# Code injection.

Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [AirControl 1.4.2 - PreAuth Remote Code Execution](https://agentprime.io/advisories/CVE-2020-37052.md)
  `CVE-2020-37052` · CVE record: Ubiquiti, Inc. AirControl · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jan 2026 · Tags: Code injection
- [D-Link DSL-6641K Web ad_virtual_server_vdsl cross site scripting](https://agentprime.io/advisories/CVE-2026-1705.md)
  `CVE-2026-1705` · CVE record: D-Link DSL-6641K · CVSS 4.8 Medium · Not analysed yet · Published 30 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload](https://agentprime.io/advisories/GHSA-77w2-v593-vxvv.md)
  `GHSA-77w2-v593-vxvv`, `CVE-2025-62348`, `PYSEC-2026-1894` · PyPI `salt`: affected `<3006.17`, fixed in `3006.17` · CVSS 7.3 High · Not analysed yet · Published 30 Jan 2026 · Tags: Code injection
- [Orval has Code Injection via unsanitized x-enum-descriptions using JS comments](https://agentprime.io/advisories/GHSA-gch2-phqh-fg9q.md)
  `GHSA-gch2-phqh-fg9q`, `CVE-2026-25141` · npm `@orval/core`: affected `>=7.19.0, <7.21.0 || >=8.0.0, <8.2.0`, fixed in `7.21.0`, `8.2.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jan 2026 · Tags: Code injection, CWE-84
- [DiscussionTools should use better regex](https://agentprime.io/advisories/CVE-2025-11175.md)
  `CVE-2025-11175` · CVE record: The Wikimedia Foundation Mediawiki - DiscussionTools Extension · CVSS 8.8 High · Not analysed yet · Published 30 Jan 2026 · Tags: Code injection
- [projectworlds House Rental and Property Listing sms.php cross site scripting](https://agentprime.io/advisories/CVE-2026-1700.md)
  `CVE-2026-1700` · CVE record: projectworlds House Rental and Property Listing · CVSS 5.1 Medium · Not analysed yet · Published 30 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Command Injection in nvm via NVM_AUTH_HEADER in wget code path](https://agentprime.io/advisories/CVE-2026-1665.md)
  `CVE-2026-1665` · CVE record: nvm-sh nvm · CVSS 5.4 Medium · Not analysed yet · Published 29 Jan 2026 · Tags: Command injection, Code injection
- [Code injection in Ivanti Endpoint Manager Mobile](https://agentprime.io/advisories/CVE-2026-1340.md)
  `CVE-2026-1340` · CVE record: Ivanti Endpoint Manager Mobile · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.99 · Not analysed yet · Published 29 Jan 2026 · Tags: Code injection
- [Code injection in Ivanti Endpoint Manager Mobile](https://agentprime.io/advisories/CVE-2026-1281.md)
  `CVE-2026-1281` · CVE record: Ivanti Endpoint Manager Mobile · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.99 · Not analysed yet · Published 29 Jan 2026 · Tags: Code injection
- [Bdtask Bhojon All-In-One Restaurant Management System User Information profile cross site scripting](https://agentprime.io/advisories/CVE-2026-1598.md)
  `CVE-2026-1598` · CVE record: Bdtask Bhojon All-In-One Restaurant Management System · CVSS 5.1 Medium · Not analysed yet · Published 29 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [AutoGPT is Vulnerable to RCE via Disabled Block Execution](https://agentprime.io/advisories/GHSA-r277-3xc5-c79v.md)
  `GHSA-r277-3xc5-c79v`, `CVE-2026-24780`, `PYSEC-2026-1078` · PyPI `agpt`: affected `<=0.2.2`, no fixed version yet · CVSS 8.6 High · Not analysed yet · Published 29 Jan 2026 · Tags: Code injection, Broken access control
- [A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or earlier than v1.3.1, allows low-privilege…](https://agentprime.io/advisories/CVE-2025-69516.md)
  `CVE-2025-69516` · CVE record · CVSS 8.8 High · Not analysed yet · Published 29 Jan 2026 · Tags: Code injection
- [Authenticated Remote Code Execution via Arbitrary File Upload](https://agentprime.io/advisories/CVE-2026-24897.md)
  `CVE-2026-24897` · CVE record: ErugoOSS Erugo · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jan 2026 · Tags: Path traversal, Code injection, Unrestricted file upload
- [BrowserStack Local vulnerable to Command Injection through logfile variable](https://agentprime.io/advisories/GHSA-g4w6-c99w-4wh7.md)
  `GHSA-g4w6-c99w-4wh7`, `CVE-2025-57283` · npm `browserstack-local`: affected `<1.5.9`, fixed in `1.5.9` · CVSS 7.8 High · Not analysed yet · Published 28 Jan 2026 · Tags: Command injection, Code injection
- [rethinkdb Secondary Index cross site scripting](https://agentprime.io/advisories/CVE-2026-1520.md)
  `CVE-2026-1520` · CVE record: rethinkdb · CVSS 4.8 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [An HTML injection vulnerability in Amidaware Inc Tactical RMM v1.3.1 and earlier allows authenticated users to inject arbitrary HTML content during the creation of a new agent via the POST /api/v3/ne…](https://agentprime.io/advisories/CVE-2025-69517.md)
  `CVE-2025-69517` · CVE record · CVSS 8.8 High · Not analysed yet · Published 28 Jan 2026 · Tags: Code injection
- [PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files](https://agentprime.io/advisories/GHSA-63cw-57p8-fm3p.md)
  `GHSA-63cw-57p8-fm3p`, `BIT-pytorch-2026-24747`, `CVE-2026-24747`, `PYSEC-2026-1856`, `PYSEC-2026-2286` · PyPI `torch`: affected `<2.10.0`, fixed in `2.10.0` · CVSS 8.8 High · Not analysed yet · Published 27 Jan 2026 · Tags: Code injection, Insecure deserialization
- [SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor](https://agentprime.io/advisories/GHSA-wxhw-j4hc-fmq6.md)
  `GHSA-wxhw-j4hc-fmq6`, `CVE-2026-23830` · npm `@nyariv/sandboxjs`: affected `<0.8.26`, fixed in `0.8.26` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jan 2026 · Tags: Code injection, CWE-693, CWE-913
- [Code injection in Minecraft-Rcon-Manage](https://agentprime.io/advisories/CVE-2026-24871.md)
  `CVE-2026-24871` · CVE record: pilgrimage233 Minecraft-Rcon-Manage · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jan 2026 · Tags: Code injection
- [n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution](https://agentprime.io/advisories/GHSA-5xrp-6693-jjx9.md)
  `GHSA-5xrp-6693-jjx9`, `CVE-2026-1470` · npm `n8n`: affected `<1.123.17 || >=2.0.0, <2.4.5 || >=2.5.0, <2.5.1`, fixed in `1.123.17`, `2.4.5`, `2.5.1` · CVSS 9.9 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.20 · Not analysed yet · Published 27 Jan 2026 · Tags: Code injection
- [Quick-Media Batik Codec FIX package has Code Injection vulnerability](https://agentprime.io/advisories/GHSA-8623-9fwr-4cxv.md)
  `GHSA-8623-9fwr-4cxv`, `CVE-2026-24806` · Maven `com.github.liuyueyi.media:batik-codec-fix`: affected `<=3.0.0`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 27 Jan 2026 · Tags: Code injection
- [code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExAddNewUser.php via the Name, Address, email, UserName, Password, confirm_password, Role, Branch, and Activate para…](https://agentprime.io/advisories/CVE-2025-69564.md)
  `CVE-2025-69564` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Jan 2026 · Tags: Code injection
- [iJason-Liu Books_Manager add_book_check.php cross site scripting](https://agentprime.io/advisories/CVE-2026-1444.md)
  `CVE-2026-1444` · CVE record: iJason-Liu Books_Manager · CVSS 4.8 Medium · Not analysed yet · Published 26 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [vm2 has a Sandbox Escape](https://agentprime.io/advisories/GHSA-99p7-6v5w-7xg8.md)
  `GHSA-99p7-6v5w-7xg8`, `CVE-2026-22709` · npm `vm2`: affected `<3.10.2`, fixed in `3.10.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jan 2026 · Tags: Code injection, CWE-693, CWE-913
- [code-projects Online Examination System Add Pages cross site scripting](https://agentprime.io/advisories/CVE-2026-1421.md)
  `CVE-2026-1421` · CVE record: code-projects Online Examination System · CVSS 5.1 Medium · Not analysed yet · Published 26 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Dioxus Components has JavaScript injection via user-supplied IDs](https://agentprime.io/advisories/CVE-2026-24474.md)
  `CVE-2026-24474` · CVE record: DioxusLabs components · CVSS 5.3 Medium · Not analysed yet · Published 23 Jan 2026 · Tags: Code injection
- [Template injection in Dell Data Protection Advisor](https://agentprime.io/advisories/CVE-2025-46699.md)
  `CVE-2025-46699` · CVE record: Dell Data Protection Advisor · CVSS 4.3 Medium · Not analysed yet · Published 23 Jan 2026 · Tags: Code injection
- [BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution](https://agentprime.io/advisories/CVE-2024-11976.md)
  `CVE-2024-11976` · CVE record: buddypress BuddyPress · CVSS 7.3 High · Not analysed yet · Published 23 Jan 2026 · Tags: Code injection
- [Moodle affected by a code injection vulnerability](https://agentprime.io/advisories/GHSA-xvmh-25jw-gmmm.md)
  `GHSA-xvmh-25jw-gmmm`, `BIT-moodle-2025-67847`, `CVE-2025-67847`, `PKSA-41tm-5zq3-pfdc` · Packagist `moodle/moodle`: affected `<4.1.22 || >=4.2.0-beta, <4.4.12 || >=4.5.0-beta, <4.5.8 || >=5.0.0-beta, <5.0.4 || >=5.1.0-beta, <5.1.1`, fixed in `4.1.22`, `4.4.12`, `4.5.8`, `5.0.4`, `5.1.1` · CVSS 8.8 High · Not analysed yet · Published 23 Jan 2026 · Tags: Code injection
- [Langflow PythonFunction Code Injection Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-0771.md)
  `CVE-2026-0771` · CVE record: Langflow Langflow · CVSS 7.1 High · Not analysed yet · Published 23 Jan 2026 · Tags: Code injection
- [Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-0769.md)
  `CVE-2026-0769` · CVE record: Langflow Langflow · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.41 · Not analysed yet · Published 23 Jan 2026 · Tags: Code injection
- [Langflow code Code Injection Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-0768.md)
  `CVE-2026-0768` · CVE record: Langflow Langflow · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.28 · Not analysed yet · Published 23 Jan 2026 · Tags: Code injection
- [Foundation Agents MetaGPT actionoutput_str_to_mapping Code Injection Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-0761.md)
  `CVE-2026-0761` · CVE record: Foundation Agents MetaGPT · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jan 2026 · Tags: Code injection
- [Orval Mock Generation Code Injection via const](https://agentprime.io/advisories/GHSA-f456-rf33-4626.md)
  `GHSA-f456-rf33-4626`, `CVE-2026-24132` · npm `@orval/mock`: affected `<7.20.0 || >=8.0.0-rc.0, <8.0.3`, fixed in `7.20.0`, `8.0.3` · CVSS 7.7 High · Not analysed yet · Published 22 Jan 2026 · Tags: Command injection, Code injection
- [WordPress Beaver Builder plugin <= 2.9.4.1 - Arbitrary Code Execution vulnerability](https://agentprime.io/advisories/CVE-2025-69319.md)
  `CVE-2025-69319` · CVE record: Beaver Builder Beaver Builder · CVSS 7.5 High · Not analysed yet · Published 22 Jan 2026 · Tags: Code injection
- [WordPress FluentForm plugin <= 6.1.11 - Arbitrary Shortcode Execution vulnerability](https://agentprime.io/advisories/CVE-2025-69001.md)
  `CVE-2025-69001` · CVE record: Shahjahan Jewel FluentForm · CVSS 5.3 Medium · Not analysed yet · Published 22 Jan 2026 · Tags: Code injection
- [WordPress Event Tickets with Ticket Scanner plugin <= 2.8.5 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2025-68015.md)
  `CVE-2025-68015` · CVE record: Vollstart Event Tickets with Ticket Scanner · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jan 2026 · Tags: Code injection
- [WordPress Nelio AB Testing plugin <= 8.1.8 - Arbitrary Code Execution vulnerability](https://agentprime.io/advisories/CVE-2025-67944.md)
  `CVE-2025-67944` · CVE record: Nelio Software Nelio AB Testing · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jan 2026 · Tags: Code injection
- [5ire vulnerable to Remote Code Execution (RCE) via ECharts](https://agentprime.io/advisories/CVE-2026-22793.md)
  `CVE-2026-22793` · CVE record: nanbingxyz 5ire · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jan 2026 · Tags: Code injection
- [GetSimple CMS My SMTP Contact Plugin 1.1.2 - PHP Code Injection](https://agentprime.io/advisories/CVE-2021-47778.md)
  `CVE-2021-47778` · CVE record: Get-Simple My SMTP Contact Plugin · CVSS 8.6 High · Not analysed yet · Published 21 Jan 2026 · Tags: Code injection
- [OpenPLC 3 - Remote Code Execution](https://agentprime.io/advisories/CVE-2021-47770.md)
  `CVE-2021-47770` · CVE record: Autonomy OpenPLC · CVSS 8.6 High · Not analysed yet · Published 21 Jan 2026 · Tags: Code injection
- [Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization](https://agentprime.io/advisories/GHSA-339m-4qw5-j2g3.md)
  `GHSA-339m-4qw5-j2g3`, `CVE-2026-23946`, `PYSEC-2026-1950` · PyPI `tendenci`: affected `<15.3.12`, fixed in `15.3.12` · CVSS 6.8 Medium · Not analysed yet · Published 21 Jan 2026 · Tags: Code injection, Insecure deserialization
- [Cisco Unified Communications Products Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-20045.md)
  `CVE-2026-20045` · CVE record: Cisco Cisco Unified Communications Manager and 2 more · CVSS 8.2 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 21 Jan 2026 · Tags: Code injection
- [vLLM affected by RCE via auto_map dynamic module loading during model initialization](https://agentprime.io/advisories/GHSA-2pc9-4j83-qjmr.md)
  `GHSA-2pc9-4j83-qjmr`, `CVE-2026-22807`, `PYSEC-2026-2010` · PyPI `vllm`: affected `>=0.10.1, <0.14.0`, fixed in `0.14.0` · CVSS 8.8 High · Not analysed yet · Published 21 Jan 2026 · Tags: Code injection
- [AlchemyCMS: Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper](https://agentprime.io/advisories/GHSA-2762-657x-v979.md)
  `GHSA-2762-657x-v979`, `CVE-2026-23885` · RubyGems `alchemy_cms`: affected `<7.4.12 || >=8.0.0.a, <8.0.3`, fixed in `7.4.12`, `8.0.3` · CVSS 6.4 Medium · Not analysed yet · Published 21 Jan 2026 · Tags: Code injection
- [Orval has a code injection via unsanitized x-enum-descriptions in enum generation](https://agentprime.io/advisories/GHSA-h526-wf6g-67jv.md)
  `GHSA-h526-wf6g-67jv`, `CVE-2026-23947` · npm `@orval/core`: affected `<7.19.0 || >=8.0.0-rc.0, <8.0.2`, fixed in `7.19.0`, `8.0.2` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jan 2026 · Tags: Command injection, Code injection
- [binary-parser library has a code injection vulnerability](https://agentprime.io/advisories/GHSA-m39p-34qh-rh3w.md)
  `GHSA-m39p-34qh-rh3w`, `CVE-2026-1245` · npm `binary-parser`: affected `<2.3.0`, fixed in `2.3.0` · CVSS 6.5 Medium · Not analysed yet · Published 20 Jan 2026 · Tags: Code injection
- [XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability](https://agentprime.io/advisories/GHSA-r8w2-w357-9pjv.md)
  `GHSA-r8w2-w357-9pjv`, `CVE-2025-64087` · Maven `fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker`: affected `<2.2.0`, fixed in `2.2.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jan 2026 · Tags: Code injection
- [Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE)](https://agentprime.io/advisories/GHSA-4gpc-rhpj-9443.md)
  `GHSA-4gpc-rhpj-9443`, `CVE-2026-23733` · npm `@lobehub/chat`: affected `<=1.143.2`, no fixed version yet · CVSS 6.4 Medium · Not analysed yet · Published 20 Jan 2026 · Tags: Code injection
- [Code injection in NVIDIA Merlin Transformers4Rec](https://agentprime.io/advisories/CVE-2025-33233.md)
  `CVE-2025-33233` · CVE record: NVIDIA Merlin Transformers4Rec · CVSS 7.8 High · Not analysed yet · Published 20 Jan 2026 · Tags: Code injection
- [Kimai has an Authenticated Server-Side Template Injection (SSTI)](https://agentprime.io/advisories/GHSA-jg2j-2w24-54cg.md)
  `GHSA-jg2j-2w24-54cg`, `CVE-2026-23626`, `PKSA-pn9p-tcw8-rbpj` · Packagist `kimai/kimai`: affected `<2.46.0`, fixed in `2.46.0` · CVSS 6.8 Medium · Not analysed yet · Published 20 Jan 2026 · Tags: Code injection
- [A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is pass…](https://agentprime.io/advisories/CVE-2025-55423.md)
  `CVE-2025-55423` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Jan 2026 · Tags: Code injection
- [SiYuan vulnerable to Stored XSS / RCE via \`setBlockAttrs\` icon attribute](https://agentprime.io/advisories/CVE-2026-23852.md)
  `CVE-2026-23852` · CVE record: siyuan-note siyuan · CVSS 5.8 Medium · Not analysed yet · Published 19 Jan 2026 · Tags: Code injection
- [pbrong hrms recruitment.go UpdateRecruitmentById cross site scripting](https://agentprime.io/advisories/CVE-2026-1161.md)
  `CVE-2026-1161` · CVE record: pbrong hrms · CVSS 5.1 Medium · Not analysed yet · Published 19 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [technical-laohu mpay User Center cross site scripting](https://agentprime.io/advisories/CVE-2026-1151.md)
  `CVE-2026-1151` · CVE record: technical-laohu mpay · CVSS 4.8 Medium · Not analysed yet · Published 19 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System api_patient_schedule.php cross site scripting](https://agentprime.io/advisories/CVE-2026-1147.md)
  `CVE-2026-1147` · CVE record: SourceCodester Patients Waiting Area Queue Management System and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 19 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System api_register_patient.php cross site scripting](https://agentprime.io/advisories/CVE-2026-1146.md)
  `CVE-2026-1146` · CVE record: SourceCodester Patients Waiting Area Queue Management System and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 19 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [lcg0124 BootDo ContentController save cross site scripting](https://agentprime.io/advisories/CVE-2026-1136.md)
  `CVE-2026-1136` · CVE record: lcg0124 BootDo · CVSS 5.1 Medium · Not analysed yet · Published 19 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [itsourcecode Society Management System activity.php cross site scripting](https://agentprime.io/advisories/CVE-2026-1135.md)
  `CVE-2026-1135` · CVE record: itsourcecode Society Management System · CVSS 5.3 Medium · Not analysed yet · Published 19 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection
- [itsourcecode Society Management System expenses.php cross site scripting](https://agentprime.io/advisories/CVE-2026-1134.md)
  `CVE-2026-1134` · CVE record: itsourcecode Society Management System · CVSS 5.3 Medium · Not analysed yet · Published 19 Jan 2026 · Tags: Cross-site scripting (XSS), Code injection

Newest: <https://agentprime.io/advisories/tag/code-injection.md>
Older: <https://agentprime.io/advisories/tag/code-injection.md?cursor=WyIyMDI2LTAxLTE5VDAyOjMyOjA2LjY0ODAwMFoiLCJDVkUtMjAyNi0xMTM0Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=code-injection&cursor=WyIyMDI2LTAyLTAyVDA0OjMyOjA4LjI0NzAwMFoiLCJDVkUtMjAyNi0xNzQ0Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/code-injection/?cursor=WyIyMDI2LTAyLTAyVDA0OjMyOjA4LjI0NzAwMFoiLCJDVkUtMjAyNi0xNzQ0Il0>. Everything for agents: <https://agentprime.io/llms.txt>.