# CWE-81.

Every Advisory and CVE whose sources give the weakness CWE-81, newest first.

## Records, newest first

- [Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap](https://agentprime.io/advisories/GHSA-vp62-88p7-qqf5.md)
  `GHSA-vp62-88p7-qqf5`, `CVE-2026-41568`, `GO-2026-5668` · Go `github.com/docker/docker` and 2 more: affected `<=28.5.2`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 18 May 2026 · Tags: Race condition, CWE-61, CWE-81
- [A vulnerability in the error notification messages of the web application of ctrlX OS allows a remote unauthenticated attacker to inject arbitrary HTML tags and, possibly, execute arbitrary client-si…](https://agentprime.io/advisories/CVE-2025-24344.md)
  `CVE-2025-24344` · CVE record: Bosch Rexroth AG ctrlX OS - Solutions · CVSS 6.3 Medium · Not analysed yet · Published 30 Apr 2025 · Tags: CWE-81
- [vulnerability has been discovered in OpenText™ Service Manager.](https://agentprime.io/advisories/CVE-2025-0883.md)
  `CVE-2025-0883` · CVE record: OpenText™ Service Manager · CVSS 2.1 Low · Not analysed yet · Published 12 Mar 2025 · Tags: CWE-81
- [OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project](https://agentprime.io/advisories/GHSA-j8hp-f2mj-586g.md)
  `GHSA-j8hp-f2mj-586g`, `CVE-2024-47882` · Maven `org.openrefine:openrefine`: affected `<3.8.3`, fixed in `3.8.3` · CVSS 5.9 Medium · Not analysed yet · Published 24 Oct 2024 · Tags: Cross-site scripting (XSS), CWE-81
- [Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints](https://agentprime.io/advisories/CVE-2024-47064.md)
  `CVE-2024-47064` · CVE record: cvat-ai cvat · CVSS 6.3 Medium · Not analysed yet · Published 30 Sept 2024 · Tags: Cross-site scripting (XSS), CWE-81
- [Journyx Reflected Cross Site Scripting](https://agentprime.io/advisories/CVE-2024-6892.md)
  `CVE-2024-6892` · CVE record: Journyx Journyx (jtime) · CVSS 6.1 Medium · Not analysed yet · Published 7 Aug 2024 · Tags: CWE-81
- [Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC](https://agentprime.io/advisories/GHSA-3p62-6fjh-3p5h.md)
  `GHSA-3p62-6fjh-3p5h`, `CVE-2022-4361` · Maven `org.keycloak:keycloak-services`: affected `<21.1.2`, fixed in `21.1.2` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2023 · Tags: Cross-site scripting (XSS), CWE-81
- [Keycloak Cross-site Scripting on OpenID connect login service](https://agentprime.io/advisories/GHSA-9hhc-pj4w-w5rv.md)
  `GHSA-9hhc-pj4w-w5rv`, `CVE-2022-4137` · Maven `org.keycloak:keycloak-parent`: affected `<20.0.5`, fixed in `20.0.5` · CVSS 8.1 High · Not analysed yet · Published 1 Mar 2023 · Tags: Cross-site scripting (XSS), CWE-81, CWE-116
- [Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13](https://agentprime.io/advisories/GHSA-rp4x-wxqv-cf9m.md)
  `GHSA-rp4x-wxqv-cf9m`, `CVE-2019-25027` · Maven `com.vaadin:flow-server`: affected `>=1.0.0, <1.0.11 || >=1.1.0, <1.4.3`, fixed in `1.0.11`, `1.4.3` · CVSS 6.1 Medium · Not analysed yet · Published 19 Apr 2021 · Tags: Cross-site scripting (XSS), CWE-81
- [Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13](https://agentprime.io/advisories/GHSA-jqj4-r483-4gvr.md)
  `GHSA-jqj4-r483-4gvr` · Maven `com.vaadin:vaadin-bom`: affected `>=10.0.0, <10.0.14 || >=11.0.0, <13.0.6`, fixed in `10.0.14`, `13.0.6` · CVSS 6.1 Medium · Not analysed yet · Published 19 Apr 2021 · Tags: CWE-81

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-81>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-81/>. Everything for agents: <https://agentprime.io/llms.txt>.