# CWE-807.

Every Advisory and CVE whose sources give the weakness CWE-807, newest first.

## Records, newest first (an older page)

- [Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass](https://agentprime.io/advisories/GHSA-5r4w-85f3-pw66.md)
  `GHSA-5r4w-85f3-pw66`, `CVE-2026-48491`, `GO-2026-5152` · Go `github.com/traefik/traefik/v2` and 1 more: affected `<2.11.48`, fixed in `2.11.48` · CVSS 7.8 High · Not analysed yet · Published 16 Jun 2026 · Tags: Authentication bypass, CWE-807
- [Appsmith: Configuration-dependent origin validation bypass in password reset and email verification link generation](https://agentprime.io/advisories/GHSA-j9gf-vw2f-9hrw.md)
  `GHSA-j9gf-vw2f-9hrw` · Maven `com.appsmith:server`: affected `<2.0`, fixed in `2.0` · CVSS 8.1 High · Not analysed yet · Published 12 Jun 2026 · Tags: CWE-346, CWE-807
- [The connection confirmation pop-up of a specific feature in the PcSuite can be bypassed.](https://agentprime.io/advisories/CVE-2026-12058.md)
  `CVE-2026-12058` · CVE record: vivo PcSuite · CVSS 5.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: CWE-807
- [Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header](https://agentprime.io/advisories/GHSA-3qmc-cj7q-62hv.md)
  `GHSA-3qmc-cj7q-62hv`, `CVE-2026-48061`, `PYSEC-2026-2603` · PyPI `litestar`: affected `<2.22.0`, fixed in `2.22.0` · CVSS 5.9 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: CWE-348, CWE-644, CWE-807
- [e107: Host Header Injection in e107 password reset enables phishing](https://agentprime.io/advisories/CVE-2026-43935.md)
  `CVE-2026-43935` · CVE record: e107inc e107 · CVSS 8.1 High · Not analysed yet · Published 26 May 2026 · Tags: CWE-20, CWE-807
- [SillyTavern has Authentication Bypass via SSO Header Injection](https://agentprime.io/advisories/GHSA-gxx6-h3g6-vwjh.md)
  `GHSA-gxx6-h3g6-vwjh`, `CVE-2026-44649` · npm `sillytavern`: affected `<1.18.0`, fixed in `1.18.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Authentication bypass, CWE-346, CWE-807
- [Remote Spark SparkView RCE](https://agentprime.io/advisories/CVE-2026-6213.md)
  `CVE-2026-6213` · CVE record: Remote Spark (https\://www\.remotespark.com/) SparkView · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 May 2026 · Tags: Authentication bypass, CWE-807
- [VM2 Has Sandbox Breakout Through Promise Species](https://agentprime.io/advisories/GHSA-qvjj-29qf-hp7p.md)
  `GHSA-qvjj-29qf-hp7p`, `CVE-2026-24120` · npm `vm2`: affected `<3.10.5`, fixed in `3.10.5` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 May 2026 · Tags: Code injection, CWE-693, CWE-807
- [Client-supplied URI scheme trusted without transport verification in bandit](https://agentprime.io/advisories/GHSA-375f-4r2h-f99j.md)
  `GHSA-375f-4r2h-f99j`, `CVE-2026-39807`, `EEF-CVE-2026-39807` · Hex `bandit`: affected `>=1.0.0, <1.11.0`, fixed in `1.11.0` · CVSS 6.3 Medium · Not analysed yet · Published 1 May 2026 · Tags: CWE-807
- [A vulnerability in the browser-based remote management interface may allow an administrator to access sensitive information on the device via crafted requests, affecting certain production printers a…](https://agentprime.io/advisories/CVE-2026-1789.md)
  `CVE-2026-1789` · CVE record: Canon Inc. imagePRESS Series and 4 more · CVSS 6.9 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: CWE-807
- [UEFI Secure Boot Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-0390.md)
  `CVE-2026-0390` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 6.7 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-807
- [SpotFTP Password Recover 2.4.2 Denial of Service via Name Field](https://agentprime.io/advisories/CVE-2019-25711.md)
  `CVE-2019-25711` · CVE record: NSauditor SpotFTP Password Recover · CVSS 6.9 Medium · Not analysed yet · Published 12 Apr 2026 · Tags: CWE-807
- [Duplicate Advisory: OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName](https://agentprime.io/advisories/GHSA-j42q-r6qx-xrfp.md)
  `GHSA-j42q-r6qx-xrfp` · npm `openclaw`: affected `<=2026.3.24`, no fixed version yet · CVSS 4.2 Medium · Withdrawn · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-807
- [Duplicate Advisory: OpenClaw: Nextcloud Talk room allowlist matched colliding room names instead of stable room tokens](https://agentprime.io/advisories/GHSA-5f7h-p83x-5vc2.md)
  `GHSA-5f7h-p83x-5vc2` · npm `openclaw`: affected `*`, no fixed version yet · CVSS 4.2 Medium · Withdrawn · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-807
- [Apache Tomcat Missing Encryption of Sensitive Data vulnerability](https://agentprime.io/advisories/GHSA-69r9-qgr7-g2wj.md)
  `GHSA-69r9-qgr7-g2wj`, `BIT-tomcat-2026-34486`, `CVE-2026-34486` · Maven `org.apache.tomcat:tomcat` and 1 more: affected `>=11.0.20, <11.0.21 || >=10.1.53, <10.1.54 || >=9.0.116, <9.0.117`, fixed in `11.0.21`, `10.1.54`, `9.0.117` · CVSS 7.5 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.99 · Not analysed yet · Published 9 Apr 2026 · Tags: Weak cryptography or TLS, CWE-807
- [Contemporary Controls BASC 20T Reliance on Untrusted Inputs in a Security Decision](https://agentprime.io/advisories/CVE-2025-13926.md)
  `CVE-2025-13926` · CVE record: Contemporary Controls BASControl20 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-807
- [OpenClaw: diffs viewer misclassifies proxied remote requests as loopback when \`allowRemoteViewer\` is disabled](https://agentprime.io/advisories/GHSA-3xv9-89fm-7h4r.md)
  `GHSA-3xv9-89fm-7h4r`, `CVE-2026-41403` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 6.3 Medium · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-348, CWE-807
- [OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic](https://agentprime.io/advisories/GHSA-7ggg-pvrf-458v.md)
  `GHSA-7ggg-pvrf-458v`, `CVE-2026-41391` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 5.8 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-184, CWE-807
- [GINA Domain Switch](https://agentprime.io/advisories/CVE-2026-29134.md)
  `CVE-2026-29134` · CVE record: SEPPmail Secure Email Gateway · CVSS 5.3 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-807
- [OpenClaw gateway exec allow-always over-trusts positional carrier executables](https://agentprime.io/advisories/GHSA-p4x4-2r7f-wjxg.md)
  `GHSA-p4x4-2r7f-wjxg`, `CVE-2026-41380` · npm `openclaw`: affected `<2026.3.28`, fixed in `2026.3.28` · CVSS 7.0 High · Not analysed yet · Published 1 Apr 2026 · Tags: Broken access control, CWE-807
- [OpenClaw has a gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapper](https://agentprime.io/advisories/GHSA-6pfc-6m7w-m8fx.md)
  `GHSA-6pfc-6m7w-m8fx`, `CVE-2026-41390` · npm `openclaw`: affected `<2026.3.28`, fixed in `2026.3.28` · CVSS 7.0 High · Not analysed yet · Published 31 Mar 2026 · Tags: CWE-385, CWE-807
- [OpenClaw: Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing](https://agentprime.io/advisories/GHSA-6xg4-82hv-cp6f.md)
  `GHSA-6xg4-82hv-cp6f`, `CVE-2026-41299` · npm `openclaw`: affected `<2026.3.28`, fixed in `2026.3.28` · CVSS 7.1 High · Not analysed yet · Published 31 Mar 2026 · Tags: Authentication bypass, CWE-807
- [OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName](https://agentprime.io/advisories/GHSA-52q4-3xjc-6778.md)
  `GHSA-52q4-3xjc-6778`, `CVE-2026-35617` · npm `openclaw`: affected `<2026.3.28`, fixed in `2026.3.28` · CVSS 2.3 Low · Not analysed yet · Published 29 Mar 2026 · Tags: Broken access control, CWE-807
- [OpenClaw's Conflicting Tool Identity Hints Bypass Dangerous-Tool Prompting](https://agentprime.io/advisories/GHSA-74wf-h43j-vvmj.md)
  `GHSA-74wf-h43j-vvmj`, `CVE-2026-35655` · npm `openclaw`: affected `<2026.3.22`, fixed in `2026.3.22` · CVSS 6.9 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Broken access control, CWE-807
- [OpenClaw: Nextcloud Talk room allowlist matched colliding room names instead of stable room tokens](https://agentprime.io/advisories/GHSA-xhq5-45pm-2gjr.md)
  `GHSA-xhq5-45pm-2gjr`, `CVE-2026-35624` · npm `openclaw`: affected `<2026.3.22`, fixed in `2026.3.22` · CVSS 2.3 Low · Not analysed yet · Published 26 Mar 2026 · Tags: Broken access control, CWE-807
- [OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.](https://agentprime.io/advisories/GHSA-wv46-v6xc-2qhf.md)
  `GHSA-wv46-v6xc-2qhf`, `CVE-2026-35670` · npm `openclaw`: affected `<2026.3.22`, fixed in `2026.3.22` · CVSS 6.0 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Broken access control, CWE-706, CWE-807
- [Pixel Studio 2.17 Denial of Service via Malformed Input](https://agentprime.io/advisories/CVE-2019-25621.md)
  `CVE-2019-25621` · CVE record: Pixarra Pixel Studio · CVSS 6.9 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: CWE-807
- [ASPRunner.NET 10.1 Denial of Service via Table Name Field](https://agentprime.io/advisories/CVE-2019-25594.md)
  `CVE-2019-25594` · CVE record: Xlinesoft ASPRunner.NET · CVSS 6.9 Medium · Not analysed yet · Published 22 Mar 2026 · Tags: CWE-807
- [Pidgin 2.13.0 Denial of Service via Malformed Username](https://agentprime.io/advisories/CVE-2019-25544.md)
  `CVE-2019-25544` · CVE record: Pidgin Pidgin · CVSS 6.9 Medium · Not analysed yet · Published 21 Mar 2026 · Tags: CWE-807
- [Duplicate Advisory: OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata](https://agentprime.io/advisories/GHSA-rcx4-77x4-hjx5.md)
  `GHSA-rcx4-77x4-hjx5` · npm `openclaw`: affected `<=2026.2.22-2`, no fixed version yet · CVSS 5.4 Medium · Withdrawn · Not analysed yet · Published 21 Mar 2026 · Tags: CWE-807
- [Duplicate Advisory: OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions](https://agentprime.io/advisories/GHSA-xh9j-mpc9-2m9p.md)
  `GHSA-xh9j-mpc9-2m9p` · npm `openclaw`: affected `<=2026.2.24`, no fixed version yet · CVSS 5.9 Medium · Withdrawn · Not analysed yet · Published 21 Mar 2026 · Tags: CWE-807
- [Vikunja has a Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers](https://agentprime.io/advisories/GHSA-m547-hp4w-j6jx.md)
  `GHSA-m547-hp4w-j6jx`, `CVE-2026-29794`, `GO-2026-4791` · Go `code.vikunja.io/api`: affected `>=0.8, <2.2.0`, fixed in `2.2.0` · CVSS 5.3 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-807
- [Claude Code has a Workspace Trust Dialog Bypass via Repo-Controlled Settings File](https://agentprime.io/advisories/GHSA-mmgp-wc2j-qcv7.md)
  `GHSA-mmgp-wc2j-qcv7`, `CVE-2026-33068` · npm `@anthropic-ai/claude-code`: affected `<2.1.53`, fixed in `2.1.53` · CVSS 7.7 High · Not analysed yet · Published 19 Mar 2026 · Tags: CWE-807
- [OpenClaw's Zalouser allowlist authorization matched mutable group names by default](https://agentprime.io/advisories/GHSA-f5mf-3r52-r83w.md)
  `GHSA-f5mf-3r52-r83w`, `CVE-2026-32975` · npm `openclaw`: affected `<2026.3.12`, fixed in `2026.3.12` · CVSS 6.9 Medium · Not analysed yet · Published 13 Mar 2026 · Tags: Broken access control, CWE-807
- [Argo Workflows: WorkflowTemplate Security Bypass via podSpecPatch in Strict/Secure Reference Mode](https://agentprime.io/advisories/GHSA-3wf5-g532-rcrr.md)
  `GHSA-3wf5-g532-rcrr`, `BIT-argo-workflows-2026-31892`, `CVE-2026-31892`, `GO-2026-4681` · Go `github.com/argoproj/argo-workflows` and 2 more: affected `>=2.9.0`, no fixed version yet · CVSS 8.9 High · Not analysed yet · Published 11 Mar 2026 · Tags: Broken access control, CWE-807
- [OpenClaw improperly parses X-Forwarded-For behind trusted proxies allows client IP spoofing in security decisions](https://agentprime.io/advisories/GHSA-2rgf-hm63-5qph.md)
  `GHSA-2rgf-hm63-5qph`, `CVE-2026-32029` · npm `openclaw`: affected `<2026.2.21`, fixed in `2026.2.21` · CVSS 6.3 Medium · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-345, CWE-807
- [OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions](https://agentprime.io/advisories/GHSA-vvgp-4c28-m3jm.md)
  `GHSA-vvgp-4c28-m3jm`, `CVE-2026-32057` · npm `openclaw`: affected `<2026.2.25`, fixed in `2026.2.25` · CVSS 6.0 Medium · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-807
- [OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata](https://agentprime.io/advisories/GHSA-7jx5-9fjg-hp4m.md)
  `GHSA-7jx5-9fjg-hp4m`, `CVE-2026-32898` · npm `openclaw`: affected `<2026.2.23`, fixed in `2026.2.23` · CVSS 5.3 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: Broken access control, CWE-807
- [Plex-configured Seerr instances vulnerable to unauthenticated account registration via Jellyfin authentication endpoint](https://agentprime.io/advisories/CVE-2026-27707.md)
  `CVE-2026-27707` · CVE record: seerr-team seerr · CVSS 7.3 High · Not analysed yet · Published 27 Feb 2026 · Tags: Authentication bypass, CWE-807
- [OpenClaw: Command hijacking via unsafe PATH handling (bootstrapping + node-host PATH overrides)](https://agentprime.io/advisories/GHSA-jqpq-mgvm-f9r6.md)
  `GHSA-jqpq-mgvm-f9r6`, `CVE-2026-29610` · npm `openclaw`: affected `<2026.2.14`, fixed in `2026.2.14` · CVSS 7.7 High · Not analysed yet · Published 18 Feb 2026 · Tags: Command injection, CWE-427, CWE-807
- [Microsoft Word Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-21514.md)
  `CVE-2026-21514` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 4 more · CVSS 7.8 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-807
- [Cube Core is vulnerable to privilege escalation via a specially crafted request](https://agentprime.io/advisories/GHSA-v226-32c7-x2v7.md)
  `GHSA-v226-32c7-x2v7`, `CVE-2026-25958` · npm `@cubejs-backend/server-core`: affected `>=0.27.19, <1.0.14 || >=1.1.0, <1.4.2 || >=1.5.0, <1.5.13`, fixed in `1.0.14`, `1.4.2`, `1.5.13` · CVSS 7.7 High · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-807
- [vscode-spell-checker has a workspace-trust bypass Code Execution](https://agentprime.io/advisories/CVE-2026-25931.md)
  `CVE-2026-25931` · CVE record: streetsidesoftware vscode-spell-checker · CVSS 7.8 High · Not analysed yet · Published 9 Feb 2026 · Tags: Broken access control, CWE-807, CWE-829
- [Microsoft Office Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-21509.md)
  `CVE-2026-21509` · CVE record: Microsoft Microsoft 365 Apps for Enterprise and 4 more · CVSS 7.8 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.71 · Not analysed yet · Published 26 Jan 2026 · Tags: CWE-807
- [MyTube has Rate Limiting Bypass via X-Forwarded-For Header Spoofing](https://agentprime.io/advisories/CVE-2026-23848.md)
  `CVE-2026-23848` · CVE record: franklioxygen MyTube · CVSS 6.5 Medium · Not analysed yet · Published 19 Jan 2026 · Tags: CWE-807
- [Windows Kerberos Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-20849.md)
  `CVE-2026-20849` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.5 High · Not analysed yet · Published 13 Jan 2026 · Tags: CWE-807
- [Mega-Fence (webgate-lib.\*) 25.1.914 and prior trusts the first value of the X-Forwarded-For (XFF) header as the client IP without validating a trusted proxy chain.](https://agentprime.io/advisories/CVE-2025-65328.md)
  `CVE-2025-65328` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: CWE-807
- [1Panel – CAPTCHA Bypass via Client-Controlled Flag in github.com/1Panel-dev/1Panel](https://agentprime.io/advisories/GHSA-qmg5-v42x-qqhq.md)
  `GHSA-qmg5-v42x-qqhq`, `CVE-2025-66507`, `GO-2025-4209` · Go `github.com/1Panel-dev/1Panel` and 1 more: affected `<2.0.14+incompatible`, fixed in `2.0.14+incompatible` · CVSS 7.5 High · Not analysed yet · Published 15 Dec 2025 · Tags: Authentication bypass, CWE-602, CWE-807
- [cpp-httplib Untrusted HTTP Header Handling: X-Forwarded-For/X-Real-IP Trust](https://agentprime.io/advisories/CVE-2025-66577.md)
  `CVE-2025-66577` · CVE record: yhirose cpp-httplib · CVSS 5.3 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: Other injection, CWE-807
- [cpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE\*/LOCAL\*)](https://agentprime.io/advisories/CVE-2025-66570.md)
  `CVE-2025-66570` · CVE record: yhirose cpp-httplib · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Dec 2025 · Tags: Authentication bypass, CWE-345, CWE-807
- [Authentication Bypass in Turkguven's Perfektive](https://agentprime.io/advisories/CVE-2025-10161.md)
  `CVE-2025-10161` · CVE record: Turkguven Software Technologies Inc. Perfektive · CVSS 7.3 High · Not analysed yet · Published 11 Nov 2025 · Tags: Authentication bypass, CWE-602, CWE-807
- [oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-12487.md)
  `CVE-2025-12487` · CVE record: oobabooga text-generation-webui · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Nov 2025 · Tags: CWE-807
- [oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-12488.md)
  `CVE-2025-12488` · CVE record: oobabooga text-generation-webui · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Nov 2025 · Tags: CWE-807
- [Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation](https://agentprime.io/advisories/CVE-2025-11271.md)
  `CVE-2025-11271` · CVE record: smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy · CVSS 5.3 Medium · Not analysed yet · Published 6 Nov 2025 · Tags: CWE-807
- [Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2025-53717.md)
  `CVE-2025-53717` · CVE record: Microsoft Windows 11 version 22H2 and 4 more · CVSS 7.0 High · Not analysed yet · Published 14 Oct 2025 · Tags: CWE-807
- [Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion](https://agentprime.io/advisories/GHSA-hm36-ffrh-c77c.md)
  `GHSA-hm36-ffrh-c77c`, `CVE-2025-59152`, `PYSEC-2026-1553` · PyPI `litestar`: affected `>=2.17.0, <2.18.0`, fixed in `2.18.0` · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2025 · Tags: CWE-807
- [github.com/gorilla/csrf improperly validates TrustedOrigins allowing CSRF attacks](https://agentprime.io/advisories/GHSA-82ff-hg59-8x73.md)
  `GHSA-82ff-hg59-8x73`, `CVE-2025-47909`, `GO-2025-3884` · Go `github.com/gorilla/csrf`: affected `<=1.7.3`, no fixed version yet · CVSS 7.3 High · Not analysed yet · Published 29 Aug 2025 · Tags: Cross-site request forgery (CSRF), CWE-346, CWE-807
- [flaskBlog allows arbitrary privilege escalation](https://agentprime.io/advisories/CVE-2025-55736.md)
  `CVE-2025-55736` · CVE record: DogukanUrker FlaskBlog · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2025 · Tags: Broken access control, CWE-807
- [flaskBlog Stored XSS Vulnerability](https://agentprime.io/advisories/CVE-2025-55735.md)
  `CVE-2025-55735` · CVE record: DogukanUrker FlaskBlog · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Cross-site scripting (XSS), CWE-807
- [The logrotate configuration in the python-mailman of openSUSE allows the mailman user to sent SIGHUP to arbitrary proceess](https://agentprime.io/advisories/CVE-2025-53882.md)
  `CVE-2025-53882` · CVE record: SUSE openSUSE Tumbleweed · CVSS 4.8 Medium · Not analysed yet · Published 23 Jul 2025 · Tags: CWE-807

Newest: <https://agentprime.io/advisories/tag/cwe-807.md>
Older: <https://agentprime.io/advisories/tag/cwe-807.md?cursor=WyIyMDI1LTA3LTIzVDA5OjMxOjE4LjU0NzAwMFoiLCJDVkUtMjAyNS01Mzg4MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-807&cursor=WyIyMDI2LTA2LTE2VDIxOjMyOjAwLjAwMDAwMFoiLCJHSFNBLThoajItdzRjOS1mamZxIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-807/?cursor=WyIyMDI2LTA2LTE2VDIxOjMyOjAwLjAwMDAwMFoiLCJHSFNBLThoajItdzRjOS1mamZxIl0>. Everything for agents: <https://agentprime.io/llms.txt>.