# CWE-76.

Every Advisory and CVE whose sources give the weakness CWE-76, newest first.

## Records, newest first

- [NGINX Gateway Fabric vulnerability](https://agentprime.io/advisories/CVE-2026-91184.md)
  `CVE-2026-91184` · CVE record: F5 NGINX Gateway Fabric · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-76
- [NGINX Ingress Controller vulnerability](https://agentprime.io/advisories/CVE-2026-77180.md)
  `CVE-2026-77180` · CVE record: F5 NGINX Ingress Controller · CVSS 8.7 High · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-76
- [NGF vulnerability](https://agentprime.io/advisories/CVE-2026-66362.md)
  `CVE-2026-66362` · CVE record: F5 NGINX Gateway Fabric · CVSS 8.6 High · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-76
- [dssrf has an SSRF bypass with remove_at_symbol_in_string](https://agentprime.io/advisories/GHSA-cg4g-m8jx-vjv2.md)
  `GHSA-cg4g-m8jx-vjv2`, `CVE-2026-54722` · npm `dssrf`: affected `<1.0.4`, fixed in `1.0.4` · CVSS 8.7 High · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-76
- [NGINX Ingress Controller vulnerability](https://agentprime.io/advisories/CVE-2026-55723.md)
  `CVE-2026-55723` · CVE record: F5 NGINX Ingress Controller · CVSS 8.7 High · Not analysed yet · Published 15 Jul 2026 · Tags: CWE-76
- [NGINX Gateway Fabric vulnerability](https://agentprime.io/advisories/CVE-2026-11311.md)
  `CVE-2026-11311` · CVE record: F5 NGINX Gateway Fabric · CVSS 8.6 High · Not analysed yet · Published 17 Jun 2026 · Tags: CWE-76
- [simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE](https://agentprime.io/advisories/GHSA-r275-fr43-pm7q.md)
  `GHSA-r275-fr43-pm7q`, `CVE-2026-28292` · npm `simple-git`: affected `>=3.15.0, <3.32.3`, fixed in `3.32.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Mar 2026 · Tags: Command injection, CWE-76, CWE-178
- [Remote Code Execution in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-4897.md)
  `CVE-2024-4897` · CVE record: parisneo parisneo/lollms-webui · CVSS 8.4 High · Not analysed yet · Published 2 Jul 2024 · Tags: CWE-76
- [llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadata](https://agentprime.io/advisories/GHSA-56xg-wfcc-g829.md)
  `GHSA-56xg-wfcc-g829`, `CVE-2024-34359`, `PYSEC-2026-392` · PyPI `llama-cpp-python`: affected `>=0.2.30, <0.2.72`, fixed in `0.2.72` · CVSS 9.7 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.26 · Not analysed yet · Published 13 May 2024 · Tags: CWE-76
- [LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint](https://agentprime.io/advisories/GHSA-46cm-pfwv-cgf8.md)
  `GHSA-46cm-pfwv-cgf8`, `CVE-2024-2952`, `PYSEC-2026-387` · PyPI `litellm`: affected `<1.34.42`, fixed in `1.34.42` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2024 · Tags: CWE-76
- [Reflected XSS in PaperCut NG/MF](https://agentprime.io/advisories/CVE-2024-1883.md)
  `CVE-2024-1883` · CVE record: PaperCut PaperCut NG, PaperCut MF · CVSS 6.3 Medium · EPSS 0.61 · Not analysed yet · Published 14 Mar 2024 · Tags: CWE-76
- [Server-side resource injection in PaperCut NG/MF](https://agentprime.io/advisories/CVE-2024-1882.md)
  `CVE-2024-1882` · CVE record: PaperCut PaperCut NG, PaperCut MF · CVSS 7.2 High · Not analysed yet · Published 14 Mar 2024 · Tags: CWE-76
- [Improper access controls on APIs on Linux and macOS in PaperCut NG/MF](https://agentprime.io/advisories/CVE-2024-1221.md)
  `CVE-2024-1221` · CVE record: PaperCut PaperCut NG, PaperCut MF · CVSS 3.1 Low · Not analysed yet · Published 14 Mar 2024 · Tags: CWE-76
- [Junos OS: PTX Series: In an FTI scenario MPLS packets hitting reject next-hop will cause a host path wedge condition](https://agentprime.io/advisories/CVE-2024-21600.md)
  `CVE-2024-21600` · CVE record: Juniper Networks Junos OS · CVSS 6.5 Medium · Not analysed yet · Published 12 Jan 2024 · Tags: CWE-76
- [Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver](https://agentprime.io/advisories/CVE-2023-1149.md)
  `CVE-2023-1149` · CVE record: btcpayserver btcpayserver/btcpayserver · CVSS 5.7 Medium · Not analysed yet · Published 2 Mar 2023 · Tags: CWE-76
- [Withdrawn Advisory: HTML injections in BTCPayServer](https://agentprime.io/advisories/GHSA-33gv-rvgq-gpxp.md)
  `GHSA-33gv-rvgq-gpxp`, `CVE-2023-0493` · NuGet `BTCPayServer.Client`: affected `<1.7.5`, fixed in `1.7.5` · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 27 Jan 2023 · Tags: Other injection, CWE-76

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-76>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-76/>. Everything for agents: <https://agentprime.io/llms.txt>.