# CWE-116.

Every Advisory and CVE whose sources give the weakness CWE-116, newest first.

## Records, newest first (an older page)

- [Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery](https://agentprime.io/advisories/GHSA-7c7c-373r-gfjj.md)
  `GHSA-7c7c-373r-gfjj`, `CVE-2026-82409`, `GO-2026-6585` · Go `github.com/klever-io/klever-go`: affected `<1.7.20`, fixed in `1.7.20` · CVSS 8.4 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-116
- [MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread](https://agentprime.io/advisories/CVE-2026-95659.md)
  `CVE-2026-95659` · CVE record: MISP MISP · CVSS 4.8 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-20, CWE-116
- [Warpgate: x-warpgate-username Header Not Stripped from Client Requests Enables Identity Spoofing to WebSocket Backend Targets](https://agentprime.io/advisories/CVE-2026-63329.md)
  `CVE-2026-63329` · CVE record: warp-tech warpgate · CVSS 4.9 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass, CWE-116
- [draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642](https://agentprime.io/advisories/CVE-2026-58504.md)
  `CVE-2026-58504` · CVE record: jgraph drawio · CVSS 6.1 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Improper output encoding in Synology DiskStation Manager (DSM)](https://agentprime.io/advisories/CVE-2026-13635.md)
  `CVE-2026-13635` · CVE record: Synology DiskStation Manager (DSM) · CVSS 5.3 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-116
- [Improper output encoding in Synology DiskStation Manager (DSM)](https://agentprime.io/advisories/CVE-2026-13684.md)
  `CVE-2026-13684` · CVE record: Synology DiskStation Manager (DSM) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-116
- [Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field](https://agentprime.io/advisories/CVE-2026-54506.md)
  `CVE-2026-54506` · CVE record: givanz Vvveb · CVSS 7.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116, CWE-185
- [djust: A template binding inherits a context safety grant it never earned (XSS)](https://agentprime.io/advisories/GHSA-xjw9-38cr-6372.md)
  `GHSA-xjw9-38cr-6372` · PyPI `djust`: affected `<1.1.2`, fixed in `1.1.2` · CVSS 4.0, no score published · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)](https://agentprime.io/advisories/GHSA-9395-2g46-rj3f.md)
  `GHSA-9395-2g46-rj3f` · PyPI `djust`: affected `<1.1.1`, fixed in `1.1.1` · No CVSS score · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection](https://agentprime.io/advisories/GHSA-465g-fh3v-9jw4.md)
  `GHSA-465g-fh3v-9jw4`, `CVE-2026-77404`, `GO-2026-6493` · Go `github.com/rabbitmq/amqp091-go`: affected `<1.13.0`, fixed in `1.13.0` · CVSS 8.7 High · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-116
- [Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment](https://agentprime.io/advisories/CVE-2026-90999.md)
  `CVE-2026-90999` · CVE record: Functional Software, Inc. Sentry Seer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection, Code injection, CWE-20, CWE-116
- [Royal Elementor Addons < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification Emails](https://agentprime.io/advisories/CVE-2026-13407.md)
  `CVE-2026-13407` · CVE record: Unknown Royal Addons for Elementor · CVSS 6.1 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-116
- [On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhau…](https://agentprime.io/advisories/CVE-2026-19641.md)
  `CVE-2026-19641` · CVE record: Arista Networks EOS · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-116
- [Apache Syncope: CSV export spreadsheet formula injection](https://agentprime.io/advisories/CVE-2026-73195.md)
  `CVE-2026-73195` · CVE record: Apache Software Foundation Apache Syncope · CVSS 7.3 High · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-116
- [Angular: SSR XSS via Unescaped \<template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements](https://agentprime.io/advisories/GHSA-v3p8-whq6-r5jg.md)
  `GHSA-v3p8-whq6-r5jg`, `CVE-2026-88060` · npm `@angular/platform-server`: affected `<=19.2.25 || >=20.0.0, <20.3.30 || >=21.0.0, <21.2.22 || >=22.0.0, <22.1.4`, fixed in `20.3.30`, `21.2.22`, `22.1.4` · CVSS 8.6 High · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [MISP: Unescaped HTML Injection in PDF Report Element Rendering](https://agentprime.io/advisories/CVE-2026-88921.md)
  `CVE-2026-88921` · CVE record: MISP MISP · CVSS 5.1 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover](https://agentprime.io/advisories/CVE-2026-54694.md)
  `CVE-2026-54694` · CVE record: NationalSecurityAgency skills-service · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-20, CWE-116, CWE-183
- [Improper output encoding in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-79964.md)
  `CVE-2026-79964` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-116
- [Improper output encoding in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-79952.md)
  `CVE-2026-79952` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-116
- [Improper output encoding in Google Chrome](https://agentprime.io/advisories/CVE-2026-87550.md)
  `CVE-2026-87550` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-116
- [SWC HTML minifier may allow script element breakout when minifying embedded JSON](https://agentprime.io/advisories/GHSA-5qr2-v392-m9g8.md)
  `GHSA-5qr2-v392-m9g8`, `CVE-2026-72925` · crates.io `swc_html_minifier` and 1 more: affected `<59.0.0`, fixed in `59.0.0` · CVSS 6.1 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69821.md)
  `CVE-2026-69821` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-116
- [ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection](https://agentprime.io/advisories/GHSA-2h3v-83jg-2qmm.md)
  `GHSA-2h3v-83jg-2qmm`, `CVE-2026-82756`, `EEF-CVE-2026-82756` · Hex `ash_authentication_oauth2_server`: affected `>=0.1.3, <0.3.1`, fixed in `0.3.1` · CVSS 6.3 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: CWE-116
- [Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)](https://agentprime.io/advisories/GHSA-fg9p-mrxr-hvq7.md)
  `GHSA-fg9p-mrxr-hvq7`, `CVE-2026-62681` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection, CWE-116
- [Orval: RCE via servers\[\].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)](https://agentprime.io/advisories/GHSA-88f2-fpv8-89q2.md)
  `GHSA-88f2-fpv8-89q2`, `CVE-2026-62682` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection, CWE-116
- [Orval: Import-time RCE via schema default -> zod module-level template literal](https://agentprime.io/advisories/GHSA-w727-8j6c-2rj4.md)
  `GHSA-w727-8j6c-2rj4`, `CVE-2026-72717` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection, CWE-116
- [Orval: Import-time RCE via array-items default -> zod module-level template literal](https://agentprime.io/advisories/GHSA-2h9g-j24r-h63g.md)
  `GHSA-2h9g-j24r-h63g`, `CVE-2026-71869` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection, CWE-116
- [Orval: Import-time RCE via header-parameter default -> zod module-level template literal](https://agentprime.io/advisories/GHSA-8j6p-r8jg-mxqh.md)
  `GHSA-8j6p-r8jg-mxqh`, `CVE-2026-71871` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection, CWE-116
- [Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli](https://agentprime.io/advisories/GHSA-653q-5476-x79g.md)
  `GHSA-653q-5476-x79g`, `CVE-2026-71865` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection, CWE-116
- [Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client](https://agentprime.io/advisories/GHSA-6437-gxhq-pqv8.md)
  `GHSA-6437-gxhq-pqv8`, `CVE-2026-71864` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection, CWE-116
- [Improper output encoding in Jenkins](https://agentprime.io/advisories/CVE-2026-84655.md)
  `CVE-2026-84655` · CVE record: Jenkins Project Jenkins · CVSS 4.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-116
- [xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization](https://agentprime.io/advisories/GHSA-6gmq-8vp8-gcm6.md)
  `GHSA-6gmq-8vp8-gcm6`, `CVE-2026-83610` · npm `xmldom` and 1 more: affected `<=0.6.0`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-116
- [Template injection in Eclipse Foundation Eclipse Ditto](https://agentprime.io/advisories/CVE-2026-82958.md)
  `CVE-2026-82958` · CVE record: Eclipse Foundation Eclipse Ditto · CVSS 7.6 High · Not analysed yet · Published 2 Sept 2026 · Tags: Other injection, Code injection, CWE-116
- [Wallos: iCalendar Injection via CRLF in Subscription Name/Notes Export](https://agentprime.io/advisories/CVE-2026-77353.md)
  `CVE-2026-77353` · CVE record: ellite Wallos · CVSS 4.6 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, CWE-116
- [Query-parameter injection in AshAdmin row-action links via unencoded string primary keys](https://agentprime.io/advisories/GHSA-j89q-xjrh-c26p.md)
  `GHSA-j89q-xjrh-c26p`, `CVE-2026-82681`, `EEF-CVE-2026-82681` · Hex `ash_admin`: affected `>=0.3.0-rc.0, <1.3.1`, fixed in `1.3.1` · CVSS 2.0 Low · Not analysed yet · Published 31 Aug 2026 · Tags: CWE-116
- [MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets](https://agentprime.io/advisories/GHSA-g5xc-5w98-jfvm.md)
  `GHSA-g5xc-5w98-jfvm`, `BIT-mariadb-2026-55855`, `BIT-mariadb-min-2026-55855`, `BIT-mysql-client-2026-55855`, `CVE-2026-55855` · npm `mariadb`: affected `<3.2.4 || >=3.3.0, <3.3.4 || >=3.4.0, <3.4.6 || >=3.5.0, <3.5.3`, fixed in `3.2.4`, `3.3.4`, `3.4.6`, `3.5.3` · CVSS 6.5 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: SQL injection, CWE-116
- [org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output](https://agentprime.io/advisories/GHSA-5rqc-86vf-g8r2.md)
  `GHSA-5rqc-86vf-g8r2`, `CVE-2026-55859` · Maven `org.mariadb:r2dbc-mariadb`: affected `<1.4.1`, fixed in `1.4.1` · CVSS 5.9 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-116, CWE-838
- [PrivateBin has reflected JSON injection in backend responses via unescaped REQUEST_URI](https://agentprime.io/advisories/GHSA-xrjc-c68j-hp7w.md)
  `GHSA-xrjc-c68j-hp7w`, `CVE-2026-55891`, `PKSA-t55m-4nf3-277t` · Packagist `privatebin/privatebin`: affected `<2.0.5`, fixed in `2.0.5` · CVSS 0.0 None · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-116
- [gitoxide before 0.38.2 Credential Helper Protocol Field Injection](https://agentprime.io/advisories/CVE-2026-82249.md)
  `CVE-2026-82249` · CVE record: GitoxideLabs gitoxide · CVSS 2.3 Low · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-116
- [Cross-tenant database retargeting via dot/NUL injection in namespace strings in the C++ Driver](https://agentprime.io/advisories/CVE-2026-81522.md)
  `CVE-2026-81522` · CVE record: MongoDB C++ Driver · CVSS 8.6 High · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-116
- [openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal c...](https://agentprime.io/advisories/GHSA-49h2-qmcq-wvvc.md)
  `GHSA-49h2-qmcq-wvvc`, `CVE-2026-81685`, `PYSEC-2026-3793` · PyPI `openssl-encrypt`: affected `<1.4.9`, fixed in `1.4.9` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-116
- [Improper output encoding in NVIDIA OpenShell](https://agentprime.io/advisories/CVE-2026-65085.md)
  `CVE-2026-65085` · CVE record: NVIDIA OpenShell · CVSS 5.2 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-116
- [eml_parser has a URL extraction bypass via HTML entities in URLs](https://agentprime.io/advisories/GHSA-fxgq-9m89-cxj9.md)
  `GHSA-fxgq-9m89-cxj9`, `CVE-2026-55618`, `PYSEC-2026-3831` · PyPI `eml-parser`: affected `<3.0.2`, fixed in `3.0.2` · CVSS 6.5 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-116
- [Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors](https://agentprime.io/advisories/GHSA-jg4p-g6xj-4qmf.md)
  `GHSA-jg4p-g6xj-4qmf`, `CVE-2026-61824` · npm `defuddle`: affected `<0.19.1`, fixed in `0.19.1` · CVSS 8.2 High · Not analysed yet · Published 21 Aug 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username](https://agentprime.io/advisories/GHSA-w4mq-xh27-6xpx.md)
  `GHSA-w4mq-xh27-6xpx`, `CVE-2026-63466` · npm `unleash-server`: affected `<8.0.3`, fixed in `8.0.3` · CVSS 4.1 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: CWE-116
- [Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Instance Reset Password Function in UI](https://agentprime.io/advisories/CVE-2026-61398.md)
  `CVE-2026-61398` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2026 · Tags: CWE-116
- [Apache CloudStack: Cross-Site Scripting (XSS) Vulnerability in Lock User Function in UI](https://agentprime.io/advisories/CVE-2026-61399.md)
  `CVE-2026-61399` · CVE record: Apache Software Foundation Apache CloudStack · CVSS 4.8 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: CWE-116
- [Laravel Backpack CRUD: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)](https://agentprime.io/advisories/GHSA-mrc5-3mm3-45c5.md)
  `GHSA-mrc5-3mm3-45c5`, `CVE-2026-54182`, `PKSA-qrrt-7bj6-f81q` · Packagist `backpack/crud`: affected `>=4.1.0, <4.1.72 || >=5.0.0, <5.6.2 || >=6.0.0, <6.8.13 || >=7.0.0, <7.0.36`, fixed in `4.1.72`, `5.6.2`, `6.8.13`, `7.0.36` · CVSS 8.1 High · Not analysed yet · Published 20 Aug 2026 · Tags: Command injection, CWE-20, CWE-116
- [DS8900F and DS8A00 Authentication Bypass](https://agentprime.io/advisories/CVE-2025-36254.md)
  `CVE-2025-36254` · CVE record: IBM DS8A00 (R10.0 - R10.1) and 1 more · CVSS 7.4 High · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-116
- [jmespath.php has CompilerRuntime code injection via unescaped function names](https://agentprime.io/advisories/GHSA-pcw8-m77r-2528.md)
  `GHSA-pcw8-m77r-2528`, `CVE-2026-54133`, `PKSA-mnyp-475s-ywph` · Packagist `mtdowling/jmespath.php`: affected `<2.9.1`, fixed in `2.9.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Code injection, CWE-20, CWE-116
- [Forem: Stored XSS in Admin Abuse Report Rendering](https://agentprime.io/advisories/CVE-2026-61696.md)
  `CVE-2026-61696` · CVE record: forem forem · CVSS 6.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: Other injection, Cross-site scripting (XSS), CWE-116
- [Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1](https://agentprime.io/advisories/EEF-CVE-2026-43971.md)
  `EEF-CVE-2026-43971`, `CVE-2026-43971` · Hex `cowlib`: affected `>=2.9.0, <2.20.0`, fixed in `2.20.0` · CVSS 6.3 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-116
- [Shescape before 2.1.15 and 3.0.2 Home Directory Disclosure via BusyBox](https://agentprime.io/advisories/CVE-2026-73055.md)
  `CVE-2026-73055` · CVE record: ericcornelissen shescape · CVSS 6.3 Medium · Not analysed yet · Published 15 Aug 2026 · Tags: Information disclosure, CWE-116
- [dua-cli Terminal Escape Sequence Injection via Marked Paths](https://agentprime.io/advisories/CVE-2026-73479.md)
  `CVE-2026-73479` · CVE record: Byron dua-cli · CVSS 4.8 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-116
- [gdu Terminal Injection via Unstripped Escape Sequences](https://agentprime.io/advisories/CVE-2026-73480.md)
  `CVE-2026-73480` · CVE record: dundee gdu · CVSS 4.8 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-116
- [HCL AION is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2025-62315.md)
  `CVE-2025-62315` · CVE record: HCL Software AION · CVSS 3.4 Low · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-116
- [ColdFusion | Improper Encoding or Escaping of Output (CWE-116)](https://agentprime.io/advisories/CVE-2026-48376.md)
  `CVE-2026-48376` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-116
- [cti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search Highlighting](https://agentprime.io/advisories/CVE-2026-73161.md)
  `CVE-2026-73161` · CVE record: MISP cti-transmute · CVSS 5.1 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [cti-transmute Remote MISP Event Browser Allows Cross-Site Scripting via Malicious Event Metadata](https://agentprime.io/advisories/CVE-2026-73157.md)
  `CVE-2026-73157` · CVE record: MISP cti-transmute · CVSS 2.3 Low · Not analysed yet · Published 11 Aug 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Improper Output Encoding in GNU cpio](https://agentprime.io/advisories/CVE-2026-66486.md)
  `CVE-2026-66486` · CVE record: GNU cpio · CVSS 4.6 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: CWE-116

Newest: <https://agentprime.io/advisories/tag/cwe-116.md>
Older: <https://agentprime.io/advisories/tag/cwe-116.md?cursor=WyIyMDI2LTA4LTEwVDEwOjI1OjQxLjYyNTAwMFoiLCJDVkUtMjAyNi02NjQ4NiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-116&cursor=WyIyMDI2LTA5LTI0VDE5OjMzOjIzLjAwMDAwMFoiLCJHSFNBLWo4cjQtMzJjNS0zM3JjIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-116/?cursor=WyIyMDI2LTA5LTI0VDE5OjMzOjIzLjAwMDAwMFoiLCJHSFNBLWo4cjQtMzJjNS0zM3JjIl0>. Everything for agents: <https://agentprime.io/llms.txt>.