# Command injection.

Untrusted input reaching a shell or operating-system command. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Guardian Language-System Unauthenticated OS Command Injection via id Parameter in transcribe_amazon.php](https://agentprime.io/advisories/CVE-2026-34115.md)
  `CVE-2026-34115` · CVE record: guardian language-system · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: Command injection
- [Guardian Language-System Unauthenticated OS Command Injection via id Parameter in translate_text.php](https://agentprime.io/advisories/CVE-2026-34114.md)
  `CVE-2026-34114` · CVE record: guardian language-system · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: Command injection
- [Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech_text.php](https://agentprime.io/advisories/CVE-2026-34113.md)
  `CVE-2026-34113` · CVE record: guardian language-system · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: Command injection
- [Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac.php](https://agentprime.io/advisories/CVE-2026-34112.md)
  `CVE-2026-34112` · CVE record: guardian language-system · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: Command injection
- [Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac_text.php](https://agentprime.io/advisories/CVE-2026-34111.md)
  `CVE-2026-34111` · CVE record: guardian language-system · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: Command injection
- [Guardian Language-System Unauthenticated OS Command Injection via id Parameter in complex_start.php](https://agentprime.io/advisories/CVE-2026-34110.md)
  `CVE-2026-34110` · CVE record: guardian language-system · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: Command injection
- [Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech.php](https://agentprime.io/advisories/CVE-2026-34109.md)
  `CVE-2026-34109` · CVE record: guardian language-system · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: Command injection
- [Guardian Language-System Unauthenticated OS Command Injection via id Parameter in text.php](https://agentprime.io/advisories/CVE-2026-34108.md)
  `CVE-2026-34108` · CVE record: guardian language-system · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: Command injection
- [Guardian Language-System Unauthenticated OS Command Injection via id Parameter in translate.php](https://agentprime.io/advisories/CVE-2026-34107.md)
  `CVE-2026-34107` · CVE record: guardian language-system · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: Command injection
- [Guardian Language-System Unauthenticated OS Command Injection via id Parameter in subtitles.php](https://agentprime.io/advisories/CVE-2026-34106.md)
  `CVE-2026-34106` · CVE record: guardian language-system · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Jul 2026 · Tags: Command injection
- [JAIOTlink C492A-W6 4.8.30.57701411 OS Command Injection via SetMAC Endpoint](https://agentprime.io/advisories/CVE-2026-58452.md)
  `CVE-2026-58452` · CVE record: JAIOTlink C492A-W6 Wi-Fi IP Camera · CVSS 8.7 High · Not analysed yet · Published 1 Jul 2026 · Tags: Command injection
- [OS command injection in Seiko Solutions Inc. SkyBridge MB-A100/MB-A110](https://agentprime.io/advisories/CVE-2026-50043.md)
  `CVE-2026-50043` · CVE record: Seiko Solutions Inc. SkyBridge MB-A100/MB-A110 · CVSS 8.6 High · Not analysed yet · Published 1 Jul 2026 · Tags: Command injection
- [An unauthenticated command injection vulnerability in the /goform/fast_setting_internet_set endpoint of Tenda AC18 v15.03.05.05 allows attackers to execute arbitrary commands via a crafted payload in…](https://agentprime.io/advisories/CVE-2026-38142.md)
  `CVE-2026-38142` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Command injection
- [OS Command Injection in StoneFly Storage Concentrator](https://agentprime.io/advisories/CVE-2026-56413.md)
  `CVE-2026-56413` · CVE record: StoneFly Storage Concentrator and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: Command injection
- [OS Command Injection in StoneFly Storage Concentrator](https://agentprime.io/advisories/CVE-2026-56415.md)
  `CVE-2026-56415` · CVE record: Stonefly Storage Concentrator and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jun 2026 · Tags: Command injection
- [Coolify: Authenticated RCE via command injection in CA certificate management feature](https://agentprime.io/advisories/CVE-2026-27957.md)
  `CVE-2026-27957` · CVE record: coollabsio coolify · CVSS 8.8 High · Not analysed yet · Published 30 Jun 2026 · Tags: Command injection
- [Coolify: Command Injection via Single-Quote Breakout in \`executeInDocker()\`](https://agentprime.io/advisories/CVE-2026-27955.md)
  `CVE-2026-27955` · CVE record: coollabsio coolify · CVSS 6.6 Medium · Not analysed yet · Published 30 Jun 2026 · Tags: Command injection
- [OS command injection in Gotcha Gotcha Games Inc. RPG MAKER MV and others](https://agentprime.io/advisories/CVE-2026-56137.md)
  `CVE-2026-56137` · CVE record: Gotcha Gotcha Games Inc. RPG MAKER MV and 1 more · CVSS 8.4 High · Not analysed yet · Published 30 Jun 2026 · Tags: Command injection
- [OS command injection in AVTECH Security Corporation DGM3103SCT](https://agentprime.io/advisories/CVE-2026-56808.md)
  `CVE-2026-56808` · CVE record: AVTECH Security Corporation DGM3103SCT · CVSS 8.6 High · Not analysed yet · Published 30 Jun 2026 · Tags: Command injection
- [Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management](https://agentprime.io/advisories/CVE-2026-34594.md)
  `CVE-2026-34594` · CVE record: coollabsio coolify · CVSS 8.8 High · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [Coolify: Authenticated Host RCE](https://agentprime.io/advisories/CVE-2026-34597.md)
  `CVE-2026-34597` · CVE record: coollabsio coolify · CVSS 8.8 High · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [luci-proto-openvpn - Command Injection via cl_meta Parameter in generateKey](https://agentprime.io/advisories/CVE-2026-58000.md)
  `CVE-2026-58000` · CVE record: openwrt luci-proto-openvpn · CVSS 8.7 High · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [luci-app-tailscale-community - Command Injection via tailscale.do_login RPC](https://agentprime.io/advisories/CVE-2026-57999.md)
  `CVE-2026-57999` · CVE record: openwrt luci-app-tailscale-community · CVSS 7.7 High · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [Edimax EW-7478APC POST Request formStaDrvSetup os command injection](https://agentprime.io/advisories/CVE-2026-13581.md)
  `CVE-2026-13581` · CVE record: Edimax EW-7478APC · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [Vscode-java: vscode: command injection vulnerability in the javadoc hover provider of the vscode-java extension](https://agentprime.io/advisories/CVE-2026-12856.md)
  `CVE-2026-12856` · CVE record: Red Hat Red Hat OpenShift Dev Spaces 3.29 · CVSS 8.8 High · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper](https://agentprime.io/advisories/GHSA-4p62-hqp5-g644.md)
  `GHSA-4p62-hqp5-g644`, `CVE-2026-47708`, `PYSEC-2026-544` · PyPI `stata-mcp`: affected `<1.17.3`, fixed in `1.17.3` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [terminal-controller-mcp vulnerable to Command Injection](https://agentprime.io/advisories/GHSA-h4rf-624j-gj33.md)
  `GHSA-h4rf-624j-gj33`, `CVE-2025-61492`, `PYSEC-2026-551` · PyPI `terminal-controller`: affected `<=0.1.7`, no fixed version yet · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [utcp-cli Vulnerable to Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol](https://agentprime.io/advisories/GHSA-33p6-5jxp-p3x4.md)
  `GHSA-33p6-5jxp-p3x4`, `CVE-2026-45369`, `PYSEC-2026-560` · PyPI `utcp-cli`: affected `<1.1.2`, fixed in `1.1.2` · CVSS 8.3 High · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [PraisonAI has an incomplete fix for CVE-2026-34935 - OS Command Injection](https://agentprime.io/advisories/GHSA-9qhq-v63v-fv3j.md)
  `GHSA-9qhq-v63v-fv3j`, `CVE-2026-41497`, `PYSEC-2026-473` · PyPI `praisonai`: affected `<4.5.149`, fixed in `4.5.149` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [PraisonAI Vulnerable to OS Command Injection](https://agentprime.io/advisories/GHSA-2763-cj5r-c79m.md)
  `GHSA-2763-cj5r-c79m`, `CVE-2026-40088`, `PYSEC-2026-461` · PyPI `praisonai`: affected `<4.5.121`, fixed in `4.5.121` · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py)](https://agentprime.io/advisories/GHSA-v7px-3835-7gjx.md)
  `GHSA-v7px-3835-7gjx`, `CVE-2026-40111`, `PYSEC-2026-487` · PyPI `praisonaiagents`: affected `<1.5.128`, fixed in `1.5.128` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [Upsonic: remote code execution vulnerability in its MCP server/task creation functionality](https://agentprime.io/advisories/GHSA-cw73-5f7h-m4gv.md)
  `GHSA-cw73-5f7h-m4gv`, `CVE-2026-30625`, `PYSEC-2026-559` · PyPI `upsonic`: affected `<0.72.0`, fixed in `0.72.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()](https://agentprime.io/advisories/GHSA-9gm9-c8mq-vq7m.md)
  `GHSA-9gm9-c8mq-vq7m`, `CVE-2026-34935`, `PYSEC-2026-471` · PyPI `praisonai`: affected `>=4.5.15, <4.5.69`, fixed in `4.5.69` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [pymetasploit3 vulnerable to command injection in console.run_module_with_output()](https://agentprime.io/advisories/GHSA-qpc3-8vqg-8g6w.md)
  `GHSA-qpc3-8vqg-8g6w`, `CVE-2026-5463`, `PYSEC-2026-500` · PyPI `pymetasploit3`: affected `<=1.0.6`, no fixed version yet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [PraisonAI has critical RCE via \`type: job\` workflow YAML](https://agentprime.io/advisories/GHSA-vc46-vw85-3wvm.md)
  `GHSA-vc46-vw85-3wvm`, `CVE-2026-40288`, `PYSEC-2026-477`, `PYSEC-2026-488` · PyPI `praisonai`: affected `<4.5.139`, fixed in `4.5.139` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection, Code injection
- [Mlflow: Command Injection when serving models with enable_mlserver=True](https://agentprime.io/advisories/GHSA-rvhj-8chj-8v3c.md)
  `GHSA-rvhj-8chj-8v3c`, `BIT-mlflow-2026-0596`, `CVE-2026-0596`, `PYSEC-2026-424` · PyPI `mlflow`: affected `<3.9.0`, fixed in `3.9.0` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [Remote Code Execution due to Full Controled File Write in mlflow](https://agentprime.io/advisories/GHSA-5p3h-7fwh-92rc.md)
  `GHSA-5p3h-7fwh-92rc`, `BIT-mlflow-2023-6018`, `CVE-2023-6018`, `PYSEC-2026-417` · PyPI `mlflow`: affected `<2.9.2`, fixed in `2.9.2` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.48 · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [Mocodo vulnerable to SQL injection in \`/web/generate.php\`](https://agentprime.io/advisories/GHSA-j6cv-98jx-mrwr.md)
  `GHSA-j6cv-98jx-mrwr`, `CVE-2024-35374`, `PYSEC-2026-426` · PyPI `mocodo`: affected `<4.2.7`, fixed in `4.2.7` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [llama-index-core Command Injection vulnerability](https://agentprime.io/advisories/GHSA-r6gp-rff2-p3hf.md)
  `GHSA-r6gp-rff2-p3hf`, `CVE-2024-3271`, `PYSEC-2026-396` · PyPI `llama-index-core`: affected `<0.10.24`, fixed in `0.10.24` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool](https://agentprime.io/advisories/GHSA-4c65-9gqf-4w8h.md)
  `GHSA-4c65-9gqf-4w8h`, `CVE-2025-67511`, `PYSEC-2026-302` · PyPI `cai-framework`: affected `<=0.5.9`, no fixed version yet · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [TkEasyGUI Vulnerable to OS Command Injection](https://agentprime.io/advisories/GHSA-hfrj-3w3g-jv32.md)
  `GHSA-hfrj-3w3g-jv32`, `CVE-2025-55037`, `PYSEC-2026-552` · PyPI `tkeasygui`: affected `<1.0.22`, fixed in `1.0.22` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [mcp-kubernetes-server has an OS Command Injection vulnerability](https://agentprime.io/advisories/GHSA-4hqq-7q79-932p.md)
  `GHSA-4hqq-7q79-932p`, `CVE-2025-59377`, `PYSEC-2026-409` · PyPI `mcp-kubernetes-server`: affected `<=0.1.11`, no fixed version yet · CVSS 3.7 Low · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [Edimax EW-7478APC POST Request formiNICbasic os command injection](https://agentprime.io/advisories/CVE-2026-13561.md)
  `CVE-2026-13561` · CVE record: Edimax EW-7478APC · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [Edimax EW-7478APC POST Request formAccept os command injection](https://agentprime.io/advisories/CVE-2026-13560.md)
  `CVE-2026-13560` · CVE record: Edimax EW-7478APC · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [D-Link DCS-935L POST Parameter setconf.cgi sub_400E40 os command injection](https://agentprime.io/advisories/CVE-2026-13545.md)
  `CVE-2026-13545` · CVE record: D-Link DCS-935L · CVSS 8.7 High · Not analysed yet · Published 29 Jun 2026 · Tags: Command injection
- [Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_401D68 command injection](https://agentprime.io/advisories/CVE-2026-13538.md)
  `CVE-2026-13538` · CVE record: Wavlink WL-NU516U1-A · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Other injection, Command injection
- [antlr ANTLR4 gofmt GoTarget.java GoTarget command injection](https://agentprime.io/advisories/CVE-2026-13501.md)
  `CVE-2026-13501` · CVE record: antlr ANTLR4 · CVSS 4.8 Medium · Not analysed yet · Published 28 Jun 2026 · Tags: Other injection, Command injection
- [pnpm: Repository-controlled configDependencies can select a pacquet native install engine](https://agentprime.io/advisories/GHSA-gj8w-mvpf-x27x.md)
  `GHSA-gj8w-mvpf-x27x`, `CVE-2026-55697` · npm `pnpm`: affected `<10.34.2 || >=11.0.0, <11.5.3`, fixed in `10.34.2`, `11.5.3` · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: Command injection, CWE-494, CWE-829
- [H.VIEW HV-500S6 IP Camera OS Command Injection](https://agentprime.io/advisories/CVE-2026-55975.md)
  `CVE-2026-55975` · CVE record: H.VIEW HV-500S6 IP Camera · CVSS 8.6 High · Not analysed yet · Published 26 Jun 2026 · Tags: Command injection
- [pnpm: Git Fetch Argument Injection via Lockfile resolution.commit](https://agentprime.io/advisories/GHSA-p4xf-rf54-rj3x.md)
  `GHSA-p4xf-rf54-rj3x`, `CVE-2026-50014` · npm `pnpm`: affected `<10.34.0 || >=11.0.0, <11.4.0`, fixed in `10.34.0`, `11.4.0` · CVSS 6.4 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: Command injection
- [php-weasyprint: shell command injection via configurable WeasyPrint binary path due to inverted is_executable() guard (mirror of KnpLabs/snappy GHSA-vpr4-p6fq-85jc)](https://agentprime.io/advisories/GHSA-f5gc-qxf8-mh9g.md)
  `GHSA-f5gc-qxf8-mh9g`, `CVE-2026-49260`, `PKSA-p9k4-v53c-c7zd` · Packagist `pontedilana/php-weasyprint`: affected `<2.5.1`, fixed in `2.5.1` · CVSS 8.2 High · Not analysed yet · Published 26 Jun 2026 · Tags: Command injection
- [Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in \`AuthenticationFilter\`](https://agentprime.io/advisories/CVE-2026-49869.md)
  `CVE-2026-49869` · CVE record: kestra-io kestra · CVSS 10.0 Critical · Critical (KEV, CVSS 9+) · In CISA KEV · Not analysed yet · Published 26 Jun 2026 · Tags: Command injection, Authentication bypass, Server-side request forgery (SSRF), CWE-184
- [Notepad++: Arbitrary Code Execution via config.xml commandLineInterpreter](https://agentprime.io/advisories/CVE-2026-48778.md)
  `CVE-2026-48778` · CVE record: notepad-plus-plus notepad-plus-plus · CVSS 7.8 High · Not analysed yet · Published 26 Jun 2026 · Tags: Command injection
- [Notepad++: Arbitrary Code Execution via shortcuts.xml UserCommand Injection](https://agentprime.io/advisories/CVE-2026-48800.md)
  `CVE-2026-48800` · CVE record: notepad-plus-plus notepad-plus-plus · CVSS 7.8 High · Not analysed yet · Published 26 Jun 2026 · Tags: Command injection
- [Cudy LT300 3.0 OS Command Injection via NTP Configuration](https://agentprime.io/advisories/CVE-2026-32833.md)
  `CVE-2026-32833` · CVE record: Shenzhen Cudy Technology Co., Ltd. LT300 3.0 · CVSS 8.7 High · Not analysed yet · Published 26 Jun 2026 · Tags: Command injection
- [@cyclonedx/cdxgen: Maven project scanning may allow shell command injection through repository-controlled module paths](https://agentprime.io/advisories/GHSA-5vwr-qchf-q4pf.md)
  `GHSA-5vwr-qchf-q4pf` · npm `@cyclonedx/cdxgen`: affected `<12.4.3`, fixed in `12.4.3` · CVSS 4.0, no score published · Not analysed yet · Published 26 Jun 2026 · Tags: Command injection
- [Dokku: OS Command Injection via app.json managed Cron](https://agentprime.io/advisories/CVE-2026-54636.md)
  `CVE-2026-54636` · CVE record: dokku dokku · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Command injection
- [Dokku: OS Command Injection via App Name in Git Pre-Receive Hook](https://agentprime.io/advisories/CVE-2026-45408.md)
  `CVE-2026-45408` · CVE record: dokku dokku · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2026 · Tags: Command injection
- [OS command injection in Dell Container Storage Modules](https://agentprime.io/advisories/CVE-2026-40711.md)
  `CVE-2026-40711` · CVE record: Dell Container Storage Modules · CVSS 8.0 High · Not analysed yet · Published 26 Jun 2026 · Tags: Command injection
- [Duplicate Advisory: Flowise has unsandboxed remote code execution via Custom MCP](https://agentprime.io/advisories/GHSA-q2xp-j85q-883h.md)
  `GHSA-q2xp-j85q-883h` · npm `flowise`: affected `>=2.2.7-patch.1, <3.0.6`, fixed in `3.0.6` · CVSS 9.8 Critical · Withdrawn · Not analysed yet · Published 26 Jun 2026 · Tags: Command injection

Newest: <https://agentprime.io/advisories/tag/command-injection.md>
Older: <https://agentprime.io/advisories/tag/command-injection.md?cursor=WyIyMDI2LTA2LTI2VDAwOjMyOjA1LjAwMDAwMFoiLCJHSFNBLXEyeHAtajg1cS04ODNoIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=command-injection&cursor=WyIyMDI2LTA3LTAxVDE2OjIzOjI0Ljc2MDAwMFoiLCJDVkUtMjAyNi0zNDExNiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/command-injection/?cursor=WyIyMDI2LTA3LTAxVDE2OjIzOjI0Ljc2MDAwMFoiLCJDVkUtMjAyNi0zNDExNiJd>. Everything for agents: <https://agentprime.io/llms.txt>.