# ail project ail framework.

Every CVE that names ail project ail framework among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain Page](https://agentprime.io/advisories/CVE-2026-100190.md)
  `CVE-2026-100190` · CVE record: ail project ail framework · CVSS 6.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validation](https://agentprime.io/advisories/CVE-2026-100187.md)
  `CVE-2026-100187` · CVE record: ail project ail framework · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-20
- [Ail Framework Crawler: Missing Cookiejar Authorization Check Allows Cross-Organization Cookiejar Attachment](https://agentprime.io/advisories/CVE-2026-100177.md)
  `CVE-2026-100177` · CVE record: ail project ail framework · CVSS 6.3 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control, CWE-20
- [Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip](https://agentprime.io/advisories/CVE-2026-100176.md)
  `CVE-2026-100176` · CVE record: ail project ail framework · CVSS 8.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names](https://agentprime.io/advisories/CVE-2026-100174.md)
  `CVE-2026-100174` · CVE record: ail project ail framework · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributes](https://agentprime.io/advisories/CVE-2026-100172.md)
  `CVE-2026-100172` · CVE record: ail project ail framework · CVSS 8.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Authenticated Server-Side Request Forgery in AIL Framework Crawler Allows Access to Internal Network Resources](https://agentprime.io/advisories/CVE-2026-76164.md)
  `CVE-2026-76164` · CVE record: ail-project ail-framework · CVSS 7.1 High · Not analysed yet · Published 19 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Stored Cross-Site Scripting in Chat and Forum Translation Controls in ail-framework](https://agentprime.io/advisories/CVE-2026-71447.md)
  `CVE-2026-71447` · CVE record: ail-project ail-framework · CVSS 6.9 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Stored Cross-Site Scripting in AIL Framework Domain Screenshot View](https://agentprime.io/advisories/CVE-2026-71446.md)
  `CVE-2026-71446` · CVE record: ail-project ail-framework · CVSS 6.9 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework](https://agentprime.io/advisories/CVE-2026-71445.md)
  `CVE-2026-71445` · CVE record: ail-project ail-framework · CVSS 8.2 High · Not analysed yet · Published 6 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Authenticated Path Traversal in AIL Framework PDF Object Handling Enables Potential Arbitrary File Read](https://agentprime.io/advisories/CVE-2026-59510.md)
  `CVE-2026-59510` · CVE record: ail-project ail-framework · CVSS 7.1 High · Not analysed yet · Published 5 Jul 2026 · Tags: Path traversal
- [AIL Framework - Missing Rate Limiting Enables Brute-Force Attacks Against Two-Factor Authentication Codes](https://agentprime.io/advisories/CVE-2026-56450.md)
  `CVE-2026-56450` · CVE record: ail project ail framework · CVSS 5.1 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: Authentication bypass
- [Authenticated Path Traversal in AIL Framework Investigation Downloads Allows Arbitrary File Read](https://agentprime.io/advisories/CVE-2026-56448.md)
  `CVE-2026-56448` · CVE record: ail project ail framework · CVSS 8.3 High · Not analysed yet · Published 22 Jun 2026 · Tags: Path traversal
- [Authenticated Path Traversal in AIL framework /objects/item/diff Allows Reading Gzip-Compressed Files](https://agentprime.io/advisories/CVE-2026-56138.md)
  `CVE-2026-56138` · CVE record: ail-project ail-framework · CVSS 5.3 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Path traversal
- [Stored XSS in modal item preview for long item content in AIL Framework](https://agentprime.io/advisories/CVE-2026-39416.md)
  `CVE-2026-39416` · CVE record: ail-project ail-framework · CVSS 8.5 High · Not analysed yet · Published 8 Apr 2026 · Tags: Cross-site scripting (XSS)

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=ail-project-ail-framework>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/ail-project-ail-framework/>. Everything for agents: <https://agentprime.io/llms.txt>.