# Code injection. Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [BIVOCOM TR321 Wireless Setting cross site scripting](https://agentprime.io/advisories/CVE-2026-6999.md) `CVE-2026-6999` · CVE record: BIVOCOM TR321 · CVSS 4.8 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [BDCOM P3310D New RMON Statistics cross site scripting](https://agentprime.io/advisories/CVE-2026-6998.md) `CVE-2026-6998` · CVE record: BDCOM P3310D · CVSS 4.8 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [BDCOM P3310D New RMON History cross site scripting](https://agentprime.io/advisories/CVE-2026-6997.md) `CVE-2026-6997` · CVE record: BDCOM P3310D · CVSS 4.8 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [BDCOM P3310D rmon event Tab cross site scripting](https://agentprime.io/advisories/CVE-2026-6996.md) `CVE-2026-6996` · CVE record: BDCOM P3310D · CVSS 4.8 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [BDCOM P3310D New User index.asp cross site scripting](https://agentprime.io/advisories/CVE-2026-6995.md) `CVE-2026-6995` · CVE record: BDCOM P3310D · CVSS 4.8 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [AstrBot has Incomplete Filtering of Special Elements](https://agentprime.io/advisories/GHSA-h3rr-9wqj-v3c6.md) `GHSA-h3rr-9wqj-v3c6`, `CVE-2026-6984`, `PYSEC-2026-2381` · PyPI `astrbot`: affected `<=4.22.1`, no fixed version yet · CVSS 5.1 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Code injection, CWE-791 - [projeto-siga novo cross site scripting](https://agentprime.io/advisories/CVE-2026-6990.md) `CVE-2026-6990` · CVE record: projeto-siga siga · CVSS 5.1 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [simple-git is vulnerable to Remote Code Execution](https://agentprime.io/advisories/GHSA-hffm-xvc3-vprc.md) `GHSA-hffm-xvc3-vprc`, `CVE-2026-6951` · npm `simple-git`: affected `<3.36.0`, fixed in `3.36.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Apr 2026 · Tags: Command injection, Code injection - [Skim: Arbitrary code execution via pull_request_target fork checkout in pr.yml](https://agentprime.io/advisories/CVE-2026-41414.md) `CVE-2026-41414` · CVE record: skim-rs skim · CVSS 7.4 High · Not analysed yet · Published 24 Apr 2026 · Tags: Code injection - [Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization](https://agentprime.io/advisories/GHSA-mw35-8rx3-xf9r.md) `GHSA-mw35-8rx3-xf9r`, `CVE-2026-41486`, `PYSEC-2026-2272`, `PYSEC-2026-2296` · PyPI `ray`: affected `>=2.49.0, <2.55.0`, fixed in `2.55.0` · CVSS 8.9 High · Not analysed yet · Published 24 Apr 2026 · Tags: Code injection, Insecure deserialization - [LiteLLM: Server-Side Template Injection in /prompts/test endpoint](https://agentprime.io/advisories/GHSA-xqmj-j6mv-4862.md) `GHSA-xqmj-j6mv-4862`, `CVE-2026-42203`, `PYSEC-2026-2602` · PyPI `litellm`: affected `>=1.80.5, <1.83.7`, fixed in `1.83.7` · CVSS 8.6 High · Not analysed yet · Published 24 Apr 2026 · Tags: Code injection - [Contour has Lua code injection via Cookie Path Rewrite Policy](https://agentprime.io/advisories/GHSA-x4mj-7f9g-29h4.md) `GHSA-x4mj-7f9g-29h4`, `BIT-contour-2026-41246`, `CVE-2026-41246`, `GO-2026-5738` · Go `github.com/projectcontour/contour`: affected `>=1.19.0, <1.31.6 || >=1.32.0, <1.32.5 || >=1.33.0, <1.33.4`, fixed in `1.31.6`, `1.32.5`, `1.33.4` · CVSS 8.1 High · Not analysed yet · Published 24 Apr 2026 · Tags: Code injection - [Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection](https://agentprime.io/advisories/GHSA-w3w2-mpp5-92gm.md) `GHSA-w3w2-mpp5-92gm`, `BIT-activemq-2026-40466`, `CVE-2026-40466` · Maven `org.apache.activemq:activemq-all` and 2 more: affected `<5.19.6 || >=6.0.0, <6.2.5`, fixed in `5.19.6`, `6.2.5` · CVSS 8.8 High · Not analysed yet · Published 24 Apr 2026 · Tags: Code injection, CWE-20 - [Apache ActiveMQ Vulnerable to Code Injection](https://agentprime.io/advisories/GHSA-mr6m-xj7v-3cv3.md) `GHSA-mr6m-xj7v-3cv3`, `BIT-activemq-2026-41044`, `CVE-2026-41044` · Maven `org.apache.activemq:activemq-all` and 2 more: affected `<5.19.6 || >=6.0.0, <6.2.5`, fixed in `5.19.6`, `6.2.5` · CVSS 8.8 High · Not analysed yet · Published 24 Apr 2026 · Tags: Code injection, CWE-20 - [AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component](https://agentprime.io/advisories/CVE-2026-41318.md) `CVE-2026-41318` · CVE record: Mintplex-Labs anything-llm · CVSS 5.4 Medium · Not analysed yet · Published 24 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection, CWE-116 - [OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment](https://agentprime.io/advisories/GHSA-8h25-q488-4hxw.md) `GHSA-8h25-q488-4hxw`, `CVE-2026-41900` · npm `openlearnx`: affected `<2.0.3`, fixed in `2.0.3` · CVSS 8.8 High · Not analysed yet · Published 23 Apr 2026 · Tags: Command injection, Code injection, Privilege escalation, Broken access control - [Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering](https://agentprime.io/advisories/GHSA-jcjw-58rv-c452.md) `GHSA-jcjw-58rv-c452`, `CVE-2026-34587`, `PKSA-w67s-1md9-r7dk` · Packagist `getkirby/cms`: affected `<4.9.0 || >=5.0.0, <5.4.0`, fixed in `4.9.0`, `5.4.0` · CVSS 7.6 High · Not analysed yet · Published 23 Apr 2026 · Tags: Code injection - [ntfy.sh allows a remote attacker to execute arbitrary code via the parseActions function](https://agentprime.io/advisories/GHSA-pqhx-w72w-m393.md) `GHSA-pqhx-w72w-m393`, `CVE-2026-39087`, `GO-2026-5551` · Go `heckel.io/ntfy/v2`: affected `<2.22.0`, fixed in `2.22.0` · CVSS 6.4 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Code injection, CWE-777 - [H2O-3 is Vulnerable to Code Injection](https://agentprime.io/advisories/GHSA-qmcv-hh7c-3m56.md) `GHSA-qmcv-hh7c-3m56`, `CVE-2026-3960`, `PYSEC-2026-2180` · Maven `ai.h2o:h2o-core`: affected `<3.46.0.10`, fixed in `3.46.0.10` · CVSS 5.9 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Code injection - [WordPress FunnelFormsPro plugin <= 3.8.1 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-39440.md) `CVE-2026-39440` · CVE record: Funnelforms LLC FunnelFormsPro · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Apr 2026 · Tags: Code injection - [verl's math_equal() Vulnerable to Arbitrary Code Execution via Unsafe eval()](https://agentprime.io/advisories/GHSA-h57c-v2v3-5v3v.md) `GHSA-h57c-v2v3-5v3v`, `CVE-2026-6878`, `PYSEC-2026-3402` · PyPI `verl`: affected `<=0.7.1`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 23 Apr 2026 · Tags: Code injection, CWE-264, CWE-265 - [Luanti has a mod security sandbox escape](https://agentprime.io/advisories/CVE-2026-41196.md) `CVE-2026-41196` · CVE record: luanti-org luanti · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Apr 2026 · Tags: Code injection - [Nuclei: Environment variable disclosure via Response-Derived DSL Expressions](https://agentprime.io/advisories/GHSA-jm34-66cf-qpvr.md) `GHSA-jm34-66cf-qpvr`, `CVE-2026-41282`, `CVE-2026-41645`, `GO-2026-5473` · Go `github.com/projectdiscovery/nuclei/v3`: affected `>=3.0.0, <3.8.0`, fixed in `3.8.0` · CVSS 4.0 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Code injection - [i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes](https://agentprime.io/advisories/GHSA-6457-mxpq-4fqq.md) `GHSA-6457-mxpq-4fqq`, `CVE-2026-41692` · npm `i18nextify`: affected `<4.0.8`, fixed in `4.0.8` · CVSS 4.7 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution](https://agentprime.io/advisories/GHSA-jfwf-28xr-xw6q.md) `GHSA-jfwf-28xr-xw6q`, `BIT-rclone-2026-41179`, `CVE-2026-41179`, `GO-2026-5466` · Go `github.com/rclone/rclone`: affected `>=1.48.0, <1.73.5`, fixed in `1.73.5` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Apr 2026 · Tags: Command injection, Code injection, Authentication bypass - [Incomplete domain name sanitization during](https://agentprime.io/advisories/CVE-2026-33608.md) `CVE-2026-33608` · CVE record: PowerDNS Authoritative · CVSS 7.4 High · Not analysed yet · Published 22 Apr 2026 · Tags: Code injection - [Bagisto affected by Cross-site Scripting](https://agentprime.io/advisories/GHSA-65fp-7g2v-658r.md) `GHSA-65fp-7g2v-658r`, `CVE-2026-6745`, `PKSA-fphw-3zcz-ygcb` · Packagist `bagisto/bagisto`: affected `<=2.3.15`, no fixed version yet · CVSS 5.1 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [WebSystems WebTOTUM Calendar cross site scripting](https://agentprime.io/advisories/CVE-2026-6743.md) `CVE-2026-6743` · CVE record: WebSystems WebTOTUM · CVSS 5.1 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [Dolibarr Allows Code Injection through its Website Module](https://agentprime.io/advisories/GHSA-676v-wh57-p375.md) `GHSA-676v-wh57-p375`, `CVE-2026-31018`, `PKSA-ntds-z6nr-8hyf` · Packagist `dolibarr/dolibarr`: affected `<=15.0.3`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 21 Apr 2026 · Tags: Code injection, Broken access control - [Spinnaker: RCE via expression parsing due to unrestricted context handling](https://agentprime.io/advisories/GHSA-69rw-45wj-g4v6.md) `GHSA-69rw-45wj-g4v6`, `CVE-2026-32613` · Maven `io.spinnaker.echo:echo-pipelinetriggers`: affected `>=2026.0-0, <2026.0.1 || >=2025.4-0, <2025.4.2 || <2025.3.2`, fixed in `2026.0.1`, `2025.4.2`, `2025.3.2` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Apr 2026 · Tags: Code injection - [Pagekit CMS StringStorage Template PhpEngine.php evaluate eval injection](https://agentprime.io/advisories/CVE-2026-6652.md) `CVE-2026-6652` · CVE record: Pagekit CMS · CVSS 5.1 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Code injection - [Vvveb < 1.0.8.1 Code Injection via Installation Endpoint](https://agentprime.io/advisories/CVE-2026-39918.md) `CVE-2026-39918` · CVE record: givanz Vvveb · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Apr 2026 · Tags: Code injection - [erponline.xyz ERP Online Inventory Edit Item cross site scripting](https://agentprime.io/advisories/CVE-2026-6651.md) `CVE-2026-6651` · CVE record: erponline.xyz ERP Online · CVSS 4.8 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [CVE-2026-5760](https://agentprime.io/advisories/CVE-2026-5760.md) `CVE-2026-5760` · CVE record: SGLang SGLang · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Apr 2026 · Tags: Code injection - [Qibo CMS Internal Message cross site scripting](https://agentprime.io/advisories/CVE-2026-6648.md) `CVE-2026-6648` · CVE record: Qibo CMS · CVSS 5.1 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [Yifang CMS Extended Management L_rbac_admin.php store cross site scripting](https://agentprime.io/advisories/CVE-2026-6633.md) `CVE-2026-6633` · CVE record: Yifang CMS · CVSS 5.1 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [BichitroGan ISP Billing Software Pool List add cross site scripting](https://agentprime.io/advisories/CVE-2026-6624.md) `CVE-2026-6624` · CVE record: BichitroGan ISP Billing Software · CVSS 4.8 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [BichitroGan ISP Billing Software Profile users-view cross site scripting](https://agentprime.io/advisories/CVE-2026-6623.md) `CVE-2026-6623` · CVE record: BichitroGan ISP Billing Software · CVSS 4.8 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [BichitroGan ISP Billing Software Customer edit cross site scripting](https://agentprime.io/advisories/CVE-2026-6622.md) `CVE-2026-6622` · CVE record: BichitroGan ISP Billing Software · CVSS 4.8 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [1024bit extend-deep index.js prototype pollution](https://agentprime.io/advisories/CVE-2026-6621.md) `CVE-2026-6621` · CVE record: 1024bit extend-deep · CVSS 6.9 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Code injection, Prototype pollution - [langgenius dify ImagePreview image-preview.tsx openInNewTab cross site scripting](https://agentprime.io/advisories/CVE-2026-6619.md) `CVE-2026-6619` · CVE record: langgenius dify · CVSS 5.1 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [AgentScope Vulnerable to Remote Code Injection](https://agentprime.io/advisories/GHSA-cr24-fv3h-8cjm.md) `GHSA-cr24-fv3h-8cjm`, `CVE-2026-6603`, `PYSEC-2026-2331` · PyPI `agentscope`: affected `<=1.0.18`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Other injection, Code injection - [Deep Merge is Vulnerable to Prototype Pollution Through Lack of Sanitization](https://agentprime.io/advisories/GHSA-3jc6-6r48-v6qf.md) `GHSA-3jc6-6r48-v6qf`, `CVE-2026-6594` · npm `@brikcss/merge`: affected `<=1.3.1`, no fixed version yet · CVSS 6.9 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Code injection, Prototype pollution - [langflow-ai langflow Frontend React Component Rendering edit-message.tsx cross site scripting](https://agentprime.io/advisories/CVE-2026-6600.md) `CVE-2026-6600` · CVE record: langflow-ai langflow · CVSS 5.1 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [ComfyUI View Endpoint server.py cross site scripting](https://agentprime.io/advisories/CVE-2026-6593.md) `CVE-2026-6593` · CVE record: ComfyUI · CVSS 5.1 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [ComfyUI userdata Endpoint user_manager.py getuserdata cross site scripting](https://agentprime.io/advisories/CVE-2026-6592.md) `CVE-2026-6592` · CVE record: ComfyUI · CVSS 5.1 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [Wavlink WL-WN579A3 login.cgi sub_401F80 cross site scripting](https://agentprime.io/advisories/CVE-2026-6559.md) `CVE-2026-6559` · CVE record: Wavlink WL-WN579A3 · CVSS 5.3 Medium · Not analysed yet · Published 19 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [Remote Code Execution (RCE) via String Literal Injection into math-codegen](https://agentprime.io/advisories/GHSA-p6x5-p4xf-cc4r.md) `GHSA-p6x5-p4xf-cc4r`, `CVE-2026-41507` · npm `math-codegen`: affected `<0.4.3`, fixed in `0.4.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Apr 2026 · Tags: Code injection - [Firebird: Path Traversal + Arbitrary File Write Leads to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-40342.md) `CVE-2026-40342` · CVE record: FirebirdSQL firebird · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Apr 2026 · Tags: Path traversal, Code injection, CWE-427 - [lukevella rallly Reset Password reset-password-form.tsx cross site scripting](https://agentprime.io/advisories/CVE-2026-6493.md) `CVE-2026-6493` · CVE record: lukevella rallly · CVSS 5.1 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [classroombookings User Display Name layout.php read cross site scripting](https://agentprime.io/advisories/CVE-2026-6486.md) `CVE-2026-6486` · CVE record: classroombookings · CVSS 5.1 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [Template injection in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-33392.md) `CVE-2026-33392` · CVE record: JetBrains YouTrack · CVSS 7.2 High · Not analysed yet · Published 17 Apr 2026 · Tags: Code injection - [SiYuan: Mermaid \`javascript:\` Link Injection Leads to Stored XSS and Electron RCE](https://agentprime.io/advisories/CVE-2026-40322.md) `CVE-2026-40322` · CVE record: siyuan-note siyuan · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2026 · Tags: Cross-site scripting (XSS), Code injection - [Unsafe object property setter in mathjs](https://agentprime.io/advisories/GHSA-29qv-4j9f-fjw5.md) `GHSA-29qv-4j9f-fjw5`, `CVE-2026-40897` · npm `mathjs`: affected `>=13.1.1, <15.2.0`, fixed in `15.2.0` · CVSS 8.8 High · Not analysed yet · Published 16 Apr 2026 · Tags: Broken access control, Code injection - [protobufjs has an arbitrary code execution issue](https://agentprime.io/advisories/GHSA-xq3m-2v4x-88gg.md) `GHSA-xq3m-2v4x-88gg`, `CVE-2026-41242` · npm `protobufjs`: affected `<6.11.6 || >=7.0.0, <7.5.5 || >=8.0.0, <8.0.1`, fixed in `6.11.6`, `7.5.5`, `8.0.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2026 · Tags: Code injection - [Flowise: Code Injection in CSVAgent leads to Authenticated RCE](https://agentprime.io/advisories/GHSA-9wc7-mj3f-74xv.md) `GHSA-9wc7-mj3f-74xv`, `CVE-2026-41137` · npm `flowise` and 1 more: affected `<3.1.0`, fixed in `3.1.0` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2026 · Tags: Code injection - [Flowise: Remote code execution vulnerability in AirtableAgent.ts caused by lack of input verification when using \`Pandas\`.](https://agentprime.io/advisories/GHSA-f228-chmx-v6j6.md) `GHSA-f228-chmx-v6j6`, `CVE-2026-41138` · npm `flowise` and 1 more: affected `<3.1.0`, fixed in `3.1.0` · CVSS 8.3 High · Not analysed yet · Published 16 Apr 2026 · Tags: Code injection - [OmniFaces: EL injection via crafted resource name in wildcard CDN mapping](https://agentprime.io/advisories/GHSA-vp6r-9m58-5xv8.md) `GHSA-vp6r-9m58-5xv8`, `CVE-2026-41883` · Maven `org.omnifaces:omnifaces`: affected `<1.14.2 || >=2.0-RC1, <2.7.32 || >=3.0-RC1, <3.14.16 || >=4.0-M1, <4.7.5 || >=5.0-M1, <5.2.3`, fixed in `1.14.2`, `2.7.32`, `3.14.16`, `4.7.5`, `5.2.3` · CVSS 8.1 High · Not analysed yet · Published 16 Apr 2026 · Tags: Code injection - [Home Assistant Command-line Interface: Handling of user-supplied Jinja2 templates](https://agentprime.io/advisories/GHSA-33qf-q99x-wpm8.md) `GHSA-33qf-q99x-wpm8`, `CVE-2026-40602`, `PYSEC-2026-2518` · PyPI `homeassistant-cli`: affected `<1.0.0`, fixed in `1.0.0` · CVSS 5.6 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: Code injection - [Statamic: Unsafe method invocation via query value resolution allows data destruction](https://agentprime.io/advisories/GHSA-4jjr-vmv7-wh4w.md) `GHSA-4jjr-vmv7-wh4w`, `CVE-2026-41175`, `PKSA-yx2m-bjk3-fnky` · Packagist `statamic/cms`: affected `<5.73.20 || >=6.0.0-alpha.1, <6.13.0`, fixed in `5.73.20`, `6.13.0` · CVSS 8.1 High · Not analysed yet · Published 16 Apr 2026 · Tags: Code injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .