# Code injection.

Untrusted input evaluated as code: eval, templates, expression languages. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification](https://agentprime.io/advisories/GHSA-m6wp-h223-4c8g.md)
  `GHSA-m6wp-h223-4c8g`, `CVE-2026-61446`, `PYSEC-2026-4271` · PyPI `praisonaiagents`: affected `<1.6.78`, fixed in `1.6.78` · CVSS 8.6 High · Not analysed yet · Published 8 Oct 2026 · Tags: Code injection, CWE-427
- [PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets](https://agentprime.io/advisories/GHSA-2xv2-w8cq-5gxw.md)
  `GHSA-2xv2-w8cq-5gxw`, `CVE-2026-61447`, `PYSEC-2026-4266` · PyPI `praisonaiagents`: affected `<1.6.78`, fixed in `1.6.78` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 8 Oct 2026 · Tags: Code injection, Information disclosure
- [Eval injection in Brocade Active Support Connectivity Gateway](https://agentprime.io/advisories/CVE-2026-85486.md)
  `CVE-2026-85486` · CVE record: Brocade Brocade Active Support Connectivity Gateway · CVSS 8.6 High · Not analysed yet · Published 8 Oct 2026 · Tags: Code injection
- [Ghost: Remote Code Execution via Bookmark Card Images](https://agentprime.io/advisories/GHSA-788w-68h3-cvxp.md)
  `GHSA-788w-68h3-cvxp`, `BIT-ghost-2026-105642`, `CVE-2026-105642` · npm `ghost`: affected `>=6.56.0, <6.67.0`, fixed in `6.67.0` · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection, CWE-1395
- [Payload: Remote Code Execution through first-register](https://agentprime.io/advisories/GHSA-97rh-rhh2-7vjv.md)
  `GHSA-97rh-rhh2-7vjv`, `CVE-2026-105858` · npm `payload`: affected `<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 8.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection, Prototype pollution
- [Payload Form Builder has an RCE issue](https://agentprime.io/advisories/GHSA-r488-j9vj-wx3q.md)
  `GHSA-r488-j9vj-wx3q`, `CVE-2026-105857` · npm `@payloadcms/plugin-form-builder`: affected `<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection, Prototype pollution
- [Ghost: Remote Code Execution via Theme Translation Files](https://agentprime.io/advisories/GHSA-jj74-hc2q-xrvm.md)
  `GHSA-jj74-hc2q-xrvm`, `BIT-ghost-2026-104418`, `BIT-ghost-2026-105677`, `CVE-2026-104418`, `CVE-2026-105677` · npm `ghost`: affected `>=6.10.3, <6.64.0`, fixed in `6.64.0` · CVSS 8.6 High · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal, Code injection, CWE-829
- [Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method](https://agentprime.io/advisories/GHSA-5jjj-9xc3-rm56.md)
  `GHSA-5jjj-9xc3-rm56`, `CVE-2026-106440`, `PYSEC-2026-4224` · PyPI `hydra-optuna-sweeper`: affected `>=1.2.0, <1.3.0 || >=1.4.0.dev4, <1.4.0.dev10`, fixed in `1.3.0`, `1.4.0.dev10` · CVSS 7.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection
- [Hydra: Mutable instantiate policy sets allow target blocklist bypass](https://agentprime.io/advisories/GHSA-mwj6-rfh8-7qf4.md)
  `GHSA-mwj6-rfh8-7qf4`, `CVE-2026-106439`, `PYSEC-2026-4222` · PyPI `hydra-core`: affected `>=1.3.4, <1.3.7 || >=1.4.0.dev4, <1.4.0.dev10`, fixed in `1.3.7`, `1.4.0.dev10` · CVSS 8.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection, CWE-693
- [Hydra logging configuration permits unsafe callable resolution](https://agentprime.io/advisories/GHSA-c3wx-c55w-pxjq.md)
  `GHSA-c3wx-c55w-pxjq`, `CVE-2026-106441`, `PYSEC-2026-4221` · PyPI `hydra-core`: affected `<1.3.6 || >=1.4.0.dev0, <1.4.0.dev9`, fixed in `1.3.6`, `1.4.0.dev9` · CVSS 7.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection
- [Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml](https://agentprime.io/advisories/GHSA-4488-j8vj-vqqv.md)
  `GHSA-4488-j8vj-vqqv`, `CVE-2026-106510` · npm `@backstage/plugin-techdocs-node`: affected `<1.15.4`, fixed in `1.15.4` · CVSS 7.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection, CWE-183
- [Backstage: Improper validation of MkDocs theme configuration in TechDocs](https://agentprime.io/advisories/GHSA-8w7q-29mw-gf5c.md)
  `GHSA-8w7q-29mw-gf5c`, `CVE-2026-106509` · npm `@backstage/plugin-techdocs-node`: affected `<1.15.4`, fixed in `1.15.4` · CVSS 7.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection
- [Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass](https://agentprime.io/advisories/GHSA-w7x8-q2gp-5cgg.md)
  `GHSA-w7x8-q2gp-5cgg`, `CVE-2026-73487` · npm `flowise` and 1 more: affected `<3.1.3`, fixed in `3.1.3` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection
- [Cisco License On-Prem Security Hardening Release](https://agentprime.io/advisories/CVE-2026-76484.md)
  `CVE-2026-76484` · CVE record: Cisco Cisco License On-Prem · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection
- [PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation](https://agentprime.io/advisories/GHSA-g6j7-pffp-8whg.md)
  `GHSA-g6j7-pffp-8whg`, `CVE-2026-61444`, `CVE-2026-62176`, `PYSEC-2026-4256` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection
- [Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies](https://agentprime.io/advisories/CVE-2026-92415.md)
  `CVE-2026-92415` · CVE record: Apache Software Foundation Apache Jackrabbit · CVSS 6.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection
- [ImageMagick: Code Injection in the postscript coders](https://agentprime.io/advisories/CVE-2026-106577.md)
  `CVE-2026-106577` · CVE record: ImageMagick ImageMagick · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection
- [Code injection in Six Apart Ltd. Movable Type Cloud Edition and others](https://agentprime.io/advisories/CVE-2026-96408.md)
  `CVE-2026-96408` · CVE record: Six Apart Ltd. Movable Type Cloud Edition and 3 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection
- [WP Coder 4.0 - 4.5.1 - Editor+ RCE via Global PHP](https://agentprime.io/advisories/CVE-2026-104677.md)
  `CVE-2026-104677` · CVE record: Unknown WP Coder · CVSS 7.2 High · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-88962.md)
  `CVE-2026-88962` · CVE record: IBM Langflow OSS · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-93443.md)
  `CVE-2026-93443` · CVE record: IBM Langflow OSS · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-93449.md)
  `CVE-2026-93449` · CVE record: IBM Langflow OSS · CVSS 8.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-93445.md)
  `CVE-2026-93445` · CVE record: IBM Langflow OSS · CVSS 8.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-93674.md)
  `CVE-2026-93674` · CVE record: IBM Langflow OSS · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-97674.md)
  `CVE-2026-97674` · CVE record: IBM Langflow OSS · CVSS 8.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-97679.md)
  `CVE-2026-97679` · CVE record: IBM Langflow OSS · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-97655.md)
  `CVE-2026-97655` · CVE record: IBM Langflow OSS · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-97676.md)
  `CVE-2026-97676` · CVE record: IBM Langflow OSS · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-104334.md)
  `CVE-2026-104334` · CVE record: IBM Langflow OSS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection
- [Code injection via unencoded configuration values during Python code generation in Bedrock AgentCore Starter Toolkit agent import](https://agentprime.io/advisories/CVE-2026-105812.md)
  `CVE-2026-105812` · CVE record: aws bedrock-agentcore-starter-toolkit · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection
- [Authenticated Remote Code Execution Vulnerabilities in HPE Networking ClearPass Policy Manager](https://agentprime.io/advisories/CVE-2026-79810.md)
  `CVE-2026-79810` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 7.2 High · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection
- [knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json](https://agentprime.io/advisories/GHSA-mc52-mwq4-vfx3.md)
  `GHSA-mc52-mwq4-vfx3`, `CVE-2026-86540` · npm `knowns`: affected `<0.30.0`, fixed in `0.30.0` · CVSS 8.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Command injection, Code injection, CWE-427, CWE-829
- [Code injection in Google Chrome](https://agentprime.io/advisories/CVE-2026-106416.md)
  `CVE-2026-106416` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection
- [Code injection in Google Chrome](https://agentprime.io/advisories/CVE-2026-106189.md)
  `CVE-2026-106189` · CVE record: Google Chrome · CVSS 7.3 High · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection
- [Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators](https://agentprime.io/advisories/GHSA-rm89-rhwj-9j92.md)
  `GHSA-rm89-rhwj-9j92`, `CVE-2026-105796` · NuGet `Microsoft.OpenApi.Kiota` and 1 more: affected `>=0.5.0, <1.35.0`, fixed in `1.35.0` · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection
- [openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation](https://agentprime.io/advisories/GHSA-5293-mq8x-g3xj.md)
  `GHSA-5293-mq8x-g3xj`, `CVE-2026-105801`, `PYSEC-2026-4245` · PyPI `openapi-python-client`: affected `<0.29.1`, fixed in `0.29.1` · CVSS 8.4 High · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection, CWE-116, CWE-150
- [getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting](https://agentprime.io/advisories/CVE-2026-105950.md)
  `CVE-2026-105950` · CVE record: getformwork formwork · CVSS 5.1 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Template injection in Dell Container Storage Modules](https://agentprime.io/advisories/CVE-2026-67273.md)
  `CVE-2026-67273` · CVE record: Dell Container Storage Modules · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection
- [Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation](https://agentprime.io/advisories/GHSA-8qpj-27x8-pwpq.md)
  `GHSA-8qpj-27x8-pwpq`, `CVE-2026-10561`, `PYSEC-2026-4231` · PyPI `langflow`: affected `<1.10.1`, fixed in `1.10.1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection, Privilege escalation
- [Smarty before 4.5.8 and 5.x before 5.8.5 PHP Code Injection via extends: Inheritance Cache](https://agentprime.io/advisories/CVE-2026-82531.md)
  `CVE-2026-82531` · CVE record: smarty-php smarty · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection
- [Authenticated RCE via render-components Entry Type overrides](https://agentprime.io/advisories/CVE-2026-105985.md)
  `CVE-2026-105985` · CVE record: craftcms cms · CVSS 8.7 High · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection
- [WordPress Tabs plugin <= 2.5 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-39776.md)
  `CVE-2026-39776` · CVE record: wpshopmart Tabs · CVSS 8.0 High · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection
- [WordPress WooCommerce Designer Pro plugin <= 1.9.33 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-32568.md)
  `CVE-2026-32568` · CVE record: JMAPlugins WooCommerce Designer Pro · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection
- [SourceCodester Simple Student Information System Profile Field register.php cross site scripting](https://agentprime.io/advisories/CVE-2026-105809.md)
  `CVE-2026-105809` · CVE record: SourceCodester Simple Student Information System · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester Simple Student Information System searchresults.php clean cross site scripting](https://agentprime.io/advisories/CVE-2026-105808.md)
  `CVE-2026-105808` · CVE record: SourceCodester Simple Student Information System · CVSS 5.1 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [imgproxy SVG svg.go sanitizeElement cross site scripting](https://agentprime.io/advisories/CVE-2026-105708.md)
  `CVE-2026-105708` · CVE record: imgproxy · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [SourceCodester Drug Recommendation System add_drug.php cross site scripting](https://agentprime.io/advisories/CVE-2026-105705.md)
  `CVE-2026-105705` · CVE record: SourceCodester Drug Recommendation System · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE](https://agentprime.io/advisories/CVE-2026-105764.md)
  `CVE-2026-105764` · CVE record: immich-app immich · CVSS 7.7 High · Not analysed yet · Published 5 Oct 2026 · Tags: Code injection
- [fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution](https://agentprime.io/advisories/GHSA-27vj-qcqg-25rc.md)
  `GHSA-27vj-qcqg-25rc`, `CVE-2026-104851`, `PYSEC-2026-4217` · PyPI `fsspec`: affected `>=0.9.0, <2026.6.0`, fixed in `2026.6.0` · CVSS 8.8 High · Not analysed yet · Published 5 Oct 2026 · Tags: Code injection
- [Tinypool: Prototype Pollution Gadget to RCE in run() options](https://agentprime.io/advisories/GHSA-85c8-ppgw-ccpr.md)
  `GHSA-85c8-ppgw-ccpr`, `CVE-2026-104849` · npm `tinypool`: affected `<2.1.2`, fixed in `2.1.2` · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Code injection, Prototype pollution
- [Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description](https://agentprime.io/advisories/GHSA-w584-2h2r-2hvf.md)
  `GHSA-w584-2h2r-2hvf`, `CVE-2026-51886`, `PYSEC-2026-4236` · PyPI `langflow`: affected `>=1.7.2, <1.10.1`, fixed in `1.10.1` · CVSS 8.8 High · Not analysed yet · Published 5 Oct 2026 · Tags: Code injection
- [Langflow: Prompt injection in Langflow Smart Transform can lead to code execution](https://agentprime.io/advisories/GHSA-9fpm-3445-2vx4.md)
  `GHSA-9fpm-3445-2vx4`, `CVE-2026-7700`, `PYSEC-2026-4232` · PyPI `langflow`: affected `>=1.3.0, <1.10.3`, fixed in `1.10.3` · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, Code injection
- [Apache Struts: OGNL injection in the legacy RESTful action mapper](https://agentprime.io/advisories/CVE-2026-104711.md)
  `CVE-2026-104711` · CVE record: Apache Software Foundation Apache Struts · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Code injection
- [auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF](https://agentprime.io/advisories/CVE-2026-12171.md)
  `CVE-2026-12171` · CVE record: cookpete auto-changelog · CVSS 8.4 High · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal, Command injection, Code injection, Server-side request forgery (SSRF)
- [TallCMS PluginManager ThemeManager.php code injection](https://agentprime.io/advisories/CVE-2026-105329.md)
  `CVE-2026-105329` · CVE record: TallCMS · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, Code injection
- [feelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting](https://agentprime.io/advisories/CVE-2026-105291.md)
  `CVE-2026-105291` · CVE record: feelec-yishu feelcrm-os · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripting](https://agentprime.io/advisories/CVE-2026-105289.md)
  `CVE-2026-105289` · CVE record: feelec-yishu feelcrm-os · CVSS 5.1 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [feelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scripting](https://agentprime.io/advisories/CVE-2026-105288.md)
  `CVE-2026-105288` · CVE record: feelec-yishu feelcrm-os · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site scripting (XSS), Code injection
- [WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.22 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-105064.md)
  `CVE-2026-105064` · CVE record: Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Code injection
- [Mitel MiVoice Office 400 Music on Hold WAV File Upload Code Execution](https://agentprime.io/advisories/CVE-2026-104811.md)
  `CVE-2026-104811` · CVE record: Mitel Mitel MiVoice Office 400 · CVSS 8.4 High · Not analysed yet · Published 5 Oct 2026 · Tags: Code injection, Unrestricted file upload, CWE-20, CWE-829

Newest: <https://agentprime.io/advisories/tag/code-injection.md>
Older: <https://agentprime.io/advisories/tag/code-injection.md?cursor=WyIyMDI2LTEwLTA1VDA4OjM0OjM4LjEwMjAwMFoiLCJDVkUtMjAyNi0xMDQ4MTEiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=code-injection&cursor=WyIyMDI2LTEwLTA4VDE3OjUyOjMyLjAwMDAwMFoiLCJHSFNBLThyNXgtZm0zZi13aHdqIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/code-injection/?cursor=WyIyMDI2LTEwLTA4VDE3OjUyOjMyLjAwMDAwMFoiLCJHSFNBLThyNXgtZm0zZi13aHdqIl0>. Everything for agents: <https://agentprime.io/llms.txt>.