# Code injection. Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [MCP Calculate Server: Prompt Injection to RCE](https://agentprime.io/advisories/CVE-2026-44717.md) `CVE-2026-44717` · CVE record: 611711Dark mcp_calculate_server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 May 2026 · Tags: Code injection, CWE-1427 - [Oinone Pamirs 7.0.0 contains a code execution vulnerability via ScriptRunner.](https://agentprime.io/advisories/CVE-2026-39052.md) `CVE-2026-39052` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 15 May 2026 · Tags: Code injection - [ORSEE (Online Recruitment System for Economic Experiments) 3.1.0 contains an authenticated Remote Code Execution vulnerability in the participant profile field processing subsystem.](https://agentprime.io/advisories/CVE-2025-67031.md) `CVE-2025-67031` · CVE record · CVSS 6.3 Medium · Not analysed yet · Published 15 May 2026 · Tags: Code injection - [Crabbox: environment variable exposure vulnerability](https://agentprime.io/advisories/GHSA-fm77-94qm-4894.md) `GHSA-fm77-94qm-4894`, `CVE-2026-8634`, `GO-2026-5369` · Go `github.com/openclaw/crabbox`: affected `<0.12.0`, fixed in `0.12.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2026 · Tags: Code injection - [Electerm Local code through electerm's single-instance socket](https://agentprime.io/advisories/GHSA-7p5m-v798-f8vv.md) `GHSA-7p5m-v798-f8vv`, `CVE-2026-45353` · npm `electerm`: affected `>=3.0.6, <3.9.0`, fixed in `3.9.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2026 · Tags: Code injection, Broken access control, CWE-940 - [DeepSeek TUI: task_create Insecure Defaults Enable RCE via Prompt Injection in Project Files](https://agentprime.io/advisories/GHSA-72w5-pf8h-xfp4.md) `GHSA-72w5-pf8h-xfp4`, `CVE-2026-45374` · crates.io `deepseek-tui`: affected `<0.8.26`, fixed in `0.8.26` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2026 · Tags: Code injection - [DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval](https://agentprime.io/advisories/GHSA-wx44-2q6h-j6p8.md) `GHSA-wx44-2q6h-j6p8`, `CVE-2026-45311` · crates.io `deepseek-tui` and 2 more: affected `>=0.3.0, <0.8.23`, fixed in `0.8.23` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2026 · Tags: Code injection - [Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark](https://agentprime.io/advisories/GHSA-jgg9-rw32-44pj.md) `GHSA-jgg9-rw32-44pj`, `CVE-2026-45058` · npm `electerm`: affected `<=3.8.8`, no fixed version yet · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2026 · Tags: Code injection, Broken access control, CWE-345, CWE-494 - [Code injection in Google Chrome](https://agentprime.io/advisories/CVE-2026-8539.md) `CVE-2026-8539` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 14 May 2026 · Tags: Code injection - [SiYuan: Bazaar marketplace renders unescaped package author metadata, allowing XSS and Electron code execution](https://agentprime.io/advisories/CVE-2026-44586.md) `CVE-2026-44586` · CVE record: siyuan-note siyuan · CVSS 8.3 High · Not analysed yet · Published 14 May 2026 · Tags: Cross-site scripting (XSS), Code injection - [RCE in Yordam Informatics' Library Automation System](https://agentprime.io/advisories/CVE-2025-15024.md) `CVE-2025-15024` · CVE record: Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Automation System · CVSS 8.8 High · Not analysed yet · Published 14 May 2026 · Tags: Code injection - [FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape](https://agentprime.io/advisories/GHSA-9rvc-vf7m-pgm2.md) `GHSA-9rvc-vf7m-pgm2`, `CVE-2026-46442` · npm `flowise`: affected `<3.1.2`, fixed in `3.1.2` · CVSS 9.4 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.33 · Not analysed yet · Published 14 May 2026 · Tags: Code injection - [soundcloud-rpc: Remote Code Execution via XSS in Track Title](https://agentprime.io/advisories/CVE-2026-44482.md) `CVE-2026-44482` · CVE record: richardhbtz soundcloud-rpc · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2026 · Tags: Cross-site scripting (XSS), Code injection, Broken access control, CWE-20 - [CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure \`pull_request_target\` Configuration](https://agentprime.io/advisories/GHSA-q58j-g3f4-h26h.md) `GHSA-q58j-g3f4-h26h`, `CVE-2026-41249`, `PKSA-9rch-wbbh-7nr6` · Packagist `coreshop/core-shop`: affected `=5.0.0`, no fixed version yet · CVSS 8.2 High · Not analysed yet · Published 14 May 2026 · Tags: Code injection - [Amazon Redshift Vulnerable to Remote Code Execution via Unsafe Class Loading](https://agentprime.io/advisories/GHSA-wmmv-vvg5-993q.md) `GHSA-wmmv-vvg5-993q`, `CVE-2026-8178` · Maven `com.amazon.redshift:redshift-jdbc42`: affected `<2.2.2`, fixed in `2.2.2` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 May 2026 · Tags: Code injection - [Improper Control of Generation of Code ('Code Injection') in GitLab](https://agentprime.io/advisories/CVE-2025-12669.md) `CVE-2025-12669` · CVE record: GitLab GitLab · CVSS 5.4 Medium · Not analysed yet · Published 14 May 2026 · Tags: Code injection - [Remote Code Execution in coleam00 Archon 0.1.0.](https://agentprime.io/advisories/CVE-2025-69443.md) `CVE-2025-69443` · CVE record · CVSS 6.3 Medium · Not analysed yet · Published 14 May 2026 · Tags: Code injection - [CubeCart: Authenticated RCE via Invoice Template → Order Print](https://agentprime.io/advisories/CVE-2026-45708.md) `CVE-2026-45708` · CVE record: cubecart v6 · CVSS 7.2 High · Not analysed yet · Published 13 May 2026 · Tags: Code injection - [CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE](https://agentprime.io/advisories/CVE-2026-45714.md) `CVE-2026-45714` · CVE record: cubecart v6 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2026 · Tags: Code injection - [CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE](https://agentprime.io/advisories/CVE-2026-44377.md) `CVE-2026-44377` · CVE record: cubecart v6 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2026 · Tags: Code injection - [Prisma Browser: Code Injection Enables Security Controls Bypass](https://agentprime.io/advisories/CVE-2026-0236.md) `CVE-2026-0236` · CVE record: Palo Alto Networks Prisma Browser · CVSS 7.3 High · Not analysed yet · Published 13 May 2026 · Tags: Code injection - [claude-code-cache-fix vulnerable to local code execution via Python triple-quote injection in tools/quota-statusline.sh](https://agentprime.io/advisories/GHSA-g3xq-3gmv-qq8g.md) `GHSA-g3xq-3gmv-qq8g`, `CVE-2026-45136` · npm `claude-code-cache-fix`: affected `>=3.5.0, <3.5.2`, fixed in `3.5.2` · CVSS 8.6 High · Not analysed yet · Published 13 May 2026 · Tags: Command injection, Code injection - [Mapfish Print: Remote Code Injection (RCE) in Dynamic table](https://agentprime.io/advisories/GHSA-q7m6-wpvf-mvwx.md) `GHSA-q7m6-wpvf-mvwx`, `CVE-2026-44672` · Maven `org.mapfish.print:print-lib` and 1 more: affected `>=3.23.0, <3.28.28 || >=3.29.0, <3.30.30 || >=3.31.0, <3.31.21 || >=3.32.0, <3.33.14 || >=3.34.0, <4.0.3`, fixed in `3.28.28`, `3.30.30`, `3.31.21`, `3.33.14`, `4.0.3` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 May 2026 · Tags: Code injection - [ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORD](https://agentprime.io/advisories/CVE-2026-42288.md) `CVE-2026-42288` · CVE record: ChurchCRM CRM · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Code injection - [Code injection in Claris FileMaker Cloud](https://agentprime.io/advisories/CVE-2026-43680.md) `CVE-2026-43680` · CVE record: Claris FileMaker Cloud · CVSS 7.2 High · Not analysed yet · Published 12 May 2026 · Tags: Code injection - [Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution](https://agentprime.io/advisories/CVE-2025-15463.md) `CVE-2025-15463` · CVE record: hwk-fr Advanced Custom Fields: Extended · CVSS 6.5 Medium · Not analysed yet · Published 12 May 2026 · Tags: Code injection - [Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization](https://agentprime.io/advisories/CVE-2026-44403.md) `CVE-2026-44403` · CVE record: Wing FTP Server Wing FTP Server · CVSS 8.6 High · Not analysed yet · Published 12 May 2026 · Tags: Code injection - [SPIP < 4.4.14 Remote Code Execution via nginx](https://agentprime.io/advisories/CVE-2026-8430.md) `CVE-2026-8430` · CVE record: SPIP SPIP · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Code injection - [SPIP < 4.4.14 Remote Code Execution via Private Space](https://agentprime.io/advisories/CVE-2026-8429.md) `CVE-2026-8429` · CVE record: SPIP SPIP · CVSS 8.7 High · Not analysed yet · Published 12 May 2026 · Tags: Code injection - [Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism](https://agentprime.io/advisories/GHSA-r6hf-g5x6-7pv9.md) `GHSA-r6hf-g5x6-7pv9`, `CVE-2026-31233`, `PYSEC-2026-347` · PyPI `guardrails-ai`: affected `<=0.6.7`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Code injection - [Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page](https://agentprime.io/advisories/GHSA-94gr-w3q5-rfqr.md) `GHSA-94gr-w3q5-rfqr`, `CVE-2025-65719`, `PYSEC-2026-371` · npm `kubectl-mcp-server` and 1 more: affected `<1.2.0`, fixed in `1.2.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Code injection - [Superduper: Remote code execution via unsafe eval in superduper query parsing](https://agentprime.io/advisories/GHSA-2799-6g5r-mmc7.md) `GHSA-2799-6g5r-mmc7`, `CVE-2026-31225`, `PYSEC-2026-3077` · PyPI `superduper-framework`: affected `<=0.10.0`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 12 May 2026 · Tags: Code injection - [AntSword: Incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection](https://agentprime.io/advisories/CVE-2026-43892.md) `CVE-2026-43892` · CVE record: AntSwordProject antSword · CVSS 8.8 High · Not analysed yet · Published 12 May 2026 · Tags: Cross-site scripting (XSS), Code injection, CWE-1188 - [Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-42898.md) `CVE-2026-42898` · CVE record: Microsoft Microsoft Dynamics 365 (on-premises) version 9.1 · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Code injection - [Microsoft Data Formulator Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-41094.md) `CVE-2026-41094` · CVE record: Microsoft Microsoft Data Formulator · CVSS 8.8 High · Not analysed yet · Published 12 May 2026 · Tags: Code injection - [protobuf.js: Code injection in pbjs static output from crafted schema names](https://agentprime.io/advisories/GHSA-6r35-46g8-jcw9.md) `GHSA-6r35-46g8-jcw9`, `CVE-2026-44295` · npm `protobufjs-cli`: affected `<1.2.1 || >=2.0.0, <2.0.2`, fixed in `1.2.1`, `2.0.2` · CVSS 8.7 High · Not analysed yet · Published 12 May 2026 · Tags: Code injection - [protobuf.js: Code injection through bytes field defaults in generated toObject code](https://agentprime.io/advisories/GHSA-66ff-xgx4-vchm.md) `GHSA-66ff-xgx4-vchm`, `CVE-2026-44293` · npm `protobufjs`: affected `<7.5.6 || >=8.0.0, <8.0.2`, fixed in `7.5.6`, `8.0.2` · CVSS 7.7 High · Not analysed yet · Published 12 May 2026 · Tags: Code injection - [protobuf.js: Code generation gadget after prototype pollution](https://agentprime.io/advisories/GHSA-75px-5xx7-5xc7.md) `GHSA-75px-5xx7-5xc7`, `CVE-2026-44291` · npm `protobufjs`: affected `<7.5.6 || >=8.0.0, <8.0.2`, fixed in `7.5.6`, `8.0.2` · CVSS 8.1 High · Not analysed yet · Published 12 May 2026 · Tags: Code injection, Prototype pollution - [Spring AI: Prompt Injection via Memory Poisoning in PromptChatMemoryAdvisor](https://agentprime.io/advisories/GHSA-5852-phmh-8fhr.md) `GHSA-5852-phmh-8fhr`, `CVE-2026-41713` · Maven `org.springframework.ai:spring-ai-client-chat`: affected `<1.0.7 || >=1.1.0-M1, <1.1.6`, fixed in `1.0.7`, `1.1.6` · CVSS 8.2 High · Not analysed yet · Published 12 May 2026 · Tags: Code injection - [Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform](https://agentprime.io/advisories/CVE-2026-40129.md) `CVE-2026-40129` · CVE record: SAP_SE SAP Application Server ABAP for SAP NetWeaver and ABAP Platform · CVSS 4.3 Medium · Not analysed yet · Published 12 May 2026 · Tags: Code injection - [Cognee thru v0.4.0 contains a critical remote code execution vulnerability in its notebook cell execution API endpoint.](https://agentprime.io/advisories/CVE-2026-31231.md) `CVE-2026-31231` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Code injection - [The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a command-line argument injection vulnerability in its Kubeflow component (robustness_evaluation_fgsm_pytorch.py).](https://agentprime.io/advisories/CVE-2026-31230.md) `CVE-2026-31230` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Command injection, Code injection - [The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a remote code execution vulnerability in its Kubeflow component.](https://agentprime.io/advisories/CVE-2026-31228.md) `CVE-2026-31228` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Code injection - [The \_load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f (2024-07-21) allows arbitrary code execution.](https://agentprime.io/advisories/CVE-2026-31217.md) `CVE-2026-31217` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2026 · Tags: Code injection - [SandboxJS has a sandbox escape via Function.caller leakage of internal call op](https://agentprime.io/advisories/GHSA-g8f2-4f4f-5jqw.md) `GHSA-g8f2-4f4f-5jqw`, `CVE-2026-43898` · npm `@nyariv/sandboxjs`: affected `<0.9.6`, fixed in `0.9.6` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 May 2026 · Tags: Code injection - [Mermaid: Improper sanitization of configuration leads to CSS injection](https://agentprime.io/advisories/GHSA-87f9-hvmw-gh4p.md) `GHSA-87f9-hvmw-gh4p`, `CVE-2026-41159` · npm `mermaid`: affected `<10.9.6 || >=11.0.0-alpha.1, <11.15.0`, fixed in `10.9.6`, `11.15.0` · CVSS 5.3 Medium · Not analysed yet · Published 11 May 2026 · Tags: Code injection - [Mermaid: Improper sanitization of \`classDef\` in state diagrams leads to HTML injection](https://agentprime.io/advisories/GHSA-ghcm-xqfw-q4vr.md) `GHSA-ghcm-xqfw-q4vr`, `CVE-2026-41149` · npm `mermaid`: affected `<10.9.6 || >=11.0.0-alpha.1, <11.15.0`, fixed in `10.9.6`, `11.15.0` · CVSS 5.3 Medium · Not analysed yet · Published 11 May 2026 · Tags: Code injection - [Mermaid: Improper sanitization of \`classDefs\` in diagrams leads to CSS injection](https://agentprime.io/advisories/GHSA-xcj9-5m2h-648r.md) `GHSA-xcj9-5m2h-648r`, `CVE-2026-41148` · npm `mermaid`: affected `<10.9.6 || >=11.0.0-alpha.1, <11.15.0`, fixed in `10.9.6`, `11.15.0` · CVSS 5.3 Medium · Not analysed yet · Published 11 May 2026 · Tags: Code injection - [flash-attention contains an insecure deserialization vulnerability in its checkpoint loading mechanism](https://agentprime.io/advisories/GHSA-7g5w-pq96-8c5w.md) `GHSA-7g5w-pq96-8c5w`, `CVE-2026-31253`, `PYSEC-2026-2477` · PyPI `flash-attn`: affected `<=2.8.3`, no fixed version yet · CVSS 7.3 High · Not analysed yet · Published 11 May 2026 · Tags: Code injection, Insecure deserialization - [Angular Expressions - Remote Code Execution using filters](https://agentprime.io/advisories/GHSA-pw8r-6689-xvf4.md) `GHSA-pw8r-6689-xvf4`, `CVE-2026-44643` · npm `angular-expressions`: affected `<1.5.2`, fixed in `1.5.2` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 May 2026 · Tags: Code injection - [LiteLLM has a sandbox escape in custom-code guardrail](https://agentprime.io/advisories/GHSA-wxxx-gvqv-xp7p.md) `GHSA-wxxx-gvqv-xp7p`, `CVE-2026-40217`, `PYSEC-2026-2601` · PyPI `litellm`: affected `>=1.81.8, <1.83.10`, fixed in `1.83.10` · CVSS 8.8 High · Critical (CVSS 7+ and EPSS) · EPSS 0.17 · Not analysed yet · Published 11 May 2026 · Tags: Code injection, CWE-420, CWE-913 - [Local Path Provisioner Vulnerable to HelperPod Template Injection](https://agentprime.io/advisories/GHSA-7fxv-8wr2-mfc4.md) `GHSA-7fxv-8wr2-mfc4`, `CVE-2026-44543`, `GO-2026-5218` · Go `github.com/rancher/local-path-provisioner`: affected `<0.0.36`, fixed in `0.0.36` · CVSS 8.7 High · Not analysed yet · Published 11 May 2026 · Tags: Privilege escalation, Code injection - [OWASP BLT: pre-commit-fix.yaml executes untrusted fork code via pull_request_target](https://agentprime.io/advisories/CVE-2026-42603.md) `CVE-2026-42603` · CVE record: OWASP-BLT BLT · CVSS 8.8 High · Not analysed yet · Published 11 May 2026 · Tags: Code injection - [Dockerfile command injection via envs\[\*\].name in bentofile.yaml (sibling fix-bypass of CVE-2026-33744 and CVE-2026-35043)](https://agentprime.io/advisories/GHSA-w2pm-x38x-jp44.md) `GHSA-w2pm-x38x-jp44`, `CVE-2026-44346`, `PYSEC-2026-190` · PyPI `bentoml`: affected `<1.4.39`, fixed in `1.4.39` · CVSS 8.8 High · Not analysed yet · Published 11 May 2026 · Tags: Command injection, Code injection - [PraisonAI has unsafe tool resolution in \`ToolExecutionMixin.execute_tool\`: undeclared \`\_\_main\_\_\` callables execute](https://agentprime.io/advisories/GHSA-gmjg-hv98-qggq.md) `GHSA-gmjg-hv98-qggq`, `CVE-2026-44339`, `PYSEC-2026-2915`, `PYSEC-2026-2948` · PyPI `praisonai` and 1 more: affected `<4.6.37`, fixed in `4.6.37` · CVSS 8.6 High · Not analysed yet · Published 11 May 2026 · Tags: Code injection - [Devs Palace ERP Online chart-save cross site scripting](https://agentprime.io/advisories/CVE-2026-8262.md) `CVE-2026-8262` · CVE record: Devs Palace ERP Online · CVSS 4.8 Medium · Not analysed yet · Published 11 May 2026 · Tags: Cross-site scripting (XSS), Code injection - [Devs Palace ERP Online mr-save cross site scripting](https://agentprime.io/advisories/CVE-2026-8256.md) `CVE-2026-8256` · CVE record: Devs Palace ERP Online · CVSS 4.8 Medium · Not analysed yet · Published 11 May 2026 · Tags: Cross-site scripting (XSS), Code injection - [Devs Palace ERP Online add_new_customer cross site scripting](https://agentprime.io/advisories/CVE-2026-8255.md) `CVE-2026-8255` · CVE record: Devs Palace ERP Online · CVSS 4.8 Medium · Not analysed yet · Published 11 May 2026 · Tags: Cross-site scripting (XSS), Code injection - [An issue in QuickJS-NG v.0.12.1 allows an attacker to execute arbitrary code via the js_mapped_arguments_mark function](https://agentprime.io/advisories/CVE-2026-37630.md) `CVE-2026-37630` · CVE record · CVSS 7.3 High · Not analysed yet · Published 11 May 2026 · Tags: Code injection - [The flash-attention project thru commit e724e2588cbe754beb97cf7c011b5e7e34119e62 (2025-13-04) contains a code injection vulnerability (CWE-94) in its training script.](https://agentprime.io/advisories/CVE-2026-31254.md) `CVE-2026-31254` · CVE record · CVSS 7.3 High · Not analysed yet · Published 11 May 2026 · Tags: Code injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .