agentprime: zukeEvery new CVE for zuke.https://agentprime.io/CVE-2026-119291: zuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directoryhttps://agentprime.io/advisories/CVE-2026-119291/https://agentprime.io/advisories/CVE-2026-119291/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 15:52:01 GMTCVECVE-2026-119290: Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow runhttps://agentprime.io/advisories/CVE-2026-119290/https://agentprime.io/advisories/CVE-2026-119290/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 15:50:46 GMTCVECVE-2026-119289: Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gatehttps://agentprime.io/advisories/CVE-2026-119289/https://agentprime.io/advisories/CVE-2026-119289/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 15:48:59 GMTCVECVE-2026-119288: Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command linehttps://agentprime.io/advisories/CVE-2026-119288/https://agentprime.io/advisories/CVE-2026-119288/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 15:47:23 GMTCVECVE-2026-119287: Zuke: Command-form registry descriptors bypass the MCP launch policyhttps://agentprime.io/advisories/CVE-2026-119287/https://agentprime.io/advisories/CVE-2026-119287/CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 15:39:52 GMTCVE