# Code injection.

Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [itsourcecode Online Medicine Delivery System index.php cross site scripting](https://agentprime.io/advisories/CVE-2026-85207.md)
  `CVE-2026-85207` · CVE record: itsourcecode Online Medicine Delivery System · CVSS 5.1 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Orval: RCE via servers\[\].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)](https://agentprime.io/advisories/GHSA-88f2-fpv8-89q2.md)
  `GHSA-88f2-fpv8-89q2`, `CVE-2026-62682` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection, CWE-116
- [Orval: Import-time RCE via schema default -> zod module-level template literal](https://agentprime.io/advisories/GHSA-w727-8j6c-2rj4.md)
  `GHSA-w727-8j6c-2rj4`, `CVE-2026-72717` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection, CWE-116
- [Orval: Import-time RCE via array-items default -> zod module-level template literal](https://agentprime.io/advisories/GHSA-2h9g-j24r-h63g.md)
  `GHSA-2h9g-j24r-h63g`, `CVE-2026-71869` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection, CWE-116
- [Improper Control of Generation of Code in Kibana Leading to Privilege Escalation](https://agentprime.io/advisories/CVE-2026-78593.md)
  `CVE-2026-78593` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection
- [Orval: Import-time RCE via header-parameter default -> zod module-level template literal](https://agentprime.io/advisories/GHSA-8j6p-r8jg-mxqh.md)
  `GHSA-8j6p-r8jg-mxqh`, `CVE-2026-71871` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection, CWE-116
- [Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator](https://agentprime.io/advisories/GHSA-2w86-xfrc-g85r.md)
  `GHSA-2w86-xfrc-g85r`, `CVE-2026-71867` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: SQL injection, Code injection
- [Orval: Import-time RCE via enum-typed default -> zod module-level template literal](https://agentprime.io/advisories/GHSA-3575-w9fc-c2j6.md)
  `GHSA-3575-w9fc-c2j6`, `CVE-2026-71868` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection
- [Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli](https://agentprime.io/advisories/GHSA-653q-5476-x79g.md)
  `GHSA-653q-5476-x79g`, `CVE-2026-71865` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection, CWE-116
- [Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client](https://agentprime.io/advisories/GHSA-6437-gxhq-pqv8.md)
  `GHSA-6437-gxhq-pqv8`, `CVE-2026-71864` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection, CWE-116
- [GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter](https://agentprime.io/advisories/CVE-2026-58400.md)
  `CVE-2026-58400` · CVE record: geonetwork core-geonetwork · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection
- [Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing](https://agentprime.io/advisories/CVE-2026-75036.md)
  `CVE-2026-75036` · CVE record: SUSE Fleet · CVSS 5.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Server-side request forgery (SSRF), Code injection
- [SeaCMS Locoy Collector seacms_locoy_news.php parseIf code injection](https://agentprime.io/advisories/CVE-2026-85137.md)
  `CVE-2026-85137` · CVE record: SeaCMS · CVSS 6.9 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Other injection, Code injection
- [n8n before 1.123.73 Remote Code Execution via $fromAI Prototype Leak](https://agentprime.io/advisories/CVE-2026-85169.md)
  `CVE-2026-85169` · CVE record: n8n-io n8n · CVSS 8.7 High · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection
- [n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement](https://agentprime.io/advisories/CVE-2026-85165.md)
  `CVE-2026-85165` · CVE record: n8n-io n8n · CVSS 7.2 High · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection
- [langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting](https://agentprime.io/advisories/CVE-2026-85022.md)
  `CVE-2026-85022` · CVE record: langgenius dify · CVSS 5.1 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [langgenius dify Splash Layout splash.tsx router.replace cross site scripting](https://agentprime.io/advisories/CVE-2026-85021.md)
  `CVE-2026-85021` · CVE record: langgenius dify · CVSS 5.3 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE](https://agentprime.io/advisories/GHSA-jrrm-9hc7-2v3h.md)
  `GHSA-jrrm-9hc7-2v3h`, `CVE-2026-62674`, `PYSEC-2026-3874` · PyPI `omnigent`: affected `<0.3.0`, fixed in `0.3.0` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Code injection
- [Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools](https://agentprime.io/advisories/GHSA-756x-9hf6-q4h4.md)
  `GHSA-756x-9hf6-q4h4`, `CVE-2026-62675`, `PYSEC-2026-3872` · PyPI `omnigent`: affected `<0.3.0`, fixed in `0.3.0` · CVSS 8.8 High · Not analysed yet · Published 2 Sept 2026 · Tags: Code injection
- [Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)](https://agentprime.io/advisories/GHSA-mc5q-6hpj-rp7j.md)
  `GHSA-mc5q-6hpj-rp7j`, `CVE-2026-61450`, `CVE-2026-61842`, `PKSA-sq15-xbtt-m678` · Packagist `getgrav/grav`: affected `<2.0.2`, fixed in `2.0.2` · CVSS 7.1 High · Not analysed yet · Published 2 Sept 2026 · Tags: Code injection, Information disclosure
- [Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets](https://agentprime.io/advisories/CVE-2026-66786.md)
  `CVE-2026-66786` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16 and 2 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Code injection
- [Code injection in Jenkins](https://agentprime.io/advisories/CVE-2026-84645.md)
  `CVE-2026-84645` · CVE record: Jenkins Project Jenkins · CVSS 8.8 High · Not analysed yet · Published 2 Sept 2026 · Tags: Code injection, Broken access control
- [Orval: Import-time RCE via query-parameter default -> zod module-level template literal](https://agentprime.io/advisories/GHSA-p4cg-3328-rvfg.md)
  `GHSA-p4cg-3328-rvfg`, `CVE-2026-72716` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Code injection
- [Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client](https://agentprime.io/advisories/GHSA-6mr6-jvcr-2f25.md)
  `GHSA-6mr6-jvcr-2f25`, `CVE-2026-71866` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: SQL injection, Code injection
- [Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()](https://agentprime.io/advisories/GHSA-fj2p-qj2f-74v5.md)
  `GHSA-fj2p-qj2f-74v5`, `CVE-2026-64850`, `CVE-2026-65008`, `PKSA-1q9r-bgms-91mf` · Packagist `getgrav/grav`: affected `<2.0.7`, fixed in `2.0.7` · CVSS 8.7 High · Not analysed yet · Published 2 Sept 2026 · Tags: Code injection
- [pnpm: A tarball dependency's manifest \`name\` escapes node_modules → arbitrary file write/overwrite on install](https://agentprime.io/advisories/GHSA-vq4v-j7r6-jq4m.md)
  `GHSA-vq4v-j7r6-jq4m`, `CVE-2026-82393` · npm `pnpm`: affected `<10.34.5 || >=11.0.0, <11.11.0`, fixed in `10.34.5`, `11.11.0` · CVSS 7.5 High · Not analysed yet · Published 2 Sept 2026 · Tags: Path traversal, Code injection
- [Faker: helpers.fake exploitable into arbritary code execution](https://agentprime.io/advisories/GHSA-qxc2-j82w-r537.md)
  `GHSA-qxc2-j82w-r537`, `CVE-2026-73231` · npm `@faker-js/faker`: affected `<10.5.0`, fixed in `10.5.0` · CVSS 7.8 High · Not analysed yet · Published 2 Sept 2026 · Tags: Code injection
- [WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console](https://agentprime.io/advisories/CVE-2026-77009.md)
  `CVE-2026-77009` · CVE record: Unknown WatchMan-Site7 · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Code injection
- [Template injection in Eclipse Foundation Eclipse Ditto](https://agentprime.io/advisories/CVE-2026-82958.md)
  `CVE-2026-82958` · CVE record: Eclipse Foundation Eclipse Ditto · CVSS 7.6 High · Not analysed yet · Published 2 Sept 2026 · Tags: Other injection, Code injection, CWE-116
- [OpenCart Autocomplete Workflow edit.php cross site scripting](https://agentprime.io/advisories/CVE-2026-84438.md)
  `CVE-2026-84438` · CVE record: OpenCart · CVSS 5.1 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [OpenCart Autocomplete Workflow address.php cross site scripting](https://agentprime.io/advisories/CVE-2026-84437.md)
  `CVE-2026-84437` · CVE record: OpenCart · CVSS 5.1 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Unauthenticated Remote Code Execution in HPE Networking Fabric Composer](https://agentprime.io/advisories/CVE-2026-73701.md)
  `CVE-2026-73701` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Code injection
- [Code injection in Dell PowerStore 500T and others](https://agentprime.io/advisories/CVE-2026-58572.md)
  `CVE-2026-58572` · CVE record: Dell PowerStore 500T and 4 more · CVSS 8.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Code injection
- [Unauthenticated Remote Code Execution via Code Injection in Klemsan's KIO](https://agentprime.io/advisories/CVE-2026-18808.md)
  `CVE-2026-18808` · CVE record: Klemsan Electrical Electronics Inc. KIO (Klemsan Internet Objects) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Code injection
- [Code injection in the Lutece Core](https://agentprime.io/advisories/CVE-2026-4813.md)
  `CVE-2026-4813` · CVE record: Lutece Lutece Core · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Code injection
- [Eval injection in WebPros cPanel](https://agentprime.io/advisories/CVE-2026-65643.md)
  `CVE-2026-65643` · CVE record: WebPros cPanel · CVSS 8.7 High · Not analysed yet · Published 1 Sept 2026 · Tags: Code injection
- [An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted…](https://agentprime.io/advisories/CVE-2026-51974.md)
  `CVE-2026-51974` · CVE record · CVSS 8.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: Code injection
- [Typora Mermaid Rendering cross site scripting](https://agentprime.io/advisories/CVE-2026-82805.md)
  `CVE-2026-82805` · CVE record: Typora · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Online Shopping System Newsletter Subscription offersmail.php cross site scripting](https://agentprime.io/advisories/CVE-2026-82700.md)
  `CVE-2026-82700` · CVE record: code-projects Online Shopping System · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine](https://agentprime.io/advisories/CVE-2026-12894.md)
  `CVE-2026-12894` · CVE record: Quarkus quarkus-qute and 4 more · CVSS 8.8 High · Not analysed yet · Published 31 Aug 2026 · Tags: Code injection
- [yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection](https://agentprime.io/advisories/CVE-2026-82666.md)
  `CVE-2026-82666` · CVE record: yaojingang GEOFlow · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, Code injection
- [yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting](https://agentprime.io/advisories/CVE-2026-82664.md)
  `CVE-2026-82664` · CVE record: yaojingang GEOFlow · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Simple Inventory System User Registration register.php cross site scripting](https://agentprime.io/advisories/CVE-2026-82625.md)
  `CVE-2026-82625` · CVE record: code-projects Simple Inventory System · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection
- [code-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scripting](https://agentprime.io/advisories/CVE-2026-82622.md)
  `CVE-2026-82622` · CVE record: code-projects Employee Leave Managing System · CVSS 5.1 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SeaCMS err.php cross site scripting](https://agentprime.io/advisories/CVE-2026-82601.md)
  `CVE-2026-82601` · CVE record: SeaCMS · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection
- [EEx template evaluation of prompt content in AshAi enables remote code execution](https://agentprime.io/advisories/GHSA-2g59-hg7m-qc83.md)
  `GHSA-2g59-hg7m-qc83`, `CVE-2026-77956`, `EEF-CVE-2026-77956` · Hex `ash_ai`: affected `>=0.1.0, <1.0.0`, fixed in `1.0.0` · CVSS 8.9 High · Not analysed yet · Published 31 Aug 2026 · Tags: Code injection
- [SeaCMS Template search.php parseIf code injection](https://agentprime.io/advisories/CVE-2026-82598.md)
  `CVE-2026-82598` · CVE record: SeaCMS · CVSS 6.9 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, Code injection
- [SourceCodester Queue Management System add_customer.php cross site scripting](https://agentprime.io/advisories/CVE-2026-82554.md)
  `CVE-2026-82554` · CVE record: SourceCodester Queue Management System · CVSS 5.3 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Beetel 450TC3 User Management cross site scripting](https://agentprime.io/advisories/CVE-2026-82488.md)
  `CVE-2026-82488` · CVE record: Beetel 450TC3 · CVSS 5.1 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection
- [coppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db_input.php cross site scripting](https://agentprime.io/advisories/CVE-2026-82483.md)
  `CVE-2026-82483` · CVE record: coppermine-gallery Coppermine Photo Gallery · CVSS 5.1 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection
- [coppermine-gallery Coppermine Photo Gallery edit_profile Endpoint profile.php cross site scripting](https://agentprime.io/advisories/CVE-2026-82482.md)
  `CVE-2026-82482` · CVE record: coppermine-gallery Coppermine Photo Gallery · CVSS 5.1 Medium · Not analysed yet · Published 30 Aug 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Skyvern before 1.0.45 Sandbox Escape via TextPromptBlock](https://agentprime.io/advisories/CVE-2026-82447.md)
  `CVE-2026-82447` · CVE record: Skyvern-AI skyvern · CVSS 8.7 High · Not analysed yet · Published 29 Aug 2026 · Tags: Code injection
- [Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement](https://agentprime.io/advisories/CVE-2026-19295.md)
  `CVE-2026-19295` · CVE record: IBM Langflow OSS · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2026 · Tags: Code injection
- [Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement](https://agentprime.io/advisories/CVE-2026-19286.md)
  `CVE-2026-19286` · CVE record: IBM Langflow OSS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2026 · Tags: Code injection
- [Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement](https://agentprime.io/advisories/CVE-2026-18729.md)
  `CVE-2026-18729` · CVE record: IBM Langflow OSS · CVSS 8.8 High · Not analysed yet · Published 28 Aug 2026 · Tags: Code injection
- [Pimcore Vulnerable to Remote Code Execution via DataObject Class-Definition Field Name](https://agentprime.io/advisories/GHSA-9x44-4gxf-8c25.md)
  `GHSA-9x44-4gxf-8c25`, `CVE-2026-55634`, `PKSA-vgg9-cbdg-s4xt` · Packagist `pimcore/pimcore`: affected `<12.3.10 || >=2026.1.0, <2026.1.6`, fixed in `12.3.10`, `2026.1.6` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2026 · Tags: SQL injection, Code injection
- [Yamcs vulnerable to authenticated remote code execution via unescaped StreamSQL \`LIKE\` pattern compiled by Janino (\`LikeExpression\`)](https://agentprime.io/advisories/GHSA-c64q-hj4j-375f.md)
  `GHSA-c64q-hj4j-375f`, `CVE-2026-55565` · Maven `org.yamcs:yamcs-core`: affected `>=5.13.0, <5.13.2 || <5.12.8`, fixed in `5.13.2`, `5.12.8` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2026 · Tags: Code injection
- [Yamcs vulnerable to Remote Code Execution via instance-template argument YAML injection (createInstance)](https://agentprime.io/advisories/GHSA-73mf-m39p-wpm9.md)
  `GHSA-73mf-m39p-wpm9`, `CVE-2026-55559` · Maven `org.yamcs:yamcs-core`: affected `>=5.13.0, <5.13.2 || <5.12.8`, fixed in `5.13.2`, `5.12.8` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2026 · Tags: Code injection
- [Yamcs vulnerable to authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs \`executeSql\`](https://agentprime.io/advisories/GHSA-3g44-3m7x-cgg2.md)
  `GHSA-3g44-3m7x-cgg2`, `CVE-2026-55511` · Maven `org.yamcs:yamcs-core`: affected `>=5.13.0, <5.13.2 || <5.12.8`, fixed in `5.13.2`, `5.12.8` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2026 · Tags: Code injection
- [Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint](https://agentprime.io/advisories/CVE-2026-77939.md)
  `CVE-2026-77939` · CVE record: flextype flextype · CVSS 7.1 High · Not analysed yet · Published 28 Aug 2026 · Tags: Code injection

Newest: <https://agentprime.io/advisories/tag/code-injection.md>
Older: <https://agentprime.io/advisories/tag/code-injection.md?cursor=WyIyMDI2LTA4LTI4VDE3OjA2OjUxLjEzMjAwMFoiLCJDVkUtMjAyNi03NzkzOSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=code-injection&cursor=WyIyMDI2LTA5LTAzVDE5OjE3OjMyLjAwMDAwMFoiLCJHSFNBLWZnOXAtbXJ4ci1odnE3Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/code-injection/?cursor=WyIyMDI2LTA5LTAzVDE5OjE3OjMyLjAwMDAwMFoiLCJHSFNBLWZnOXAtbXJ4ci1odnE3Il0>. Everything for agents: <https://agentprime.io/llms.txt>.