# CWE-942.

Every Advisory and CVE whose sources give the weakness CWE-942, newest first.

## Records, newest first

- [Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads](https://agentprime.io/advisories/GHSA-g5jq-qmqr-qrwf.md)
  `GHSA-g5jq-qmqr-qrwf`, `CVE-2026-119285`, `GO-2026-6896` · Go `github.com/gofiber/fiber/v2`: affected `>=2.52.1, <2.52.3`, fixed in `2.52.3` · CVSS 5.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-346, CWE-942
- [MoLing: unauthenticated SSE and wildcard CORS expose tool sessions](https://agentprime.io/advisories/CVE-2026-62863.md)
  `CVE-2026-62863` · CVE record: gojue moling · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass, CWE-942
- [vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server](https://agentprime.io/advisories/GHSA-vvpg-rrww-wpmh.md)
  `GHSA-vvpg-rrww-wpmh`, `CVE-2026-115917`, `PYSEC-2026-4348` · PyPI `vllm`: affected `<0.32.0`, fixed in `0.32.0` · CVSS 3.4 Low · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-942
- [Push Endpoint Returns Permissive CORS Headers](https://agentprime.io/advisories/CVE-2026-110737.md)
  `CVE-2026-110737` · CVE record: vaadin vaadin and 2 more · CVSS 2.3 Low · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-346, CWE-942
- [Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token](https://agentprime.io/advisories/CVE-2026-116748.md)
  `CVE-2026-116748` · CVE record: transmission transmission · CVSS 8.7 High · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-942
- [Cross-Site WebSocket Hijacking and Permissive CORS in Google Agent Development Kit (ADK) for Java Development Server](https://agentprime.io/advisories/CVE-2026-107858.md)
  `CVE-2026-107858` · CVE record: Google Agent Development Kit (ADK) for Java · CVSS 7.2 High · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, CWE-942, CWE-1385
- [IBM Concert Software Permissive Cross-domain Security Policy](https://agentprime.io/advisories/CVE-2026-3303.md)
  `CVE-2026-3303` · CVE record: IBM Concert · CVSS 3.7 Low · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-942
- [LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files](https://agentprime.io/advisories/GHSA-vx2m-gpq4-8j5q.md)
  `GHSA-vx2m-gpq4-8j5q`, `CVE-2026-108372` · PyPI `loopx`: affected `>=0.0.1, <0.4.5`, fixed in `0.4.5` · CVSS 7.1 High · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-346, CWE-942
- [Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set](https://agentprime.io/advisories/CVE-2026-85313.md)
  `CVE-2026-85313` · CVE record: Apache Software Foundation Apache Camel · CVSS 4.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-942
- [Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection](https://agentprime.io/advisories/CVE-2026-84176.md)
  `CVE-2026-84176` · CVE record: Apache Software Foundation Apache Camel · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-942
- [Scoold: CORS wildcard origin with credentials enabled allows cross-origin authenticated API access from any domain](https://agentprime.io/advisories/CVE-2026-55842.md)
  `CVE-2026-55842` · CVE record: Erudika scoold · CVSS 5.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-346, CWE-942
- [Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted](https://agentprime.io/advisories/GHSA-m687-p538-r5hp.md)
  `GHSA-m687-p538-r5hp`, `CVE-2026-111922`, `GO-2026-6739` · Go `code.vikunja.io/api`: affected `>=2.2.0, <=2.6.0`, no fixed version yet · CVSS 7.2 High · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-942
- [Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain](https://agentprime.io/advisories/GHSA-v2f8-6655-7grj.md)
  `GHSA-v2f8-6655-7grj`, `CVE-2026-114108` · PyPI `vibe-trading-ai`: affected `>=0.1.0, <0.1.7`, fixed in `0.1.7` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure, Authentication bypass, Unrestricted file upload, Broken access control
- [HCL Software iControl: iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy…](https://agentprime.io/advisories/CVE-2026-66247.md)
  `CVE-2026-66247` · CVE record: HCL Software iControl · CVSS 4.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-942
- [RabbitMQ: CORS \* reflects Origin with Allow-Credentials](https://agentprime.io/advisories/CVE-2026-66070.md)
  `CVE-2026-66070` · CVE record: rabbitmq rabbitmq-server · CVSS 7.6 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-942
- [Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user data](https://agentprime.io/advisories/CVE-2026-90882.md)
  `CVE-2026-90882` · CVE record: Eclipse Foundation open-vsx.org · CVSS 8.7 High · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-942
- [HCL BigFix Service Management is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-56595.md)
  `CVE-2026-56595` · CVE record: HCL Software HCL BigFix Service Management · CVSS 3.1 Low · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-942
- [Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config](https://agentprime.io/advisories/CVE-2026-89058.md)
  `CVE-2026-89058` · CVE record: Red Hat and 4 more · CVSS 7.4 High · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-346, CWE-942
- [ag-ui-protocol ag-ui CORSMiddleware utils.py create_strands_app cross-domain policy](https://agentprime.io/advisories/CVE-2026-92359.md)
  `CVE-2026-92359` · CVE record: ag-ui-protocol ag-ui · CVSS 2.3 Low · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-346, CWE-942
- [Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins](https://agentprime.io/advisories/CVE-2026-82438.md)
  `CVE-2026-82438` · CVE record: Apache Software Foundation Apache Storm Webapp · CVSS 8.1 High · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-346, CWE-942
- [@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft](https://agentprime.io/advisories/GHSA-rqx4-3f6q-3x2v.md)
  `GHSA-rqx4-3f6q-3x2v`, `CVE-2026-59148` · npm `@mockoon/cli` and 1 more: affected `<9.7.0`, fixed in `9.7.0` · CVSS 8.8 High · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF), Broken access control, CWE-942
- [Windows ML CLI: CORS misconfig enables localhost RCE](https://agentprime.io/advisories/GHSA-96p9-rh4f-92cf.md)
  `GHSA-96p9-rh4f-92cf`, `CVE-2026-84452`, `PYSEC-2026-3944` · PyPI `winml-cli`: affected `<0.4.0`, fixed in `0.4.0` · CVSS 8.6 High · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass, CWE-942
- [Azure Arc SQL Server Extension Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-62895.md)
  `CVE-2026-62895` · CVE record: Microsoft Azure Arc SQL Server Extension · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: SQL injection, Authentication bypass, CWE-942
- [ASUS Armoury Crate: A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows…](https://agentprime.io/advisories/CVE-2026-12962.md)
  `CVE-2026-12962` · CVE record: ASUS Armoury Crate · CVSS 5.3 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-942
- [HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials](https://agentprime.io/advisories/CVE-2026-82291.md)
  `CVE-2026-82291` · CVE record: heyform heyform · CVSS 8.1 High · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-942
- [Rybbit Reflects Any Origin in CORS Responses While Allowing Credentials](https://agentprime.io/advisories/CVE-2026-82287.md)
  `CVE-2026-82287` · CVE record: rybbit-io rybbit · CVSS 8.6 High · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-942
- [Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains.](https://agentprime.io/advisories/CVE-2025-61163.md)
  `CVE-2025-61163` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-942
- [Grav API Plugin: CORS 'Access-Control-Allow-Origin: \*' on Authenticated API Responses](https://agentprime.io/advisories/CVE-2026-63407.md)
  `CVE-2026-63407` · CVE record: getgrav grav-plugin-api · CVSS 8.2 High · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-942
- [Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard](https://agentprime.io/advisories/GHSA-fp27-88fp-2phg.md)
  `GHSA-fp27-88fp-2phg`, `CVE-2026-68517`, `PYSEC-2026-3667` · PyPI `glances`: affected `<4.5.6`, fixed in `4.5.6` · CVSS 6.5 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-942
- [OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-46409.md)
  `CVE-2026-46409` · CVE record: openyak openyak · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Aug 2026 · Tags: Code injection, Authentication bypass, Cross-site request forgery (CSRF), CWE-346
- [Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads](https://agentprime.io/advisories/GHSA-v3j7-r9gq-3gjw.md)
  `GHSA-v3j7-r9gq-3gjw`, `CVE-2026-70604` · npm `electron`: affected `<39.8.10 || >=40.0.0-alpha.1, <40.9.3 || >=41.0.0-alpha.1, <41.4.0 || >=42.0.0-alpha.1, <42.0.0`, fixed in `39.8.10`, `40.9.3`, `41.4.0`, `42.0.0` · CVSS 7.4 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-942
- [\`nx graph\` dev server permissive CORS policy](https://agentprime.io/advisories/GHSA-g2r8-wvmj-jf5w.md)
  `GHSA-g2r8-wvmj-jf5w`, `CVE-2026-54753` · npm `nx`: affected `>=17.0.4, <22.7.2 || >=23.0.0-beta.0, <23.0.0-beta.2`, fixed in `22.7.2`, `23.0.0-beta.2` · CVSS 5.9 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-749, CWE-942
- [Missing authentication and permissive CORS policy](https://agentprime.io/advisories/CVE-2026-65310.md)
  `CVE-2026-65310` · CVE record: ANDRITZ HIPASE-250 and 1 more · CVSS 7.5 High · Not analysed yet · Published 31 Jul 2026 · Tags: Authentication bypass, CWE-942
- [Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding](https://agentprime.io/advisories/CVE-2026-66005.md)
  `CVE-2026-66005` · CVE record: janhq jan · CVSS 5.3 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: CWE-183, CWE-942
- [Improper CORS handling in MOVEit Transfer](https://agentprime.io/advisories/CVE-2026-15966.md)
  `CVE-2026-15966` · CVE record: Progress MOVEit Transfer · CVSS 7.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: CWE-942
- [LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests](https://agentprime.io/advisories/GHSA-6x6h-qqr7-855w.md)
  `GHSA-6x6h-qqr7-855w`, `CVE-2026-61736`, `PYSEC-2026-3474` · PyPI `lightrag-hku`: affected `<1.5.4`, fixed in `1.5.4` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-942
- [CORS Misconfiguration in DevOps Loop](https://agentprime.io/advisories/CVE-2026-21761.md)
  `CVE-2026-21761` · CVE record: HCLSoftware DevOps Loop · CVSS 4.2 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-942
- [HCLSoftware Aftermarket EPC: HCL Aftermarket EPC is vulnerable to attack as the application implements an HTML5…](https://agentprime.io/advisories/CVE-2024-23578.md)
  `CVE-2024-23578` · CVE record: HCLSoftware Aftermarket EPC · CVSS 4.2 Medium · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-942
- [Grav < 1.0.0-rc.16 CORS Misconfiguration via API Plugin](https://agentprime.io/advisories/CVE-2026-62387.md)
  `CVE-2026-62387` · CVE record: getgrav grav · CVSS 7.1 High · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-942
- [FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: \*), enabling cross-origin reads of local server data](https://agentprime.io/advisories/GHSA-q78p-hj9h-5466.md)
  `GHSA-q78p-hj9h-5466`, `CVE-2026-53656`, `PYSEC-2026-3465` · PyPI `fiftyone`: affected `<1.17.0`, fixed in `1.17.0` · CVSS 6.3 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: CWE-346, CWE-942
- [ASUS GameSDK: Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a…](https://agentprime.io/advisories/CVE-2026-8919.md)
  `CVE-2026-8919` · CVE record: ASUS GameSDK · CVSS 7.2 High · Not analysed yet · Published 15 Jul 2026 · Tags: CWE-942
- [Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment](https://agentprime.io/advisories/CVE-2026-59726.md)
  `CVE-2026-59726` · CVE record: ruvnet ruflo · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jul 2026 · Tags: Command injection, Authentication bypass, CWE-942
- [HCL DevOps Deploy is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains](https://agentprime.io/advisories/CVE-2026-56458.md)
  `CVE-2026-56458` · CVE record: HCLSoftware HCL DevOps Deploy · CVSS 5.4 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: CWE-942
- [Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE](https://agentprime.io/advisories/GHSA-xqhv-chqm-fhcc.md)
  `GHSA-xqhv-chqm-fhcc`, `CVE-2026-53649`, `GO-2026-5947` · Go `github.com/BishopFox/joro`: affected `<0.0.0-20260601151442-5c0ca35db828`, fixed in `0.0.0-20260601151442-5c0ca35db828` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jul 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF), Unrestricted file upload, CWE-942
- [A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration found in UniFi OS to trigger actions in UniFi OS using that…](https://agentprime.io/advisories/CVE-2026-55110.md)
  `CVE-2026-55110` · CVE record: Ubiquiti Inc UniFi OS Server and 4 more · CVSS 7.5 High · Not analysed yet · Published 2 Jul 2026 · Tags: CWE-942
- [IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains](https://agentprime.io/advisories/CVE-2026-12084.md)
  `CVE-2026-12084` · CVE record: IBM UCD - IBM DevOps Deploy · CVSS 5.4 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: CWE-942
- [Papermark 0.22.0 - CORS Misconfiguration in Viewer Upload Endpoint](https://agentprime.io/advisories/CVE-2026-57957.md)
  `CVE-2026-57957` · CVE record: papermark papermark · CVSS 2.3 Low · Not analysed yet · Published 29 Jun 2026 · Tags: CWE-942
- [Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)](https://agentprime.io/advisories/GHSA-87qc-fj39-wccr.md)
  `GHSA-87qc-fj39-wccr`, `CVE-2026-46608`, `PYSEC-2026-2495` · PyPI `glances`: affected `<4.5.5`, fixed in `4.5.5` · CVSS 7.4 High · Not analysed yet · Published 22 Jun 2026 · Tags: CWE-183, CWE-942
- [PraisonAI - Cross-Origin Agent Execution via Hardcoded Wildcard CORS and Missing Authentication on AGUI Endpoint](https://agentprime.io/advisories/CVE-2026-56076.md)
  `CVE-2026-56076` · CVE record: PraisonAI PraisonAI · CVSS 8.6 High · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-942
- [hono: CORS Middleware reflects any Origin with credentials when \`origin\` defaults to the wildcard](https://agentprime.io/advisories/GHSA-88fw-hqm2-52qc.md)
  `GHSA-88fw-hqm2-52qc`, `CVE-2026-54290` · npm `hono`: affected `<4.12.25`, fixed in `4.12.25` · CVSS 7.1 High · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-942
- [Aqara Developer Portal cross-origin resource sharing](https://agentprime.io/advisories/CVE-2026-50088.md)
  `CVE-2026-50088` · CVE record: Aqara Aqara Developer Portal and 1 more · CVSS 8.2 High · Not analysed yet · Published 12 Jun 2026 · Tags: CWE-942
- [Aqara IAM/SSO Gateway cross-origin resource sharing](https://agentprime.io/advisories/CVE-2026-50087.md)
  `CVE-2026-50087` · CVE record: Aqara Aqara IAM/SSO Gateway · CVSS 8.2 High · Not analysed yet · Published 12 Jun 2026 · Tags: CWE-942
- [CORS misconfiguration in Nx Witness VMS allows session token exfiltration via cross-origin request](https://agentprime.io/advisories/CVE-2026-10056.md)
  `CVE-2026-10056` · CVE record: Network Optix Nx Witness VMS · CVSS 7.5 High · Not analysed yet · Published 29 May 2026 · Tags: CWE-942
- [RustFS: Reflective CORS with credentials on S3 listener; unauthenticated license metadata endpoint on console](https://agentprime.io/advisories/CVE-2026-46685.md)
  `CVE-2026-46685` · CVE record: rustfs rustfs · CVSS 6.0 Medium · Not analysed yet · Published 28 May 2026 · Tags: Authentication bypass, CWE-346, CWE-942
- [MCP Toolbox for Databases vulnerable to DNS rebinding attacks](https://agentprime.io/advisories/GHSA-7pf3-8xx7-rvhf.md)
  `GHSA-7pf3-8xx7-rvhf`, `CVE-2026-9739`, `GO-2026-5870` · Go `github.com/googleapis/mcp-toolbox`: affected `<1.2.0`, fixed in `1.2.0` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2026 · Tags: CWE-942
- [Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage](https://agentprime.io/advisories/GHSA-m837-xvxr-vqwg.md)
  `GHSA-m837-xvxr-vqwg`, `CVE-2026-56277` · npm `flowise`: affected `<3.1.2`, fixed in `3.1.2` · CVSS 6.9 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-346, CWE-942
- [Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: \*](https://agentprime.io/advisories/GHSA-hw27-4v2q-5qff.md)
  `GHSA-hw27-4v2q-5qff`, `CVE-2026-46431`, `GO-2026-5440` · Go `github.com/xyproto/algernon`: affected `<1.17.7`, fixed in `1.17.7` · CVSS 4.3 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-942
- [Algernon: Auto-refresh SSE event server binds to all interfaces with Access-Control-Allow-Origin: \* and no authentication](https://agentprime.io/advisories/GHSA-9v4j-7g44-qcqw.md)
  `GHSA-9v4j-7g44-qcqw`, `GO-2026-5300` · Go `github.com/xyproto/algernon`: affected `<1.17.7`, fixed in `1.17.7` · CVSS 5.3 Medium · Not analysed yet · Published 19 May 2026 · Tags: Information disclosure, Authentication bypass, CWE-942, CWE-1188
- [Same-origin policy bypass in the DOM: Networking component](https://agentprime.io/advisories/CVE-2026-8948.md)
  `CVE-2026-8948` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Cross-site scripting (XSS), CWE-942
- [Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin](https://agentprime.io/advisories/GHSA-3vcp-chfh-f6r2.md)
  `GHSA-3vcp-chfh-f6r2`, `CVE-2026-18676`, `CVE-2026-45021`, `GO-2026-5102` · Go `github.com/kumahq/kuma`: affected `<2.7.25 || >=2.9.0, <2.9.15 || >=2.11.0, <2.11.13 || >=2.12.0, <2.12.10 || >=2.13.0, <2.13.5`, fixed in `2.7.25`, `2.9.15`, `2.11.13`, `2.12.10`, `2.13.5` · CVSS 5.1 Medium · Not analysed yet · Published 14 May 2026 · Tags: CWE-346, CWE-942

Older: <https://agentprime.io/advisories/tag/cwe-942.md?cursor=WyIyMDI2LTA1LTE0VDIwOjE1OjA4LjAwMDAwMFoiLCJHSFNBLTN2Y3AtY2hmaC1mNnIyIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-942>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-942/>. Everything for agents: <https://agentprime.io/llms.txt>.