# CWE-116.

Every Advisory and CVE whose sources give the weakness CWE-116, newest first.

## Records, newest first

- [Zammad: Stored XSS in ticket article rendering in the new Vue-based interface](https://agentprime.io/advisories/CVE-2026-102345.md)
  `CVE-2026-102345` · CVE record: zammad zammad · CVSS 5.1 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename](https://agentprime.io/advisories/CVE-2026-120647.md)
  `CVE-2026-120647` · CVE record · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-116
- [CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values](https://agentprime.io/advisories/CVE-2026-120644.md)
  `CVE-2026-120644` · CVE record · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-116
- [fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator](https://agentprime.io/advisories/CVE-2026-63471.md)
  `CVE-2026-63471` · CVE record: koxudaxi fastapi-code-generator · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Code injection, CWE-116
- [fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict](https://agentprime.io/advisories/CVE-2026-63469.md)
  `CVE-2026-63469` · CVE record: koxudaxi fastapi-code-generator · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Code injection, CWE-116
- [fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring](https://agentprime.io/advisories/CVE-2026-63470.md)
  `CVE-2026-63470` · CVE record: koxudaxi fastapi-code-generator · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Code injection, CWE-116
- [Elo Ruby backend has Remote Code Execution via unescaped \`#{...}\` interpolation in emitted string literals and subtype-constraint labels](https://agentprime.io/advisories/GHSA-7w38-ggh5-v542.md)
  `GHSA-7w38-ggh5-v542`, `CVE-2026-44266` · npm `@enspirit/elo`: affected `<1.0.1`, fixed in `1.0.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Code injection, CWE-116
- [Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks](https://agentprime.io/advisories/CVE-2024-12139.md)
  `CVE-2024-12139` · CVE record: WSO2 WSO2 API Manager and 2 more · CVSS 4.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-116
- [Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal](https://agentprime.io/advisories/CVE-2026-83559.md)
  `CVE-2026-83559` · CVE record: Apache Software Foundation Apache Wicket · CVSS 7.4 High · Not analysed yet · Published 1 Nov 2026 · Tags: CWE-116
- [Refitter: C# source injection through OpenAPI header parameter names](https://agentprime.io/advisories/CVE-2026-63346.md)
  `CVE-2026-63346` · CVE record: christianhelle refitter · CVSS 8.6 High · Not analysed yet · Published 30 Oct 2026 · Tags: Code injection, CWE-116
- [Refitter: C# source injection through OpenAPI content-type map keys](https://agentprime.io/advisories/CVE-2026-63344.md)
  `CVE-2026-63344` · CVE record: christianhelle refitter · CVSS 8.6 High · Not analysed yet · Published 30 Oct 2026 · Tags: Code injection, CWE-116
- [Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field](https://agentprime.io/advisories/CVE-2026-104368.md)
  `CVE-2026-104368` · CVE record: webtoffee Export and Import Users and Customers · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-116
- [Seroval: Script injection through RegExp sources in serialized output](https://agentprime.io/advisories/GHSA-9wx9-5pv9-3349.md)
  `GHSA-9wx9-5pv9-3349`, `CVE-2026-116582` · npm `seroval`: affected `<1.0.0 || >=1.5.5, <1.6.10`, fixed in `1.0.0`, `1.6.10` · CVSS 4.7 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Vue I18n: \`escapeParameter\` does not escape named values when the same call also passes a list](https://agentprime.io/advisories/GHSA-8rc2-428q-7ww3.md)
  `GHSA-8rc2-428q-7ww3`, `CVE-2026-118256` · npm `@intlify/core` and 4 more: affected `>=9.0.0-beta.10, <11.4.14 || >=12.0.0-alpha.1, <12.0.0-alpha.5`, fixed in `11.4.14`, `12.0.0-alpha.5` · CVSS 2.1 Low · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages](https://agentprime.io/advisories/GHSA-83rm-6c8r-g728.md)
  `GHSA-83rm-6c8r-g728`, `CVE-2026-118257` · npm `@intlify/core` and 5 more: affected `>=11.1.10, <11.4.14 || >=12.0.0-alpha.4, <12.0.0-alpha.5`, fixed in `11.4.14`, `12.0.0-alpha.5` · CVSS 7.2 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (\_escape()) - full graph wipe from ingested-document content](https://agentprime.io/advisories/GHSA-vqrg-773h-4wxc.md)
  `GHSA-vqrg-773h-4wxc`, `CVE-2026-114510` · PyPI `flexible-graphrag`: affected `>=0.6.0, <0.8.2`, fixed in `0.8.2` · CVSS 7.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Other injection, CWE-116
- [Satori-generated SVG has improper escaping](https://agentprime.io/advisories/GHSA-wx4j-mvgx-mqwp.md)
  `GHSA-wx4j-mvgx-mqwp`, `CVE-2026-94545` · npm `satori`: affected `>=0.0.27, <0.33.5`, fixed in `0.33.5` · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-116
- [qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection](https://agentprime.io/advisories/CVE-2026-110910.md)
  `CVE-2026-110910` · CVE record: ljharb qs · CVSS 6.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-116
- [OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts](https://agentprime.io/advisories/CVE-2026-116815.md)
  `CVE-2026-116815` · CVE record: Openpanel-dev openpanel · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-116
- [fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references](https://agentprime.io/advisories/GHSA-333x-w4r6-6crp.md)
  `GHSA-333x-w4r6-6crp`, `CVE-2026-110725` · npm `fast-uri`: affected `<2.4.8 || >=3.0.0, <3.1.9 || >=4.0.0, <4.2.3`, fixed in `2.4.8`, `3.1.9`, `4.2.3` · CVSS 3.7 Low · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-41, CWE-116
- [Goobi viewer: cleanUpQuery double-brace bypass allows arbitrary Solr local-param injection](https://agentprime.io/advisories/CVE-2026-55442.md)
  `CVE-2026-55442` · CVE record: intranda goobi-viewer-core · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-20, CWE-116
- [Vitest: Code injection via unauthenticated manual mock registration](https://agentprime.io/advisories/GHSA-qxg6-89mg-rqv8.md)
  `GHSA-qxg6-89mg-rqv8`, `CVE-2026-112949` · npm `@vitest/mocker`: affected `>=2.1.0-beta.7, <4.1.12 || >=5.0.0-beta.1, <5.0.3`, fixed in `4.1.12`, `5.0.3` · CVSS 4.7 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Code injection, Authentication bypass, CWE-116
- [Improper Encoding of Server-Supplied JavaScript Values in MongoDB Compass BSON Parsing](https://agentprime.io/advisories/CVE-2026-113870.md)
  `CVE-2026-113870` · CVE record: MongoDB Compass · CVSS 8.6 High · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-116
- [virtualenv bash activate runs commands from an environment name with a backslash before $](https://agentprime.io/advisories/GHSA-vxj4-q4g9-crj7.md)
  `GHSA-vxj4-q4g9-crj7`, `BIT-virtualenv-2026-113725`, `CVE-2026-113725` · PyPI `virtualenv`: affected `<21.14.7`, fixed in `21.14.7` · CVSS 7.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Command injection, CWE-116
- [virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST](https://agentprime.io/advisories/GHSA-5vjq-rrrf-7h2q.md)
  `GHSA-5vjq-rrrf-7h2q`, `BIT-virtualenv-2026-113726`, `CVE-2026-113726` · PyPI `virtualenv`: affected `<21.14.4`, fixed in `21.14.4` · CVSS 7.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Command injection, CWE-116
- [virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote](https://agentprime.io/advisories/GHSA-c947-3pg5-gm8q.md)
  `GHSA-c947-3pg5-gm8q`, `BIT-virtualenv-2026-113732`, `CVE-2026-113732` · PyPI `virtualenv`: affected `<21.14.2`, fixed in `21.14.2` · CVSS 7.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Command injection, CWE-116
- [HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer](https://agentprime.io/advisories/CVE-2026-14556.md)
  `CVE-2026-14556` · CVE record: Unknown HappyForms · CVSS 5.4 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-116
- [Stanza injection in XMPP chat](https://agentprime.io/advisories/CVE-2026-113867.md)
  `CVE-2026-113867` · CVE record: Mozilla Thunderbird · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-116
- [ApostropheCMS: CAPTCHA response token not URL-encoded](https://agentprime.io/advisories/GHSA-44qr-rrjg-2cqq.md)
  `GHSA-44qr-rrjg-2cqq`, `CVE-2026-113667` · npm `@apostrophecms/form` and 2 more: affected `<1.5.5`, fixed in `1.5.5` · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-116
- [Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML](https://agentprime.io/advisories/GHSA-2658-85cv-9wwq.md)
  `GHSA-2658-85cv-9wwq`, `CVE-2026-111059` · PyPI `mercury`: affected `>=3.0.0, <3.2.11`, fixed in `3.2.11` · CVSS 6.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine](https://agentprime.io/advisories/CVE-2026-110757.md)
  `CVE-2026-110757` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-116
- [Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print](https://agentprime.io/advisories/CVE-2026-110756.md)
  `CVE-2026-110756` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-116
- [swoosh has email-derived URL path injection in Microsoft Graph endpoint](https://agentprime.io/advisories/GHSA-754j-98wh-57rf.md)
  `GHSA-754j-98wh-57rf`, `CVE-2026-54893`, `EEF-CVE-2026-54893` · Hex `swoosh`: affected `>=1.12.0, <1.26.3`, fixed in `1.26.3` · CVSS 2.1 Low · Not analysed yet · Published 16 Oct 2026 · Tags: Denial of service, CWE-116, CWE-1284
- [Improper Encoding or Escaping of Output in Crafty Controller](https://agentprime.io/advisories/CVE-2026-18516.md)
  `CVE-2026-18516` · CVE record: Arcadia Technology, LLC Crafty Controller · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-116
- [Vitess vttablet /twopcz reflected XSS](https://agentprime.io/advisories/GHSA-v75v-6fpf-gvw8.md)
  `GHSA-v75v-6fpf-gvw8`, `CVE-2026-104252`, `GO-2026-6798` · Go `vitess.io/vitess`: affected `<0.23.5 || >=0.24.0, <0.24.2`, fixed in `0.23.5`, `0.24.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [unstructured: Stored XSS via unescaped HTML generation](https://agentprime.io/advisories/GHSA-v5mq-3xhg-98m9.md)
  `GHSA-v5mq-3xhg-98m9`, `CVE-2026-104250` · PyPI `unstructured`: affected `<0.24.1`, fixed in `0.24.1` · CVSS 6.1 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [BottleCRM 0.30 through 1.14.5 HTML Injection via Custom Invoice PDF Template](https://agentprime.io/advisories/CVE-2026-110592.md)
  `CVE-2026-110592` · CVE record: MicroPyramid BottleCRM · CVSS 5.1 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-116
- [NetBird client SSH config Match line injection via peer FQDN or hostname allows local command execution](https://agentprime.io/advisories/CVE-2026-105429.md)
  `CVE-2026-105429` · CVE record: NetBird NetBird · CVSS 8.9 High · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection, CWE-116
- [Visual Studio Code Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-102235.md)
  `CVE-2026-102235` · CVE record: Microsoft Visual Studio Code · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-116
- [Unauthenticated queue manipulation through connector SSRF and response injection in Progress ShareFile Storage Zones Controller](https://agentprime.io/advisories/CVE-2026-93693.md)
  `CVE-2026-93693` · CVE record: Progress ShareFile Storage Zones Controller · CVSS 6.5 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Authentication bypass, Server-side request forgery (SSRF), CWE-20, CWE-116
- [Contao: Cross-site scripting in the comments bundle](https://agentprime.io/advisories/GHSA-628f-v4f6-p37r.md)
  `GHSA-628f-v4f6-p37r`, `CVE-2026-107845`, `PKSA-c42s-m9fj-8jxw` · Packagist `contao/comments-bundle`: affected `>=4.0.0, <5.3.50 || >=5.4.0-RC1, <5.7.12`, fixed in `5.3.50`, `5.7.12` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [MariaDB: privilege escalation via incorrect view frm parsing](https://agentprime.io/advisories/CVE-2026-107823.md)
  `CVE-2026-107823` · CVE record: MariaDB server · CVSS 7.2 High · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-116, CWE-144
- [FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header](https://agentprime.io/advisories/CVE-2026-107393.md)
  `CVE-2026-107393` · CVE record: freescout-help-desk freescout · CVSS 6.1 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [PraisonAI: API deploy code generator embeds unescaped YAML fields into Python source](https://agentprime.io/advisories/GHSA-79fv-7hq9-w7xg.md)
  `GHSA-79fv-7hq9-w7xg`, `CVE-2026-61433`, `PYSEC-2026-4251` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 8.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Code injection, CWE-116
- [Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates](https://agentprime.io/advisories/GHSA-xw65-4hp5-5hc7.md)
  `GHSA-xw65-4hp5-5hc7`, `CVE-2026-106444` · npm `handlebars`: affected `>=4.0.0, <4.7.10`, fixed in `4.7.10` · CVSS 4.7 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-116
- [PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats](https://agentprime.io/advisories/GHSA-fj8f-m44g-c479.md)
  `GHSA-fj8f-m44g-c479`, `CVE-2026-61439`, `PYSEC-2026-4255` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 8.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-116, CWE-693, CWE-1188, CWE-1287
- [Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained](https://agentprime.io/advisories/GHSA-5m6h-8g35-p3m7.md)
  `GHSA-5m6h-8g35-p3m7`, `CVE-2026-106107` · npm `@quasar/app-vite`: affected `<3.3.0`, fixed in `3.3.0` · CVSS 8.3 High · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()](https://agentprime.io/advisories/GHSA-pq96-jpmf-w254.md)
  `GHSA-pq96-jpmf-w254`, `CVE-2026-106102` · npm `quasar`: affected `<2.22.0`, fixed in `2.22.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content](https://agentprime.io/advisories/CVE-2026-105244.md)
  `CVE-2026-105244` · CVE record: Apache Software Foundation Apache log4net · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-116
- [openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation](https://agentprime.io/advisories/GHSA-5293-mq8x-g3xj.md)
  `GHSA-5293-mq8x-g3xj`, `CVE-2026-105801`, `PYSEC-2026-4245` · PyPI `openapi-python-client`: affected `<0.29.1`, fixed in `0.29.1` · CVSS 8.4 High · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection, CWE-116, CWE-150
- [@vue/server-renderer: XSS via missing CR in attribute-name blacklist](https://agentprime.io/advisories/GHSA-g2v6-rqmx-r4w6.md)
  `GHSA-g2v6-rqmx-r4w6` · npm `@vue/server-renderer`: affected `<3.5.42 || >=3.6.0-rc.0, <3.6.0-rc.6`, fixed in `3.5.42`, `3.6.0-rc.6` · CVSS 7.2 High · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF](https://agentprime.io/advisories/GHSA-jqmf-mx4f-hfr6.md)
  `GHSA-jqmf-mx4f-hfr6`, `CVE-2026-114107` · PyPI `vibe-trading-ai`: affected `>=0.1.0, <0.1.7`, fixed in `0.1.7` · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Command injection, Code injection, Server-side request forgery (SSRF), CWE-116
- [MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler](https://agentprime.io/advisories/CVE-2026-104907.md)
  `CVE-2026-104907` · CVE record: MISP MISP · CVSS 4.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Improper output encoding in NVIDIA GeForce and others](https://agentprime.io/advisories/CVE-2026-47562.md)
  `CVE-2026-47562` · CVE record: NVIDIA GeForce and 4 more · CVSS 4.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-116
- [Improper output encoding in Google Chrome](https://agentprime.io/advisories/CVE-2026-95274.md)
  `CVE-2026-95274` · CVE record: Google Chrome · CVSS 8.3 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-116
- [fast-uri vulnerable to authority injection via an unvalidated port in serialize](https://agentprime.io/advisories/GHSA-qw65-cvwx-89v3.md)
  `GHSA-qw65-cvwx-89v3`, `CVE-2026-84292` · npm `fast-uri`: affected `<2.4.6 || >=3.0.0, <3.1.7 || >=4.0.0, <4.1.4`, fixed in `2.4.6`, `3.1.7`, `4.1.4` · CVSS 7.5 High · Not analysed yet · Published 28 Sept 2026 · Tags: CWE-116
- [Angular SSR: XSS via Unescaped Processing Instruction (\<?...?>) Nodes in Fallback Raw-Content Elements](https://agentprime.io/advisories/GHSA-j3r3-mxqp-r2p4.md)
  `GHSA-j3r3-mxqp-r2p4`, `CVE-2026-88058` · npm `@angular/platform-server`: affected `<=19.2.25 || >=20.0.0, <20.3.30 || >=21.0.0, <21.2.22 || >=22.0.0, <22.1.4`, fixed in `20.3.30`, `21.2.22`, `22.1.4` · CVSS 8.6 High · Not analysed yet · Published 28 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [GLPI: Stored XSS in suppliers](https://agentprime.io/advisories/CVE-2026-55214.md)
  `CVE-2026-55214` · CVE record: glpi-project glpi · CVSS 8.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-116
- [Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens](https://agentprime.io/advisories/CVE-2026-63208.md)
  `CVE-2026-63208` · CVE record: zammad zammad · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Information disclosure, CWE-116
- [xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS](https://agentprime.io/advisories/GHSA-j8r4-32c5-33rc.md)
  `GHSA-j8r4-32c5-33rc`, `CVE-2026-61784` · npm `xhtml-purifier`: affected `<0.4.3`, fixed in `0.4.3` · CVSS 6.1 Medium · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116

Older: <https://agentprime.io/advisories/tag/cwe-116.md?cursor=WyIyMDI2LTA5LTI0VDE5OjMzOjIzLjAwMDAwMFoiLCJHSFNBLWo4cjQtMzJjNS0zM3JjIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-116>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-116/>. Everything for agents: <https://agentprime.io/llms.txt>.