# Code injection. Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [\`datamodel-code-generator\` vulnerable to code execution on import via \`x-python-type\` JSON-Schema extension in datamodel-code-generator](https://agentprime.io/advisories/GHSA-m34r-v34r-rf9q.md) `GHSA-m34r-v34r-rf9q`, `CVE-2026-54655`, `PYSEC-2026-3562` · PyPI `datamodel-code-generator`: affected `>=0.51.0, <0.60.2`, fixed in `0.60.2` · CVSS 7.8 High · Not analysed yet · Published 28 Jul 2026 · Tags: Code injection - [Artica Proxy 4.50 Session Fixation via fw.login.php](https://agentprime.io/advisories/CVE-2026-66745.md) `CVE-2026-66745` · CVE record: ArticaTech Artica Proxy · CVSS 7.5 High · Not analysed yet · Published 28 Jul 2026 · Tags: Code injection - [Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field](https://agentprime.io/advisories/CVE-2026-66748.md) `CVE-2026-66748` · CVE record: owen2345 camaleon-cms · CVSS 8.7 High · Not analysed yet · Published 28 Jul 2026 · Tags: Code injection - [Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulnerabilities](https://agentprime.io/advisories/GHSA-4r9r-4425-74p7.md) `GHSA-4r9r-4425-74p7`, `CVE-2026-55771` · Maven `com.cedarpolicy:cedar-java`: affected `<2.3.6 || >=3.1.2, <3.4.1 || >=4.0.0, <4.9.0`, fixed in `2.3.6`, `3.4.1`, `4.9.0` · CVSS 8.8 High · Not analysed yet · Published 28 Jul 2026 · Tags: Code injection, Memory corruption, CWE-697 - [WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability](https://agentprime.io/advisories/GHSA-3pwp-g2mj-5p3v.md) `GHSA-3pwp-g2mj-5p3v`, `CVE-2026-45293`, `PKSA-mh9b-91zm-m1gy` · Packagist `wp-coding-standards/wpcs`: affected `>=0.14.1, <3.4.1`, fixed in `3.4.1` · CVSS 8.6 High · Not analysed yet · Published 28 Jul 2026 · Tags: Code injection - [Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3](https://agentprime.io/advisories/CVE-2026-65880.md) `CVE-2026-65880` · CVE record: balbooa.com Balbooa Forms component for Joomla · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jul 2026 · Tags: Code injection - [Code Injection in JSON Pointer Processing Component in Cribl Stream](https://agentprime.io/advisories/CVE-2026-56747.md) `CVE-2026-56747` · CVE record: Cribl Cribl Stream · CVSS 8.7 High · Not analysed yet · Published 27 Jul 2026 · Tags: Code injection - [vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php](https://agentprime.io/advisories/CVE-2026-61511.md) `CVE-2026-61511` · CVE record: vBulletin vBulletin · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.74 · Not analysed yet · Published 27 Jul 2026 · Tags: Code injection - [WP FacturaONE < 5.37 - Unauthenticated Remote Code Execution](https://agentprime.io/advisories/CVE-2026-14289.md) `CVE-2026-14289` · CVE record: Unknown FacturaONE para WooCommerce con VeriFactu · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jul 2026 · Tags: Code injection - [datamodel-code-generator Code Injection via Unvalidated customBasePath Schema Field](https://agentprime.io/advisories/CVE-2026-63720.md) `CVE-2026-63720` · CVE record: koxudaxi datamodel-code-generator · CVSS 7.5 High · Not analysed yet · Published 26 Jul 2026 · Tags: Code injection - [Oh My Posh: Arbitrary command execution via template injection in the path segment](https://agentprime.io/advisories/GHSA-6xj8-qv9j-xcjq.md) `GHSA-6xj8-qv9j-xcjq`, `CVE-2026-73505`, `GO-2026-6108` · Go `github.com/jandedobbeleer/oh-my-posh`: affected `<29.35.1`, fixed in `29.35.1` · CVSS 7.8 High · Not analysed yet · Published 24 Jul 2026 · Tags: Code injection - [NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute ...](https://agentprime.io/advisories/GHSA-848c-c2cx-j7qx.md) `GHSA-848c-c2cx-j7qx`, `CVE-2025-71408`, `PYSEC-2026-3657` · PyPI `nltk`: affected `<3.9.3`, fixed in `3.9.3` · CVSS 8.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Code injection - [OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback](https://agentprime.io/advisories/GHSA-wg5r-wc3x-39vc.md) `GHSA-wg5r-wc3x-39vc`, `CVE-2026-62379` · Maven `org.openidentityplatform.openam:openam-core`: affected `<16.1.2`, fixed in `16.1.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: Code injection - [Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id](https://agentprime.io/advisories/GHSA-74h3-cxq7-vc5q.md) `GHSA-74h3-cxq7-vc5q`, `CVE-2026-59216`, `PYSEC-2026-3592` · PyPI `open-webui`: affected `<0.10.0`, fixed in `0.10.0` · CVSS 7.7 High · Not analysed yet · Published 24 Jul 2026 · Tags: Code injection, Information disclosure, Broken access control - [Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer](https://agentprime.io/advisories/GHSA-w28w-gp39-m4p6.md) `GHSA-w28w-gp39-m4p6`, `CVE-2026-73299` · npm `@prompty/core`: affected `<0.1.5 || >=2.0.0-alpha.1, <2.0.0-beta.5`, fixed in `0.1.5`, `2.0.0-beta.5` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: Code injection - [Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)](https://agentprime.io/advisories/GHSA-7gfh-x38p-prh3.md) `GHSA-7gfh-x38p-prh3`, `CVE-2026-73649` · npm `velocityjs`: affected `<2.1.7`, fixed in `2.1.7` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: Code injection - [Microsoft Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName](https://agentprime.io/advisories/GHSA-4vv7-jj25-4gh6.md) `GHSA-4vv7-jj25-4gh6`, `CVE-2026-59866` · NuGet `Microsoft.OpenApi.Kiota` and 1 more: affected `<1.29.1 || >=1.30.0, <1.32.5`, fixed in `1.29.1`, `1.32.5` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: Path traversal, Code injection - [Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by \`kiota info\`](https://agentprime.io/advisories/GHSA-hq9q-27g5-qwpj.md) `GHSA-hq9q-27g5-qwpj`, `CVE-2026-59865` · NuGet `Microsoft.OpenApi.Kiota` and 1 more: affected `<1.29.1 || >=1.30.0, <1.32.5`, fixed in `1.29.1`, `1.32.5` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: Code injection, CWE-829 - [Ray: Arbitrary code execution via ray.data.read_webdataset default decoder: pickle.loads(value) and torch.load(weights_only=False)](https://agentprime.io/advisories/GHSA-hhrp-gw25-jr43.md) `GHSA-hhrp-gw25-jr43`, `CVE-2026-57516`, `PYSEC-2026-2273` · PyPI `ray`: affected `<2.56.0`, fixed in `2.56.0` · CVSS 8.6 High · Not analysed yet · Published 24 Jul 2026 · Tags: Code injection, Insecure deserialization - [Microsoft Kiota: Code Generation Literal Injection in Kiota PHP Generator](https://agentprime.io/advisories/GHSA-jqwh-526h-c92j.md) `GHSA-jqwh-526h-c92j`, `CVE-2026-59859` · NuGet `Microsoft.OpenApi.Kiota` and 1 more: affected `<1.29.1 || >=1.30.0, <1.32.4`, fixed in `1.29.1`, `1.32.4` · CVSS 8.7 High · Not analysed yet · Published 24 Jul 2026 · Tags: Code injection - [Microsoft Kiota: Code Generation Literal Injection in Kiota Python Generator](https://agentprime.io/advisories/GHSA-7f3j-j7jj-r3vr.md) `GHSA-7f3j-j7jj-r3vr`, `CVE-2026-59862` · NuGet `Microsoft.OpenAPI.Kiota` and 1 more: affected `<1.29.1 || >=1.30.0, <1.32.0`, fixed in `1.29.1`, `1.32.0` · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Code injection - [Microsoft Kiota: Code Generation Literal Injection in Kiota Ruby Generator](https://agentprime.io/advisories/GHSA-xg2h-5xr2-29jw.md) `GHSA-xg2h-5xr2-29jw`, `CVE-2026-59861` · NuGet `Microsoft.OpenAPI.Kiota` and 1 more: affected `<1.29.1 || >=1.30.0, <1.32.0`, fixed in `1.29.1`, `1.32.0` · CVSS 7.5 High · Not analysed yet · Published 24 Jul 2026 · Tags: Code injection - [Microweber CMS 2.0.20 Server-Side Template Injection via Mail Templates](https://agentprime.io/advisories/CVE-2026-65693.md) `CVE-2026-65693` · CVE record: microweber microweber · CVSS 8.6 High · Not analysed yet · Published 24 Jul 2026 · Tags: Code injection - [Microsoft Kiota: XML Doc-Comment Newline Breakout Code Injection](https://agentprime.io/advisories/GHSA-3hrf-2gc2-mx32.md) `GHSA-3hrf-2gc2-mx32`, `CVE-2026-59860` · NuGet `Microsoft.OpenApi.Kiota` and 1 more: affected `<1.29.1 || >=1.30.0, <1.32.3`, fixed in `1.29.1`, `1.32.3` · CVSS 8.7 High · Not analysed yet · Published 24 Jul 2026 · Tags: Code injection - [Code injection in Devolutions PowerShell Universal](https://agentprime.io/advisories/CVE-2026-16801.md) `CVE-2026-16801` · CVE record: Devolutions PowerShell Universal · CVSS 8.8 High · Not analysed yet · Published 24 Jul 2026 · Tags: Code injection - [Code injection in Devolutions PowerShell Universal](https://agentprime.io/advisories/CVE-2026-16800.md) `CVE-2026-16800` · CVE record: Devolutions PowerShell Universal · CVSS 8.8 High · Not analysed yet · Published 24 Jul 2026 · Tags: Code injection - [Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML](https://agentprime.io/advisories/CVE-2026-63317.md) `CVE-2026-63317` · CVE record: Apache Software Foundation Apache OpenNLP · CVSS 5.6 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Code injection - [Cal.com before 5.9.9 Remote Code Execution via RSC](https://agentprime.io/advisories/CVE-2025-71389.md) `CVE-2025-71389` · CVE record: calcom cal.diy · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: Code injection - [React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration](https://agentprime.io/advisories/GHSA-337j-9hxr-rhxg.md) `GHSA-337j-9hxr-rhxg`, `CVE-2026-53666` · npm `react-router`: affected `>=6.4.0, <7.18.0`, fixed in `7.18.0` · CVSS 6.1 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: Code injection - [gpsd gpsprof Code Injection via SKY.satellites used Field](https://agentprime.io/advisories/CVE-2026-60122.md) `CVE-2026-60122` · CVE record: gpsd gpsd · CVSS 8.5 High · Not analysed yet · Published 23 Jul 2026 · Tags: Code injection - [Tugtainer has Server-Side Template Injection in notification templates that leads to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-47752.md) `CVE-2026-47752` · CVE record: Quenary tugtainer · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: Code injection - [Duplicate Advisory: Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation](https://agentprime.io/advisories/GHSA-pp9r-ppc4-25w4.md) `GHSA-pp9r-ppc4-25w4` · Packagist `getgrav/grav`: affected `>=1.7.0`, no fixed version yet · CVSS 8.8 High · Withdrawn · Not analysed yet · Published 23 Jul 2026 · Tags: Code injection - [Code injection in JetBrains TeamCity](https://agentprime.io/advisories/CVE-2026-65907.md) `CVE-2026-65907` · CVE record: JetBrains TeamCity · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: Code injection - [Code injection in JetBrains TeamCity](https://agentprime.io/advisories/CVE-2026-65906.md) `CVE-2026-65906` · CVE record: JetBrains TeamCity · CVSS 8.8 High · Not analysed yet · Published 23 Jul 2026 · Tags: Code injection - [Code injection in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2026-64815.md) `CVE-2026-64815` · CVE record: JetBrains IntelliJ IDEA · CVSS 8.1 High · Not analysed yet · Published 23 Jul 2026 · Tags: Code injection - [Code injection in JetBrains GoLand](https://agentprime.io/advisories/CVE-2026-64803.md) `CVE-2026-64803` · CVE record: JetBrains GoLand · CVSS 7.8 High · Not analysed yet · Published 23 Jul 2026 · Tags: Code injection - [Code injection in JetBrains GoLand](https://agentprime.io/advisories/CVE-2026-64802.md) `CVE-2026-64802` · CVE record: JetBrains GoLand · CVSS 7.8 High · Not analysed yet · Published 23 Jul 2026 · Tags: Code injection - [WordPress Advanced Views plugin <= 3.8.11 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-59543.md) `CVE-2026-59543` · CVE record: WPLake Advanced Views · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: Code injection - [Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter](https://agentprime.io/advisories/CVE-2026-15011.md) `CVE-2026-15011` · CVE record: emarket-design Customer Support Ticket System & Helpdesk · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: Code injection - [An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mechanism](https://agentprime.io/advisories/CVE-2026-52439.md) `CVE-2026-52439` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2026 · Tags: Code injection - [LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks](https://agentprime.io/advisories/GHSA-72m8-9m7m-h278.md) `GHSA-72m8-9m7m-h278`, `CVE-2026-59821`, `PYSEC-2026-3478` · PyPI `litellm`: affected `<1.82.0`, fixed in `1.82.0` · CVSS 2.1 Low · Not analysed yet · Published 22 Jul 2026 · Tags: Code injection - [n8n: Expression sandbox escape via arrow-function bodies enabling command execution](https://agentprime.io/advisories/GHSA-gv7g-jm28-cr3m.md) `GHSA-gv7g-jm28-cr3m`, `CVE-2026-72765` · npm `n8n`: affected `<2.31.5 || >=2.32.0, <2.32.1`, fixed in `2.31.5`, `2.32.1` · CVSS 8.7 High · Not analysed yet · Published 22 Jul 2026 · Tags: Code injection - [n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution](https://agentprime.io/advisories/GHSA-pm35-fqvh-cq5g.md) `GHSA-pm35-fqvh-cq5g`, `CVE-2026-65591` · npm `n8n`: affected `<1.123.64 || >=2.0.0-rc.0, <2.29.8 || >=2.30.0, <2.30.1`, fixed in `1.123.64`, `2.29.8`, `2.30.1` · CVSS 8.9 High · Not analysed yet · Published 22 Jul 2026 · Tags: Code injection - [Unauthenticated remote code execution (pre-auth RCE) vulnerability in openFT for Linux and Oracle Solaris](https://agentprime.io/advisories/CVE-2026-16606.md) `CVE-2026-16606` · CVE record: Fujitsu Linux openFT and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2026 · Tags: Code injection - [DialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAX](https://agentprime.io/advisories/CVE-2026-13187.md) `CVE-2026-13187` · CVE record: Progress Software Telerik UI for ASP.NET AJAX · CVSS 8.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Code injection - [RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX](https://agentprime.io/advisories/CVE-2026-13181.md) `CVE-2026-13181` · CVE record: Progress Software Telerik UI for ASP.NET AJAX · CVSS 8.1 High · Not analysed yet · Published 22 Jul 2026 · Tags: Code injection - [Duplicate Advisory: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution](https://agentprime.io/advisories/GHSA-m7jc-p4hf-xhwq.md) `GHSA-m7jc-p4hf-xhwq` · npm `n8n`: affected `*`, no fixed version yet · CVSS 4.0, no score published · Withdrawn · Not analysed yet · Published 22 Jul 2026 · Tags: Code injection - [Contact Form 7 – Dynamic Text Extension <= 5.0.7 - Unauthenticated Arbitrary Shortcode Execution](https://agentprime.io/advisories/CVE-2025-13146.md) `CVE-2025-13146` · CVE record: sevenspark DTX – Dynamic Text Extension for Contact Form 7 · CVSS 6.5 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: Code injection - [SourceCodester Class and Exam Timetabling System BSIS.php cross site scripting](https://agentprime.io/advisories/CVE-2026-16486.md) `CVE-2026-16486` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 5.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Cross-site scripting (XSS), Code injection - [SourceCodester Class and Exam Timetabling System class.php cross site scripting](https://agentprime.io/advisories/CVE-2026-16485.md) `CVE-2026-16485` · CVE record: SourceCodester Class and Exam Timetabling System · CVSS 5.3 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Cross-site scripting (XSS), Code injection - [TypeORM: migration:generate template-literal code injection](https://agentprime.io/advisories/GHSA-2rp8-mm9q-fp49.md) `GHSA-2rp8-mm9q-fp49`, `CVE-2026-73651` · npm `typeorm`: affected `<0.3.31 || >=1.0.0, <1.1.0`, fixed in `0.3.31`, `1.1.0` · CVSS 5.7 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Code injection - [Unauthenticated RCE](https://agentprime.io/advisories/CVE-2026-8984.md) `CVE-2026-8984` · CVE record: Autel MaxiCharger Single · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jul 2026 · Tags: Code injection - [MeltanoHub vulnerable to command injection in the \`test_dispatcher\` GitHub Actions workflow](https://agentprime.io/advisories/CVE-2026-47690.md) `CVE-2026-47690` · CVE record: meltano hub · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2026 · Tags: Command injection, Code injection - [Code injection in Atlassian Sourcetree for Mac](https://agentprime.io/advisories/CVE-2026-21575.md) `CVE-2026-21575` · CVE record: Atlassian Sourcetree for Mac · CVSS 7.1 High · Not analysed yet · Published 21 Jul 2026 · Tags: Code injection - [Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability](https://agentprime.io/advisories/GHSA-2969-4q4w-w5h3.md) `GHSA-2969-4q4w-w5h3`, `BIT-dotnet-2026-50650`, `BIT-dotnet-sdk-2026-50650`, `CVE-2026-50650` · NuGet `Microsoft.WindowsDesktop.App.Runtime.win-arm64` and 2 more: affected `>=8.0.0, <8.0.29 || >=9.0.0, <9.0.18 || >=10.0.0, <10.0.10`, fixed in `8.0.29`, `9.0.18`, `10.0.10` · CVSS 7.8 High · Not analysed yet · Published 21 Jul 2026 · Tags: Code injection - [Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature](https://agentprime.io/advisories/CVE-2026-63728.md) `CVE-2026-63728` · CVE record: gitleaks gitleaks · CVSS 8.1 High · Not analysed yet · Published 20 Jul 2026 · Tags: Code injection - [Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1](https://agentprime.io/advisories/CVE-2026-60026.md) `CVE-2026-60026` · CVE record: themexpert.com Quix Page Builder Pro extension for Joomla · CVSS 8.9 High · Not analysed yet · Published 20 Jul 2026 · Tags: Code injection - [Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR](https://agentprime.io/advisories/CVE-2026-64193.md) `CVE-2026-64193` · CVE record: NLNETLABS Net::DNS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jul 2026 · Tags: Code injection - [An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute arbitrary code via a crafted FEX file](https://agentprime.io/advisories/CVE-2026-52656.md) `CVE-2026-52656` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jul 2026 · Tags: Code injection - [An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code via the validate_url, safe_fetch, \_build_opener, \_fetch_html and \_download_binar…](https://agentprime.io/advisories/CVE-2026-51385.md) `CVE-2026-51385` · CVE record · CVSS 6.9 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Code injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .