coraza](https://agentprime.io/advisories/GHSA-q9f5-625g-xm39.md)
  `GHSA-q9f5-625g-xm39`, `CVE-2025-29914`, `GO-2025-3537` · Go `github.com/corazawaf/coraza` and 3 more: affected `*`, no fixed version yet · CVSS 5.4 Medium · Not analysed yet · Published 25 Mar 2025 · Tags: CWE-706
- [Zenitel AlphaWeb XE v11.2.3.10 was discovered to contain a local file inclusion vulnerability via the component amc_uploads.php.](https://agentprime.io/advisories/CVE-2024-57785.md)
  `CVE-2024-57785` · CVE record · CVSS 4.9 Medium · Not analysed yet · Published 16 Jan 2025 · Tags: CWE-706
- [An insecure direct object reference (IDOR) vulnerability was discovered in PHPGurukul Online Birth Certificate System v1.0.](https://agentprime.io/advisories/CVE-2024-55058.md)
  `CVE-2024-55058` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 17 Dec 2024 · Tags: CWE-706
- [Nextcloud Server has incomplete sanitization of SVG files allows to embed other images into previews](https://agentprime.io/advisories/CVE-2024-52515.md)
  `CVE-2024-52515` · CVE record: nextcloud security-advisories · CVSS 5.7 Medium · Not analysed yet · Published 15 Nov 2024 · Tags: CWE-706
- [gitsign may use incorrect Rekor entries during verification in github.com/sigstore/gitsign](https://agentprime.io/advisories/GHSA-8pmp-678w-c8xx.md)
  `GHSA-8pmp-678w-c8xx`, `CVE-2024-51746`, `GO-2024-3252` · Go `github.com/sigstore/gitsign`: affected `<0.11.0`, fixed in `0.11.0` · CVSS 1.8 Low · Not analysed yet · Published 6 Nov 2024 · Tags: CWE-706
- [gix-path uses local config across repos when it is the highest scope](https://agentprime.io/advisories/GHSA-v26r-4c9c-h3j6.md)
  `GHSA-v26r-4c9c-h3j6`, `CVE-2024-45305`, `RUSTSEC-2024-0367` · crates.io `gix-path`: affected `>=0.0.0-0, <0.10.10`, fixed in `0.10.10` · CVSS 2.5 Low · Not analysed yet · Published 31 Aug 2024 · Tags: CWE-706
- [Nuxt vulnerable to remote code execution via the browser when running the test locally](https://agentprime.io/advisories/GHSA-v784-fjjh-f8r4.md)
  `GHSA-v784-fjjh-f8r4`, `CVE-2024-34344` · npm `nuxt`: affected `>=3.4.0, <3.12.4`, fixed in `3.12.4` · CVSS 8.8 High · Not analysed yet · Published 5 Aug 2024 · Tags: Code injection, CWE-706
- [TorchServe vulnerable to bypass of allowed_urls configuration](https://agentprime.io/advisories/GHSA-wxcx-gg9c-fwp2.md)
  `GHSA-wxcx-gg9c-fwp2`, `CVE-2024-35198`, `PYSEC-2026-554` · PyPI `torchserve`: affected `<0.11.0`, fixed in `0.11.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jul 2024 · Tags: Path traversal, CWE-706
- [Avast Premium Security Sandbox Protection Link Following Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2023-42125.md)
  `CVE-2023-42125` · CVE record: Avast Premium Security · CVSS 7.8 High · Not analysed yet · Published 3 May 2024 · Tags: CWE-706
- [Directus has MySQL accent insensitive email matching](https://agentprime.io/advisories/GHSA-qw9g-7549-7wg5.md)
  `GHSA-qw9g-7549-7wg5`, `CVE-2024-27295` · npm `directus`: affected `<10.8.3`, fixed in `10.8.3` · CVSS 8.2 High · Not analysed yet · Published 1 Mar 2024 · Tags: CWE-706
- [Docassemble unauthorized access through URL manipulation](https://agentprime.io/advisories/GHSA-jq57-3w7p-vwvv.md)
  `GHSA-jq57-3w7p-vwvv`, `CVE-2024-27292`, `PYSEC-2026-1309`, `PYSEC-2026-2453` · PyPI `docassemble-base` and 1 more: affected `>=1.4.53, <1.4.97`, fixed in `1.4.97` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.69 · Not analysed yet · Published 29 Feb 2024 · Tags: CWE-706
- [Mastodon Invalid Domain Name Normalization vulnerability](https://agentprime.io/advisories/CVE-2023-42451.md)
  `CVE-2023-42451` · CVE record: mastodon mastodon · CVSS 7.4 High · Not analysed yet · Published 19 Sept 2023 · Tags: CWE-706
- [Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)](https://agentprime.io/advisories/GHSA-353f-5xf4-qw67.md)
  `GHSA-353f-5xf4-qw67`, `CVE-2023-34092` · npm `vite`: affected `<2.9.16 || >=3.0.2, <3.2.7 || >=4.0.0, <4.0.5 || >=4.1.0, <4.1.5 || >=4.2.0, <4.2.3 || >=4.3.0, <4.3.9`, fixed in `2.9.16`, `3.2.7`, `4.0.5`, `4.1.5`, `4.2.3`, `4.3.9` · CVSS 7.5 High · Not analysed yet · Published 6 Jun 2023 · Tags: Information disclosure, CWE-50, CWE-706
- [D-Link DIR-300 firmware <=REVA1.06 and <=REVB2.06 is vulnerable to File inclusion via /model/\_\_lang_msg.php.](https://agentprime.io/advisories/CVE-2023-31814.md)
  `CVE-2023-31814` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 May 2023 · Tags: CWE-706
- [Potential share collision for recipients when caching is enabled in nextcloud server](https://agentprime.io/advisories/CVE-2023-28643.md)
  `CVE-2023-28643` · CVE record: nextcloud security-advisories · CVSS 5.5 Medium · Not analysed yet · Published 30 Mar 2023 · Tags: CWE-706
- [lambdaisland/uri \`authority-regex\` returns the wrong authority](https://agentprime.io/advisories/GHSA-cp4w-6x4w-v2h5.md)
  `GHSA-cp4w-6x4w-v2h5`, `CVE-2023-28628` · Maven `lambdaisland:uri`: affected `<1.14.120`, fixed in `1.14.120` · CVSS 5.4 Medium · Not analysed yet · Published 27 Mar 2023 · Tags: Open redirect, CWE-706
- [Opencontainers runc Incorrect Authorization vulnerability](https://agentprime.io/advisories/GHSA-vpvm-3wq2-2wvm.md)
  `GHSA-vpvm-3wq2-2wvm`, `CVE-2023-27561`, `GO-2023-1627` · Go `github.com/opencontainers/runc`: affected `>=1.0.0-rc95, <1.1.5`, fixed in `1.1.5` · CVSS 7.0 High · Not analysed yet · Published 3 Mar 2023 · Tags: CWE-706
- [Incorrect Access Control issue discoverd in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary files via improper sanitation on th…](https://agentprime.io/advisories/CVE-2021-37315.md)
  `CVE-2021-37315` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Feb 2023 · Tags: CWE-706
- [An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name resolution.](https://agentprime.io/advisories/CVE-2022-30258.md)
  `CVE-2022-30258` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Nov 2022 · Tags: CWE-706
- [An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V1 of unintended domain name resolution.](https://agentprime.io/advisories/CVE-2022-30257.md)
  `CVE-2022-30257` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Nov 2022 · Tags: CWE-706
- [Tauri Filesystem Scope can be Partially Bypassed](https://agentprime.io/advisories/GHSA-q9wv-22m9-vhqh.md)
  `GHSA-q9wv-22m9-vhqh`, `CVE-2022-41874`, `RUSTSEC-2022-0091` · crates.io `Tauri`: affected `>=1.0.0, <1.0.7 || >=1.1.0, <1.1.2`, fixed in `1.0.7`, `1.1.2` · CVSS 2.6 Low · Not analysed yet · Published 8 Nov 2022 · Tags: Broken access control, Information disclosure, CWE-706
- [Invalid file request can crash server](https://agentprime.io/advisories/GHSA-xw6g-jjvf-wwf9.md)
  `GHSA-xw6g-jjvf-wwf9`, `BIT-parse-2022-31089`, `CVE-2022-31089` · npm `parse-server`: affected `<4.10.12 || >=5.0.0, <5.2.3`, fixed in `4.10.12`, `5.2.3` · CVSS 7.5 High · Not analysed yet · Published 20 Jun 2022 · Tags: CWE-252, CWE-706

Newest: <https://agentprime.io/advisories/tag/cwe-706.md>
Older: <https://agentprime.io/advisories/tag/cwe-706.md?cursor=WyIyMDIyLTA2LTIwVDIyOjI1OjQ2LjAwMDAwMFoiLCJHSFNBLXh3Nmctamp2Zi13d2Y5Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-706&cursor=WyIyMDI2LTA4LTExVDIxOjMwOjAxLjc3OTAwMFoiLCJDVkUtMjAyNi0yOTAzNiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-706/?cursor=WyIyMDI2LTA4LTExVDIxOjMwOjAxLjc3OTAwMFoiLCJDVkUtMjAyNi0yOTAzNiJd>. Everything for agents: <https://agentprime.io/llms.txt>.