agentprime: CWE-940

CVE-2026-119568: vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking

Fri, 30 Oct 2026 11:31:14 GMT

CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-89409: Unvalidated ZWAVE_CMD_NODES_EXIST May Cause Deletion of End Nodes

Thu, 22 Oct 2026 13:50:04 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-66279: Dis-connect vulnerability in Connect Stack

Thu, 22 Oct 2026 13:41:03 GMT

CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-112408: Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()

Wed, 21 Oct 2026 19:36:06 GMT

CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

Fri, 16 Oct 2026 19:23:48 GMT

@aborruso/ckan-mcp-server <0.4.112, fixed in 0.4.112. CVSS 3.1 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-102552: Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver

Fri, 16 Oct 2026 17:28:47 GMT

CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-102551: Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling

Fri, 16 Oct 2026 17:27:38 GMT

CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-101897: Angular DevTools (Local DoS)

Wed, 14 Oct 2026 15:03:36 GMT

CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-87705: Windows Hyper-V Security Feature Bypass Vulnerability

Tue, 13 Oct 2026 19:01:04 GMT

CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-94590: WordPress Sell Downloads plugin <= 1.2.3 - Broken Access Control vulnerability

Sat, 10 Oct 2026 18:45:45 GMT

CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-59786: Active agent heartbeat missing TLS check

Mon, 05 Oct 2026 10:29:01 GMT

CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-102117: Kiteworks Core Remote Code Execution

Wed, 30 Sep 2026 20:19:02 GMT

CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-102511: Apache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them

Wed, 30 Sep 2026 08:03:04 GMT

CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-85125: YAMAP INC. YAMAP -Social Trekking GPS App: The Android application "YAMAP -Social Trekking GPS App" contains an improper access…

Mon, 14 Sep 2026 06:46:32 GMT

CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-89178: Howyar｜WeenyGenius - Origin Validation Error

Fri, 11 Sep 2026 07:36:25 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-85085: Canva: The Canva Android App before 2.376.0 allowed an external origin to be loaded in a…

Fri, 04 Sep 2026 06:00:46 GMT

CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-78685: Le-yan｜Medical Practice Management System - Remote Code Execution

Tue, 25 Aug 2026 02:05:09 GMT

CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

Thu, 23 Jul 2026 14:31:51 GMT

@auth/core <0.41.3, fixed in 0.41.3. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

Fri, 19 Jun 2026 21:15:29 GMT

tinacms <3.9.3, fixed in 3.9.3. CVSS 7.6 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

Fri, 19 Jun 2026 14:20:20 GMT

undici >=7.23.0, <7.28.0 || >=8.0.0, <8.2.0, fixed in 7.28.0, 8.2.0. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-54106: U.S. GAO EPDS and CBCA EDS network access control bypass

Thu, 18 Jun 2026 16:13:47 GMT

CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-48745: Traccar Client: silent configuration hijack via unverified deep link redirects all GPS telemetry

Tue, 16 Jun 2026 22:19:37 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects

Thu, 11 Jun 2026 13:27:05 GMT

@hapi/wreck <18.1.2, fixed in 18.1.2. CVSS 6.5 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Netty's Default QUIC token handler accepts any client-supplied token

Mon, 08 Jun 2026 22:59:43 GMT

io.netty:netty-codec-classes-quic >=4.2.0.Final, <4.2.15.Final, fixed in 4.2.15.Final. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-44698: Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection

Fri, 29 May 2026 13:32:20 GMT

CVSS 8.3 (High). Published by the CVE Program. Not analysed by agentprime yet.

MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution

Tue, 19 May 2026 12:31:37 GMT

mlflow >=3.9.0, <3.10.0, fixed in 3.10.0. CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links

Mon, 18 May 2026 21:31:51 GMT

@steipete/summarize <0.15.1, fixed in 0.15.1. CVSS 4.6 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Electerm Local code through electerm's single-instance socket

Thu, 14 May 2026 20:29:59 GMT

electerm >=3.0.6, <3.9.0, fixed in 3.9.0. CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Enables Phishing from the Site’s Legitimate From Address

Tue, 05 May 2026 21:56:19 GMT

wwbn/avideo <=29.0, no fixed version yet. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2026-23866: Facebook WhatsApp for Android: Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for…

Fri, 01 May 2026 16:02:03 GMT

CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-40434: Anviz CrossChex Standard Improper Verification of Source of a Communication Channel

Fri, 17 Apr 2026 19:49:28 GMT

CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-33875: Authenticator Vulnerable to Authentication Flow Hijack

Fri, 27 Mar 2026 20:25:15 GMT

CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface

Thu, 26 Mar 2026 19:30:52 GMT

openclaw <2026.3.22, fixed in 2026.3.22. CVSS 8.6 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2019-25613: Easy Chat Server 3.1 Denial of Service via message Parameter

Sun, 22 Mar 2026 13:38:46 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-2967: Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source

Mon, 23 Feb 2026 02:32:07 GMT

CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2026-22269: Dell PowerProtect Data Manager: Dell PowerProtect Data Manager, version(s) prior to 19.22…

Thu, 19 Feb 2026 09:00:56 GMT

CVSS 4.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-62439: Fortinet FortiOS: An Improper Verification of Source of a Communication Channel vulnerability [CWE-940]…

Tue, 10 Feb 2026 15:39:12 GMT

CVSS 3.8 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-40820: Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range.

Tue, 09 Dec 2025 10:44:30 GMT

CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-13086: OpenVPN: Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and…

Wed, 03 Dec 2025 19:54:10 GMT

CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-32388: Due to a firewall misconfiguration, Kerlink devices running KerOS prior to 5.12 incorrectly accept specially crafted UDP packets.

Mon, 01 Dec 2025 00:00:00 GMT

CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-61932: MOTEX Inc. Lanscope Endpoint Manager (On-Premises) (Client…: Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA))…

Mon, 20 Oct 2025 07:25:39 GMT

CVSS 9.3 (Critical). Critical: In CISA’s KEV catalogue since 22 Oct 2025: it is known to be exploited. CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-43280: The issue was resolved by not loading remote images.

Wed, 15 Oct 2025 20:00:47 GMT

CVSS 4.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

SillyTavern Web Interface Vulnerable DNS Rebinding

Mon, 06 Oct 2025 20:18:55 GMT

sillytavern <1.13.4, fixed in 1.13.4. CVSS 9.7 (Critical). Critical: CVSS score 9.7: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-20365: A vulnerability in the IPv6 Router Advertisement (RA) packet processing of Cisco Access Point Software could allow an unauthenticated, adjacent attacker to modify the IPv6 gateway on an affected devi…

Wed, 24 Sep 2025 16:40:16 GMT

CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-9999: Improper validation of payload elements

Fri, 05 Sep 2025 16:41:01 GMT

CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-42978: Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java

Tue, 08 Jul 2025 00:37:44 GMT

CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2025-0036: Incorrect calculation in AMD Versal Adaptive SoC Devices and others

Mon, 09 Jun 2025 23:57:39 GMT

CVSS 3.2 (Low). Published by the CVE Program. Not analysed by agentprime yet.

Home Assistant does not correctly validate SSL for outgoing requests in core and used libs

Tue, 18 Feb 2025 19:25:24 GMT

homeassistant <2024.1.6, fixed in 2024.1.6. CVSS 7.0 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

CVE-2025-23222: Deepin dde-api-proxy: An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged…

Fri, 24 Jan 2025 00:00:00 GMT

CVSS 8.4 (High). Published by the CVE Program. Not analysed by agentprime yet.

CVE-2024-7322: Dos in ZigBee device due to unsolicited encrypted rejoin response

Wed, 15 Jan 2025 07:59:55 GMT

CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.