# Code injection. Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [browserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in \_log HTTP handler](https://agentprime.io/advisories/GHSA-6vr3-7wcx-v5g5.md) `GHSA-6vr3-7wcx-v5g5`, `CVE-2026-49143` · npm `browserstack-runner`: affected `<=0.9.5`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 3 Jun 2026 · Tags: Code injection - [Docling: Unsafe Playwright-based HTML Rendering](https://agentprime.io/advisories/GHSA-pj2v-ggqh-cmq2.md) `GHSA-pj2v-ggqh-cmq2`, `CVE-2026-44016`, `PYSEC-2026-2142` · PyPI `docling`: affected `>=2.82.0, <2.91.0`, fixed in `2.91.0` · CVSS 8.2 High · Not analysed yet · Published 3 Jun 2026 · Tags: Code injection, Server-side request forgery (SSRF) - [ahujasid blender-mcp server.py execute_blender_code code injection](https://agentprime.io/advisories/CVE-2026-10688.md) `CVE-2026-10688` · CVE record: ahujasid blender-mcp · CVSS 5.1 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Other injection, Code injection - [OpenMed vulnerable to remote code injection through privacy-filter model loading path](https://agentprime.io/advisories/GHSA-m3v4-v5gx-7wf5.md) `GHSA-m3v4-v5gx-7wf5`, `CVE-2026-47117`, `PYSEC-2026-2852` · PyPI `openmed`: affected `<1.5.2`, fixed in `1.5.2` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jun 2026 · Tags: Code injection - [Content Visibility for Divi Builder <= 4.02 - Authenticated (Contributor+) Remote Code Execution](https://agentprime.io/advisories/CVE-2026-1829.md) `CVE-2026-1829` · CVE record: jhorowitz Content Visibility for Divi Builder · CVSS 8.8 High · Not analysed yet · Published 2 Jun 2026 · Tags: Code injection - [Apache Calcite is Vulnerable to Use of Externally-Controlled Input to Select Classes](https://agentprime.io/advisories/GHSA-c2rv-hwqm-wjpg.md) `GHSA-c2rv-hwqm-wjpg`, `CVE-2026-46718` · Maven `org.apache.calcite:calcite-core`: affected `>=1.5.0, <1.42.0`, fixed in `1.42.0` · CVSS 6.5 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Code injection - [Server-Side Template Injection (SSTI) in Wirtualna Uczelnia](https://agentprime.io/advisories/CVE-2026-34906.md) `CVE-2026-34906` · CVE record: Simple SA Wirtualna Uczelnia · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jun 2026 · Tags: Code injection - [1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting](https://agentprime.io/advisories/CVE-2026-10567.md) `CVE-2026-10567` · CVE record: 1Panel-dev CordysCRM · CVSS 5.1 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection - [westboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scripting](https://agentprime.io/advisories/CVE-2026-10529.md) `CVE-2026-10529` · CVE record: westboy CicadasCMS · CVSS 4.8 Medium · Not analysed yet · Published 2 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection - [1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting](https://agentprime.io/advisories/CVE-2026-10514.md) `CVE-2026-10514` · CVE record: 1Panel-dev CordysCRM · CVSS 4.8 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection - [itsourcecode Fees Management System index.php cross site scripting](https://agentprime.io/advisories/CVE-2026-10301.md) `CVE-2026-10301` · CVE record: itsourcecode Fees Management System · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Hotel and Tourism Reservation System tour.php cross site scripting](https://agentprime.io/advisories/CVE-2026-10289.md) `CVE-2026-10289` · CVE record: code-projects Hotel and Tourism Reservation System · CVSS 5.3 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection - [IBM WebSphere Application Server is affected by remote code execution](https://agentprime.io/advisories/CVE-2026-9311.md) `CVE-2026-9311` · CVE record: IBM WebSphere Application Server · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jun 2026 · Tags: Code injection - [CloudPirates Open Source Helm Charts: GitHub Actions pull_request_target workflow allows secret exfiltration via fork pull requests](https://agentprime.io/advisories/CVE-2026-45131.md) `CVE-2026-45131` · CVE record: CloudPirates-io helm-charts · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jun 2026 · Tags: Code injection - [CloudPirates Open Source Helm Charts: GitHub Actions workflow leaks PAT and SSH signing key via unsafe credential handling](https://agentprime.io/advisories/CVE-2026-45132.md) `CVE-2026-45132` · CVE record: CloudPirates-io helm-charts · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jun 2026 · Tags: Code injection - [Critical RCE vulnerability in Disig Web Signer](https://agentprime.io/advisories/CVE-2026-8931.md) `CVE-2026-8931` · CVE record: Disig Web Signer · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jun 2026 · Tags: Code injection - [SourceCodester Pharmacy Sales and Inventory System main create_generic_name cross site scripting](https://agentprime.io/advisories/CVE-2026-10247.md) `CVE-2026-10247` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 5.1 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Pharmacy Sales and Inventory System main create_medicine_presentation cross site scripting](https://agentprime.io/advisories/CVE-2026-10246.md) `CVE-2026-10246` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 5.1 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection - [Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue](https://agentprime.io/advisories/GHSA-v853-w46p-fv2h.md) `GHSA-v853-w46p-fv2h`, `BIT-activemq-2026-45505`, `CVE-2026-45505` · Maven `org.apache.activemq:activemq-all` and 2 more: affected `<5.19.7 || >=6.0.0, <6.2.6`, fixed in `5.19.7`, `6.2.6` · CVSS 8.8 High · Not analysed yet · Published 1 Jun 2026 · Tags: Code injection, CWE-20 - [Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue](https://agentprime.io/advisories/GHSA-hg6c-8mvr-jqc9.md) `GHSA-hg6c-8mvr-jqc9`, `BIT-activemq-2026-42588`, `CVE-2026-42588` · Maven `org.apache.activemq:activemq-all` and 2 more: affected `<5.19.7 || >=6.0.0, <6.2.6`, fixed in `5.19.7`, `6.2.6` · CVSS 8.1 High · Not analysed yet · Published 1 Jun 2026 · Tags: Code injection, CWE-20 - [SourceCodester Pharmacy Sales and Inventory System main create_supplier cross site scripting](https://agentprime.io/advisories/CVE-2026-10245.md) `CVE-2026-10245` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 5.1 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection - [Apache Airflow's official documentation at \`core-concepts/dag-run.html\` ("Passing Parameters when triggering Dags") showed a verbatim \`BashOperator(bash_command="echo value: {{ dag_run.conf\['conf1'...](https://agentprime.io/advisories/GHSA-c85c-g9wv-pph2.md) `GHSA-c85c-g9wv-pph2`, `BIT-airflow-2026-42252`, `CVE-2026-42252`, `PYSEC-2026-184` · PyPI `apache-airflow`: affected `>=3.0.0, <3.2.2`, fixed in `3.2.2` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jun 2026 · Tags: Code injection - [SourceCodester Pharmacy Sales and Inventory System main create_medicine_name cross site scripting](https://agentprime.io/advisories/CVE-2026-10244.md) `CVE-2026-10244` · CVE record: SourceCodester Pharmacy Sales and Inventory System · CVSS 5.1 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection - [Mettle sendportal Campaign webview cross site scripting](https://agentprime.io/advisories/CVE-2026-10234.md) `CVE-2026-10234` · CVE record: Mettle sendportal · CVSS 5.1 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection - [raisulislamg4 student_management_system_by_php admission_form_check.php cross site scripting](https://agentprime.io/advisories/CVE-2026-10228.md) `CVE-2026-10228` · CVE record: raisulislamg4 student_management_system_by_php · CVSS 5.1 Medium · Not analysed yet · Published 1 Jun 2026 · Tags: Cross-site scripting (XSS), Code injection - [Aider is vulnerable to Code Injection via editor_coder.run function](https://agentprime.io/advisories/GHSA-7w7m-v5vp-w699.md) `GHSA-7w7m-v5vp-w699`, `CVE-2026-10175`, `PYSEC-2026-2335` · PyPI `aider-chat`: affected `<=0.86.2`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2026 · Tags: Other injection, Code injection - [Orthanc Explorer 2 URL StudyList.vue cross site scripting](https://agentprime.io/advisories/CVE-2026-10173.md) `CVE-2026-10173` · CVE record: Orthanc Explorer 2 · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2026 · Tags: Cross-site scripting (XSS), Code injection - [westboy CicadasCMS AbstractCacheManager.java search cross site scripting](https://agentprime.io/advisories/CVE-2026-10153.md) `CVE-2026-10153` · CVE record: westboy CicadasCMS · CVSS 5.3 Medium · Not analysed yet · Published 30 May 2026 · Tags: Cross-site scripting (XSS), Code injection - [sambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard cross site scripting](https://agentprime.io/advisories/CVE-2026-10112.md) `CVE-2026-10112` · CVE record: sambitraj STUDENT-MANAGEMENT-SYSTEM · CVSS 4.8 Medium · Not analysed yet · Published 30 May 2026 · Tags: Cross-site scripting (XSS), Code injection - [PraisonAI: Arbitrary code execution via unguarded \`spec.loader.exec_module\` in \`agents_generator.py\` - sibling of CVE-2026-44334](https://agentprime.io/advisories/GHSA-78r8-wwqv-r299.md) `GHSA-78r8-wwqv-r299`, `CVE-2026-47398`, `CVE-2026-64824`, `PYSEC-2026-2905` · PyPI `praisonai`: affected `<4.6.40`, fixed in `4.6.40` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2026 · Tags: Path traversal, Code injection, CWE-829 - [FastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s\*\\(/ is bypassable](https://agentprime.io/advisories/CVE-2026-44287.md) `CVE-2026-44287` · CVE record: labring FastGPT · CVSS 6.3 Medium · Not analysed yet · Published 29 May 2026 · Tags: Code injection, CWE-184 - [amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection](https://agentprime.io/advisories/GHSA-29h4-r29x-hchv.md) `GHSA-29h4-r29x-hchv`, `CVE-2026-8838`, `PYSEC-2026-521` · PyPI `redshift-connector`: affected `<2.1.14`, fixed in `2.1.14` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2026 · Tags: Code injection - [Template injection in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-49382.md) `CVE-2026-49382` · CVE record: JetBrains IntelliJ IDEA · CVSS 4.5 Medium · Not analysed yet · Published 29 May 2026 · Tags: Code injection - [axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge](https://agentprime.io/advisories/GHSA-3g43-6gmg-66jw.md) `GHSA-3g43-6gmg-66jw`, `CVE-2026-44495` · npm `axios`: affected `>=0.19.0, <0.31.1 || >=1.0.0, <1.15.2`, fixed in `0.31.1`, `1.15.2` · CVSS 7.0 High · Not analysed yet · Published 29 May 2026 · Tags: Code injection, Broken access control, Prototype pollution - [Home Assistant: Cross-origin iframe access token exfiltration via WebView JS bridge callback injection](https://agentprime.io/advisories/CVE-2026-44698.md) `CVE-2026-44698` · CVE record: home-assistant core and 2 more · CVSS 8.3 High · Not analysed yet · Published 29 May 2026 · Tags: Code injection, CWE-346, CWE-749, CWE-940 - [Roslyn CodeLens MCP Server: Untrusted Roslyn Analyzer Execution via get_diagnostics Leads to Arbitrary Code Execution](https://agentprime.io/advisories/CVE-2026-45555.md) `CVE-2026-45555` · CVE record: MarcelRoozekrans roslyn-codelens-mcp · CVSS 7.8 High · Not analysed yet · Published 29 May 2026 · Tags: Code injection - [RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-45312.md) `CVE-2026-45312` · CVE record: infiniflow ragflow · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2026 · Tags: Code injection - [Code injection in Google Chrome](https://agentprime.io/advisories/CVE-2026-9976.md) `CVE-2026-9976` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 28 May 2026 · Tags: Code injection - [Code injection in Google Chrome](https://agentprime.io/advisories/CVE-2026-9938.md) `CVE-2026-9938` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 28 May 2026 · Tags: Code injection - [compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)](https://agentprime.io/advisories/GHSA-gg2g-p7xc-qqmm.md) `GHSA-gg2g-p7xc-qqmm`, `CVE-2026-46439`, `PYSEC-2026-2425` · PyPI `compliance-trestle`: affected `<3.12.2 || >=4.0.0, <4.0.3`, fixed in `3.12.2`, `4.0.3` · CVSS 7.8 High · Not analysed yet · Published 28 May 2026 · Tags: Code injection - [GitButler: Link injection via forge integration enables arbitrary script execution](https://agentprime.io/advisories/CVE-2026-45261.md) `CVE-2026-45261` · CVE record: gitbutlerapp gitbutler · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2026 · Tags: Code injection - [Code injection in WebPros Comet Backup](https://agentprime.io/advisories/CVE-2026-32999.md) `CVE-2026-32999` · CVE record: WebPros Comet Backup · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 May 2026 · Tags: Code injection - [Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection](https://agentprime.io/advisories/GHSA-2g95-6x5q-xjwj.md) `GHSA-2g95-6x5q-xjwj`, `CVE-2026-46621` · Maven `org.yamcs:yamcs-core`: affected `<5.12.7`, fixed in `5.12.7` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: Code injection - [Yamcs Vulnerable to Remote Code Execution via Mission Database algorithm override](https://agentprime.io/advisories/GHSA-vmwp-vh32-rj75.md) `GHSA-vmwp-vh32-rj75`, `CVE-2026-46562` · Maven `org.yamcs:yamcs-core`: affected `<5.12.7`, fixed in `5.12.7` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: Code injection - [Langroid has Prompt to SQL Injection, Leading to RCE](https://agentprime.io/advisories/GHSA-mxfr-6hcw-j9rq.md) `GHSA-mxfr-6hcw-j9rq`, `CVE-2026-25879`, `PYSEC-2026-382` · PyPI `langroid`: affected `<0.63.0`, fixed in `0.63.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: SQL injection, Code injection - [Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Path)](https://agentprime.io/advisories/CVE-2026-44887.md) `CVE-2026-44887` · CVE record: leiweibau Pi.Alert · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: Code injection - [Unauthenticated RCE via Python Config File Injection in SaveConfigFile() (Interger)](https://agentprime.io/advisories/CVE-2026-44888.md) `CVE-2026-44888` · CVE record: leiweibau Pi.Alert · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: Code injection - [LiquidJS is Vulnerable to Remote Code Execution](https://agentprime.io/advisories/GHSA-gf2q-c269-pqgc.md) `GHSA-gf2q-c269-pqgc`, `CVE-2026-45618` · npm `liquidjs`: affected `<10.26.0`, fixed in `10.26.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: Code injection - [Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders](https://agentprime.io/advisories/PKSA-yd6k-t2gh-1m43.md) `PKSA-yd6k-t2gh-1m43`, `CVE-2026-46636` · Packagist `twig/twig`: affected `>=1.0.0, <2.0.0 || >=2.0.0, <3.0.0 || >=3.0.0, <3.27.0`, fixed in `2.0.0`, `3.0.0`, `3.27.0` · CVSS 8.7 High · Not analysed yet · Published 27 May 2026 · Tags: Code injection - [affiliate-toolkit <= 3.8.5 - Authenticated (Editor+) Remote Code Execution](https://agentprime.io/advisories/CVE-2026-6169.md) `CVE-2026-6169` · CVE record: cservit affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display · CVSS 7.2 High · Not analysed yet · Published 27 May 2026 · Tags: Code injection - [WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost](https://agentprime.io/advisories/CVE-2026-8832.md) `CVE-2026-8832` · CVE record: smub WPCode – Insert Headers and Footers + Custom Code Snippets – WordPress Code Manager · CVSS 8.8 High · Not analysed yet · Published 27 May 2026 · Tags: Code injection - [IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob](https://agentprime.io/advisories/CVE-2026-48962.md) `CVE-2026-48962` · CVE record: PMQS IO::Compress · CVSS 7.3 High · Not analysed yet · Published 27 May 2026 · Tags: Code injection - [QianFox FoxCMS Administrator Backend edit cross site scripting](https://agentprime.io/advisories/CVE-2026-9608.md) `CVE-2026-9608` · CVE record: QianFox FoxCMS · CVSS 4.8 Medium · Not analysed yet · Published 27 May 2026 · Tags: Cross-site scripting (XSS), Code injection - [Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in \`JavaExprAlgorithmExecutionFactory\`](https://agentprime.io/advisories/GHSA-524g-x36v-9wm6.md) `GHSA-524g-x36v-9wm6`, `CVE-2026-44632` · Maven `org.yamcs:yamcs-core`: affected `<5.12.7`, fixed in `5.12.7` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2026 · Tags: Code injection - [An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/core/class/commonobject.class.php.](https://agentprime.io/advisories/CVE-2026-37713.md) `CVE-2026-37713` · CVE record · CVSS 7.3 High · Not analysed yet · Published 27 May 2026 · Tags: Code injection - [An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/cron/class/cronjob.class.php, call_user_func_array() in fun…](https://agentprime.io/advisories/CVE-2026-37712.md) `CVE-2026-37712` · CVE record · CVSS 7.3 High · Not analysed yet · Published 27 May 2026 · Tags: Code injection - [An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/core/actions_addupdatedelete.inc.php](https://agentprime.io/advisories/CVE-2026-37711.md) `CVE-2026-37711` · CVE record · CVSS 7.3 High · Not analysed yet · Published 27 May 2026 · Tags: Code injection - [Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints](https://agentprime.io/advisories/GHSA-86rh-h242-j8xp.md) `GHSA-86rh-h242-j8xp`, `CVE-2026-44174`, `PKSA-hhnz-p4k9-sfyd` · Packagist `getkirby/cms`: affected `<4.9.1 || >=5.0.0, <5.4.1`, fixed in `4.9.1`, `5.4.1` · CVSS 8.7 High · Not analysed yet · Published 26 May 2026 · Tags: Code injection - [FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection](https://agentprime.io/advisories/GHSA-p69w-mmfv-xrfj.md) `GHSA-p69w-mmfv-xrfj`, `CVE-2026-43945` · npm `@frangoteam/fuxa`: affected `>=1.2.11, <1.3.1`, fixed in `1.3.1` · CVSS 8.9 High · Not analysed yet · Published 26 May 2026 · Tags: Code injection, Broken access control, Authentication bypass - [ThingsBoard YAML provision getGatewayDockerComposeFile code injection](https://agentprime.io/advisories/CVE-2026-9568.md) `CVE-2026-9568` · CVE record: ThingsBoard · CVSS 2.3 Low · Not analysed yet · Published 26 May 2026 · Tags: Other injection, Code injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .