# Code injection. Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-57811.md) `CVE-2026-57811` · CVE record: Realtyna Realtyna Organic IDX plugin · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jul 2026 · Tags: Code injection - [A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets](https://agentprime.io/advisories/CVE-2026-14453.md) `CVE-2026-14453` · CVE record: Centreon Infra Monitoring · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jul 2026 · Tags: Code injection - [primefaces primereact API ObjectUtils.js ObjectUtils.mutateFieldData prototype pollution](https://agentprime.io/advisories/CVE-2026-15538.md) `CVE-2026-15538` · CVE record: primefaces primereact · CVSS 5.3 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Code injection, Prototype pollution - [DedeCMS Column Management search.php code injection](https://agentprime.io/advisories/CVE-2026-15533.md) `CVE-2026-15533` · CVE record: DedeCMS · CVSS 5.1 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Other injection, Code injection - [SourceCodester Online Book Store System User Management cross site scripting](https://agentprime.io/advisories/CVE-2026-15532.md) `CVE-2026-15532` · CVE record: SourceCodester Online Book Store System · CVSS 4.8 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Cross-site scripting (XSS), Code injection - [pig-mesh Pig pig-codegen GeneratorServiceImpl.java code injection](https://agentprime.io/advisories/CVE-2026-15512.md) `CVE-2026-15512` · CVE record: pig-mesh Pig · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Other injection, Code injection - [vnotex vnote YAML Frontmatter markdownit.js cross site scripting](https://agentprime.io/advisories/CVE-2026-15505.md) `CVE-2026-15505` · CVE record: vnotex vnote · CVSS 5.1 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Cross-site scripting (XSS), Code injection - [SonicCloudOrg sonic-agent JWT Authentication Filter ExchangeController.java code injection](https://agentprime.io/advisories/CVE-2026-15497.md) `CVE-2026-15497` · CVE record: SonicCloudOrg sonic-agent · CVSS 6.9 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Other injection, Code injection - [Akpali9 Attendance-Management-System absent.php cross site scripting](https://agentprime.io/advisories/CVE-2026-15493.md) `CVE-2026-15493` · CVE record: Akpali9 Attendance-Management-System · CVSS 5.1 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Cross-site scripting (XSS), Code injection - [igweze wizgrade studentConductManager.php cross site scripting](https://agentprime.io/advisories/CVE-2026-15492.md) `CVE-2026-15492` · CVE record: igweze wizgrade · CVSS 5.3 Medium · Not analysed yet · Published 12 Jul 2026 · Tags: Cross-site scripting (XSS), Code injection - [Duplicate Advisory: PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets](https://agentprime.io/advisories/GHSA-mhgx-w3w5-2rvc.md) `GHSA-mhgx-w3w5-2rvc` · PyPI `praisonai`: affected `<=1.6.77`, no fixed version yet · CVSS 10.0 Critical · Withdrawn · Not analysed yet · Published 11 Jul 2026 · Tags: Code injection - [WP Ultimate CSV Importer <= 8.0.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'MappedFields' Parameter](https://agentprime.io/advisories/CVE-2026-13353.md) `CVE-2026-13353` · CVE record: smackcoders WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel · CVSS 8.8 High · Not analysed yet · Published 11 Jul 2026 · Tags: Code injection - [Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC](https://agentprime.io/advisories/CVE-2026-40008.md) `CVE-2026-40008` · CVE record: Apache Software Foundation Apache IoTDB · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jul 2026 · Tags: Code injection - [MyEMS Admin Backend svg.py on_post cross site scripting](https://agentprime.io/advisories/CVE-2026-15321.md) `CVE-2026-15321` · CVE record: MyEMS · CVSS 4.8 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Cross-site scripting (XSS), Code injection - [NousResearch hermes-agent Matrix Adapter matrix.py MatrixAdapter.\_markdown_to_html cross site scripting](https://agentprime.io/advisories/CVE-2026-15311.md) `CVE-2026-15311` · CVE record: NousResearch hermes-agent · CVSS 5.1 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Cross-site scripting (XSS), Code injection - [Vim: Arbitrary Code Execution via PHP Omni-Completion](https://agentprime.io/advisories/CVE-2026-59856.md) `CVE-2026-59856` · CVE record: vim vim · CVSS 8.4 High · Not analysed yet · Published 9 Jul 2026 · Tags: Code injection - [Vim: Arbitrary Code Execution via C Omni-Completion](https://agentprime.io/advisories/CVE-2026-59858.md) `CVE-2026-59858` · CVE record: vim vim · CVSS 8.4 High · Not analysed yet · Published 9 Jul 2026 · Tags: Code injection - [SiYuan: Stored XSS to RCE in SiYuan via a per-attribute URL-scheme sanitizer gap in Lute (form action / SVG xlink:href)](https://agentprime.io/advisories/CVE-2026-59833.md) `CVE-2026-59833` · CVE record: siyuan-note siyuan · CVSS 8.6 High · Not analysed yet · Published 9 Jul 2026 · Tags: Cross-site scripting (XSS), Code injection, CWE-116 - [YesWiki has Unsafe eval() in its Formula Calculato, Leading to Remote Code Execution & Denial of Service](https://agentprime.io/advisories/GHSA-px5m-h76g-p7p8.md) `GHSA-px5m-h76g-p7p8`, `CVE-2026-52778`, `PKSA-hr3h-z8mz-dxgy` · Packagist `yeswiki/yeswiki`: affected `<4.6.6`, fixed in `4.6.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jul 2026 · Tags: Code injection, Denial of service - [YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates](https://agentprime.io/advisories/GHSA-65p8-9433-jpcp.md) `GHSA-65p8-9433-jpcp`, `CVE-2026-52762`, `PKSA-yfkg-9hwq-f446` · Packagist `yeswiki/yeswiki`: affected `<4.6.6`, fixed in `4.6.6` · CVSS 7.1 High · Not analysed yet · Published 9 Jul 2026 · Tags: Code injection - [Metabase: Arbitrary Code Execution via Database Connection Detail Bypass](https://agentprime.io/advisories/CVE-2026-59826.md) `CVE-2026-59826` · CVE record: metabase metabase · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jul 2026 · Tags: Code injection - [YzmCMS Header yzmphp.php get_url cross site scripting](https://agentprime.io/advisories/CVE-2026-15202.md) `CVE-2026-15202` · CVE record: YzmCMS · CVSS 5.3 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Cross-site scripting (XSS), Code injection - [apidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution](https://agentprime.io/advisories/CVE-2026-15195.md) `CVE-2026-15195` · CVE record: apidevtools json-schema-ref-parser · CVSS 5.3 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Code injection, Prototype pollution - [enquirer Public Package API Enquirer.set prototype pollution](https://agentprime.io/advisories/CVE-2026-15187.md) `CVE-2026-15187` · CVE record: enquirer · CVSS 5.3 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Code injection, Prototype pollution - [Craft CMS: RCE via missing cleanseConfig in FieldsController::actionRenderCardPreview](https://agentprime.io/advisories/GHSA-86vw-x4ww-x467.md) `GHSA-86vw-x4ww-x467`, `CVE-2026-56382`, `PKSA-r87g-h2pd-9vq1` · Packagist `craftcms/cms`: affected `>=5.5.0, <5.9.14`, fixed in `5.9.14` · CVSS 8.6 High · Not analysed yet · Published 9 Jul 2026 · Tags: Code injection - [OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260401.0, the OpenCTI GraphQL API exposes a script filter operator in its FilterOpera...](https://agentprime.io/advisories/GHSA-qpp6-p693-rmm4.md) `GHSA-qpp6-p693-rmm4`, `CVE-2026-35211`, `PYSEC-2026-3446` · PyPI `pycti`: affected `<7.260401.0`, fixed in `7.260401.0` · CVSS 6.5 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Code injection, Broken access control - [DSpace has possible Remote Code Execution (RCE) through Velocity Templates used by LDN](https://agentprime.io/advisories/GHSA-9x82-rm84-c6x7.md) `GHSA-9x82-rm84-c6x7`, `CVE-2026-49832` · Maven `org.dspace:dspace-api`: affected `>=8.0-rc1, <8.4 || >=9.0-rc1, <9.3 || >=10.0-rc1, <10.0`, fixed in `8.4`, `9.3`, `10.0` · CVSS 8.0 High · Not analysed yet · Published 8 Jul 2026 · Tags: Code injection - [An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API endpoint in MifiService.apk](https://agentprime.io/advisories/CVE-2026-52200.md) `CVE-2026-52200` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jul 2026 · Tags: Code injection - [DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile](https://agentprime.io/advisories/CVE-2026-14380.md) `CVE-2026-14380` · CVE record · CVSS 8.8 High · Not analysed yet · Published 7 Jul 2026 · Tags: Code injection - [Koodo Reader: Remote code execution via malicious epub file](https://agentprime.io/advisories/CVE-2026-55408.md) `CVE-2026-55408` · CVE record: koodo-reader koodo-reader · CVSS 8.4 High · Not analysed yet · Published 7 Jul 2026 · Tags: Code injection - [calibre: Arbitrary Code Execution in Template Formatter via Book Metadata](https://agentprime.io/advisories/CVE-2026-53511.md) `CVE-2026-53511` · CVE record: kovidgoyal calibre · CVSS 8.5 High · Not analysed yet · Published 7 Jul 2026 · Tags: Code injection - [DataEase: H2 JDBC URL Filter Bypass Leads to Remote Code Execution (RCE)](https://agentprime.io/advisories/CVE-2026-53751.md) `CVE-2026-53751` · CVE record: dataease dataease · CVSS 8.7 High · Not analysed yet · Published 7 Jul 2026 · Tags: Code injection - [EGroupware has Authenticated RCE via Malicious eTemplate Upload](https://agentprime.io/advisories/GHSA-8737-2x9g-xjj7.md) `GHSA-8737-2x9g-xjj7`, `CVE-2026-40187`, `PKSA-s1pv-qcq4-r5jv` · Packagist `egroupware/egroupware`: affected `<23.1.20260601 || >=26.0.20251208, <26.4.20260413`, fixed in `23.1.20260601`, `26.4.20260413` · CVSS 8.6 High · Not analysed yet · Published 7 Jul 2026 · Tags: Command injection, Code injection - [EGroupware has a Remote Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-h9qx-v5xp-ph8p.md) `GHSA-h9qx-v5xp-ph8p`, `CVE-2026-27823`, `PKSA-3pf5-qtx8-njsg` · Packagist `egroupware/egroupware`: affected `<23.1.20260224 || >=26.0.20251208, <26.2.20260224`, fixed in `23.1.20260224`, `26.2.20260224` · CVSS 8.7 High · Not analysed yet · Published 7 Jul 2026 · Tags: Path traversal, Code injection, Broken access control - [FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization](https://agentprime.io/advisories/CVE-2026-43921.md) `CVE-2026-43921` · CVE record: FOSSBilling FOSSBilling · CVSS 8.9 High · Not analysed yet · Published 6 Jul 2026 · Tags: Code injection - [Craft CMS: Potential authenticated Remote Code Execution via referrer redirect](https://agentprime.io/advisories/GHSA-f74w-488g-8x5r.md) `GHSA-f74w-488g-8x5r`, `CVE-2026-55794`, `PKSA-hvdm-8k9p-kcdw` · Packagist `craftcms/cms`: affected `>=5.9.0, <5.10.0`, fixed in `5.10.0` · CVSS 8.7 High · Not analysed yet · Published 6 Jul 2026 · Tags: Code injection - [Langroid: Sandbox Escape to Remote Code Execution via Incomplete \`eval()\` Mitigation in TableChatAgent](https://agentprime.io/advisories/GHSA-q9p7-wqxg-mrhc.md) `GHSA-q9p7-wqxg-mrhc`, `CVE-2026-54769`, `PYSEC-2026-2581` · PyPI `langroid`: affected `<0.65.2`, fixed in `0.65.2` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: Code injection - [Formie Hidden field defaults vulnerable to Server-Side Template Injection](https://agentprime.io/advisories/GHSA-565m-g33j-jq96.md) `GHSA-565m-g33j-jq96`, `CVE-2026-52889`, `PKSA-rm1g-8q6b-7djk` · Packagist `verbb/formie`: affected `<3.1.27`, fixed in `3.1.27` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: Code injection - [Code injection in WebPros Plesk](https://agentprime.io/advisories/CVE-2026-48614.md) `CVE-2026-48614` · CVE record: WebPros Plesk · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: Code injection - [crater-invoice-inc crater Invoice Note InvoicesRequest.php getFormattedString cross site scripting](https://agentprime.io/advisories/CVE-2026-14791.md) `CVE-2026-14791` · CVE record: crater-invoice-inc crater · CVSS 5.1 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Cross-site scripting (XSS), Code injection - [mjperpinosa stumasy add_into_dictionary.php add_definition cross site scripting](https://agentprime.io/advisories/CVE-2026-14752.md) `CVE-2026-14752` · CVE record: mjperpinosa stumasy · CVSS 5.1 Medium · Not analysed yet · Published 5 Jul 2026 · Tags: Cross-site scripting (XSS), Code injection - [mjperpinosa stumasy calculate.php eval code injection](https://agentprime.io/advisories/CVE-2026-14749.md) `CVE-2026-14749` · CVE record: mjperpinosa stumasy · CVSS 6.9 Medium · Not analysed yet · Published 5 Jul 2026 · Tags: Other injection, Code injection - [stephen-kruger bluebox cross site scripting](https://agentprime.io/advisories/CVE-2026-14704.md) `CVE-2026-14704` · CVE record: stephen-kruger bluebox · CVSS 5.3 Medium · Not analysed yet · Published 5 Jul 2026 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Multi-Vendor Online Grocery Management System Setting SystemSettings.php update_settings_info code injection](https://agentprime.io/advisories/CVE-2026-14691.md) `CVE-2026-14691` · CVE record: SourceCodester Multi-Vendor Online Grocery Management System · CVSS 5.3 Medium · Not analysed yet · Published 5 Jul 2026 · Tags: Other injection, Code injection - [code-projects Assessment Management remove-user.php cross site scripting](https://agentprime.io/advisories/CVE-2026-14656.md) `CVE-2026-14656` · CVE record: code-projects Assessment Management · CVSS 5.3 Medium · Not analysed yet · Published 4 Jul 2026 · Tags: Cross-site scripting (XSS), Code injection - [code-projects Assessment Management view-users.php cross site scripting](https://agentprime.io/advisories/CVE-2026-14655.md) `CVE-2026-14655` · CVE record: code-projects Assessment Management · CVSS 4.8 Medium · Not analysed yet · Published 4 Jul 2026 · Tags: Cross-site scripting (XSS), Code injection - [kirilkirkov Ecommerce-CodeIgniter-Bootstrap Subscribed Emails Admin MY_Controller.php checkForPostRequests cross site scripting](https://agentprime.io/advisories/CVE-2026-14634.md) `CVE-2026-14634` · CVE record: kirilkirkov Ecommerce-CodeIgniter-Bootstrap · CVSS 5.3 Medium · Not analysed yet · Published 4 Jul 2026 · Tags: Cross-site scripting (XSS), Code injection - [kirilkirkov Ecommerce-CodeIgniter-Bootstrap Hidden REST API Endpoint set cross site scripting](https://agentprime.io/advisories/CVE-2026-14633.md) `CVE-2026-14633` · CVE record: kirilkirkov Ecommerce-CodeIgniter-Bootstrap · CVSS 5.3 Medium · Not analysed yet · Published 4 Jul 2026 · Tags: Cross-site scripting (XSS), Code injection - [In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger, StanfordParser, StanfordDependencyParser, and StanfordNeuralDependencyParser) are vul...](https://agentprime.io/advisories/GHSA-9r6g-266r-89x4.md) `GHSA-9r6g-266r-89x4`, `CVE-2026-12252`, `PYSEC-2026-2085` · PyPI `nltk`: affected `<3.9.4`, fixed in `3.9.4` · CVSS 7.8 High · Not analysed yet · Published 4 Jul 2026 · Tags: Code injection - [CURCY <= 2.2.14 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter](https://agentprime.io/advisories/CVE-2026-11778.md) `CVE-2026-11778` · CVE record: villatheme CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x · CVSS 5.4 Medium · Not analysed yet · Published 3 Jul 2026 · Tags: Code injection - [Mautic has Server-Side Template Injection (SSTI) in Theme Templates](https://agentprime.io/advisories/GHSA-9fx4-7cmj-47vg.md) `GHSA-9fx4-7cmj-47vg`, `CVE-2026-9558`, `PKSA-5wpq-7gbm-cqxv` · Packagist `mautic/core`: affected `>=1.3.0 || >=5.0.0, <5.2.11 || >=6.0.0, <6.0.9 || >=7.0.0, <7.1.2`, fixed in `5.2.11`, `6.0.9`, `7.1.2` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jul 2026 · Tags: Code injection - [OpenClaw's marketplace runtime extension metadata could point at unscanned payloads](https://agentprime.io/advisories/GHSA-v6r2-jh58-xx6w.md) `GHSA-v6r2-jh58-xx6w`, `CVE-2026-53810` · npm `openclaw`: affected `<2026.5.18`, fixed in `2026.5.18` · CVSS 7.7 High · Not analysed yet · Published 2 Jul 2026 · Tags: Command injection, Code injection, Broken access control, CWE-829 - [WordPress Blocksy Companion Pro plugin <= 2.1.46 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-57624.md) `CVE-2026-57624` · CVE record: Creative Themes Blocksy Companion Pro · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jul 2026 · Tags: Code injection - [WordPress Five Star Business Profile and Schema plugin <= 2.3.19 - Arbitrary Code Execution vulnerability](https://agentprime.io/advisories/CVE-2026-27436.md) `CVE-2026-27436` · CVE record: Rustaurius Five Star Business Profile and Schema · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jul 2026 · Tags: Code injection - [Path Traversal in Altium Git Service Allows Remote Code Execution](https://agentprime.io/advisories/CVE-2026-14439.md) `CVE-2026-14439` · CVE record: Altium Altium Enterprise Server and 1 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: Path traversal, Code injection - [Buffer overflow in Google Chrome](https://agentprime.io/advisories/CVE-2026-14407.md) `CVE-2026-14407` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 1 Jul 2026 · Tags: Code injection, Memory corruption - [Buffer overflow in Google Chrome](https://agentprime.io/advisories/CVE-2026-14383.md) `CVE-2026-14383` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 1 Jul 2026 · Tags: Code injection, Memory corruption - [Rancher vulnerable to command injection through unsanitized YAML parameter](https://agentprime.io/advisories/GHSA-mhc6-2gfq-xx62.md) `GHSA-mhc6-2gfq-xx62`, `CVE-2026-44939`, `GO-2026-5875` · Go `github.com/rancher/rancher`: affected `<0.0.0-20260617231817-2aa77eb283e7 || >=2.10.0, <2.10.12 || >=2.11.0, <2.11.14 || >=2.12.0, <2.12.10 || >=2.13.0, <2.13.6 || >=2.14.0, <2.14.2`, fixed in `0.0.0-20260617231817-2aa77eb283e7`, `2.10.12`, `2.11.14`, `2.12.10`, `2.13.6`, `2.14.2` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: Code injection - [Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached \`Template\`](https://agentprime.io/advisories/GHSA-529h-vh3j-85hq.md) `GHSA-529h-vh3j-85hq`, `CVE-2026-46636`, `CVE-2026-49981`, `PKSA-8zx5-v2nz-58pb` · Packagist `twig/twig`: affected `<3.27.0`, fixed in `3.27.0` · CVSS 8.7 High · Not analysed yet · Published 1 Jul 2026 · Tags: Broken access control, Code injection, CWE-693 - [GeoNetwork has reflected XSS through client-side template injection](https://agentprime.io/advisories/GHSA-2v4m-fw6c-g78f.md) `GHSA-2v4m-fw6c-g78f`, `CVE-2026-39379` · Maven `org.geonetwork-opensource:geonetwork`: affected `>=3.0.0, <=3.12.12 || >=4.0.0-alpha.1, <=4.0.6 || >=4.2.0, <4.2.15 || >=4.4.0, <4.4.10`, fixed in `4.2.15`, `4.4.10` · CVSS 7.1 High · Not analysed yet · Published 1 Jul 2026 · Tags: Cross-site scripting (XSS), Code injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .