# CWE-116.

Every Advisory and CVE whose sources give the weakness CWE-116, newest first.

## Records, newest first (an older page)

- [h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read](https://agentprime.io/advisories/GHSA-wr4h-v87w-p3r7.md)
  `GHSA-wr4h-v87w-p3r7`, `CVE-2026-86253` · npm `h3`: affected `<1.15.6 || >=2.0.0, <2.0.1-rc.15`, fixed in `1.15.6`, `2.0.1-rc.15` · CVSS 8.2 High · Not analysed yet · Published 18 Mar 2026 · Tags: Path traversal, CWE-116
- [Heimdall: Path received via Envoy gRPC corrupted when containing query string](https://agentprime.io/advisories/GHSA-r8x2-fhmf-6mxp.md)
  `GHSA-r8x2-fhmf-6mxp`, `CVE-2026-32811`, `GO-2026-4742` · Go `github.com/dadrus/heimdall`: affected `>=0.7.0-alpha, <0.17.11`, fixed in `0.17.11` · CVSS 8.2 High · Not analysed yet · Published 18 Mar 2026 · Tags: Broken access control, CWE-116
- [LeafKit's HTML escaping may be skipped for Collection values, enabling XSS](https://agentprime.io/advisories/CVE-2026-28499.md)
  `CVE-2026-28499` · CVE record: vapor leaf-kit · CVSS 6.9 Medium · Not analysed yet · Published 18 Mar 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [jsPDF has a PDF Object Injection via FreeText color](https://agentprime.io/advisories/GHSA-7x6v-j9x4-qf24.md)
  `GHSA-7x6v-j9x4-qf24`, `CVE-2026-31898` · npm `jspdf`: affected `<4.2.1`, fixed in `4.2.1` · CVSS 8.1 High · Not analysed yet · Published 17 Mar 2026 · Tags: Code injection, CWE-116
- [Incomplete control character validation in http.cookies](https://agentprime.io/advisories/CVE-2026-3644.md)
  `CVE-2026-3644` · CVE record: Python Software Foundation CPython · CVSS 6.0 Medium · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-20, CWE-116
- [Improper Encoding or Escaping of Output in GitLab](https://agentprime.io/advisories/CVE-2025-12697.md)
  `CVE-2025-12697` · CVE record: GitLab GitLab · CVSS 2.2 Low · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-116
- [CraftCMS vulnerable to reflective XSS via incomplete return URL sanitization](https://agentprime.io/advisories/GHSA-fvwq-45qv-xvhv.md)
  `GHSA-fvwq-45qv-xvhv`, `CVE-2026-31859`, `PKSA-t9v1-2frg-d2wy` · Packagist `craftcms/cms`: affected `>=4.15.3, <4.17.3 || >=5.7.5, <5.9.7`, fixed in `4.17.3`, `5.9.7` · CVSS 6.9 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [OpenClaw: fetch-guard forwards custom authorization headers across cross-origin redirects](https://agentprime.io/advisories/GHSA-6mgf-v5j7-45cr.md)
  `GHSA-6mgf-v5j7-45cr`, `CVE-2026-32913` · npm `openclaw`: affected `<2026.3.7`, fixed in `2026.3.7` · CVSS 8.8 High · Not analysed yet · Published 9 Mar 2026 · Tags: Hard-coded credentials, CWE-116, CWE-184
- [XWiki Blog Application home page vulnerable to Stored XSS via Post Title](https://agentprime.io/advisories/GHSA-h2xq-h7f9-vh6c.md)
  `GHSA-h2xq-h7f9-vh6c`, `CVE-2025-66024` · Maven `org.xwiki.contrib.blog:application-blog-ui`: affected `>=9.15, <9.15.7`, fixed in `9.15.7` · CVSS 8.6 High · Not analysed yet · Published 4 Mar 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling](https://agentprime.io/advisories/GHSA-mqr9-vqhq-3jxw.md)
  `GHSA-mqr9-vqhq-3jxw`, `CVE-2026-31994` · npm `openclaw`: affected `<2026.2.19`, fixed in `2026.2.19` · CVSS 6.9 Medium · Not analysed yet · Published 3 Mar 2026 · Tags: Command injection, CWE-116
- [lxml-html-clean has \<base> tag injection through default Cleaner configuration](https://agentprime.io/advisories/GHSA-xvp8-3mhv-424c.md)
  `GHSA-xvp8-3mhv-424c`, `CVE-2026-28350`, `PYSEC-2026-2202` · PyPI `lxml-html-clean`: affected `<0.4.4`, fixed in `0.4.4` · CVSS 6.1 Medium · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-116
- [lxml-html-clean has CSS @import Filter Bypass via Unicode Escapes](https://agentprime.io/advisories/GHSA-hw26-mmpg-fqfg.md)
  `GHSA-hw26-mmpg-fqfg`, `CVE-2026-28348`, `PYSEC-2026-2201` · PyPI `lxml-html-clean`: affected `<0.4.4`, fixed in `0.4.4` · CVSS 6.1 Medium · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-116
- [Sub2API Vulnerable to Password Reset Poisoning via Host Header Trust Issue, Leading to Account Takeover](https://agentprime.io/advisories/CVE-2026-27812.md)
  `CVE-2026-27812` · CVE record: Wei-Shaw sub2api · CVSS 8.0 High · Not analysed yet · Published 26 Feb 2026 · Tags: CWE-116
- [Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module](https://agentprime.io/advisories/GHSA-4qgr-4h56-8895.md)
  `GHSA-4qgr-4h56-8895`, `CVE-2026-27116`, `GO-2026-4552` · Go `code.vikunja.io/api`: affected `<=0.24.6`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [ImageMagick: SVG-to-MVG Command Injection via coders/svg.c](https://agentprime.io/advisories/GHSA-xpg8-7m6m-jf56.md)
  `GHSA-xpg8-7m6m-jf56`, `CVE-2026-56379` · NuGet `Magick.NET-Q16-AnyCPU` and 18 more: affected `<14.10.3`, fixed in `14.10.3` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Feb 2026 · Tags: Command injection, CWE-116
- [OpenEMR allows inconsistent escaping of translation function output](https://agentprime.io/advisories/CVE-2026-21443.md)
  `CVE-2026-21443` · CVE record: openemr openemr · CVSS 1.2 Low · Not analysed yet · Published 25 Feb 2026 · Tags: CWE-116
- [Isso affected by Stored XSS via comment website field](https://agentprime.io/advisories/GHSA-9fww-8cpr-q66r.md)
  `GHSA-9fww-8cpr-q66r`, `CVE-2026-27469`, `PYSEC-2026-2527` · PyPI `isso`: affected `<0.13.2`, fixed in `0.13.2` · CVSS 6.1 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Tenda F3 Reflected Script Execution via Missing nosniff Header](https://agentprime.io/advisories/CVE-2026-27512.md)
  `CVE-2026-27512` · CVE record: Shenzhen Tenda Technology Co., Ltd. Tenda F3 · CVSS 5.1 Medium · Not analysed yet · Published 23 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [OpenSift: Persistent XSS Chat Tool Rendering](https://agentprime.io/advisories/CVE-2026-27169.md)
  `CVE-2026-27169` · CVE record: OpenSift OpenSift · CVSS 8.9 High · Not analysed yet · Published 20 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Pi-hole Web Interface has Stored HTML Injection via X-Forwarded-For Header in Active Sessions Table](https://agentprime.io/advisories/CVE-2026-26953.md)
  `CVE-2026-26953` · CVE record: pi-hole web · CVSS 5.4 Medium · Not analysed yet · Published 19 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-20, CWE-116
- [Pi-hole Web Interface has Stored HTML Injection via Local DNS Records (CNAME/Hosts) in data-tag Attribute](https://agentprime.io/advisories/CVE-2026-26952.md)
  `CVE-2026-26952` · CVE record: pi-hole web · CVSS 5.4 Medium · Not analysed yet · Published 19 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-20, CWE-116
- [jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)](https://agentprime.io/advisories/GHSA-p5xg-68wr-hm3m.md)
  `GHSA-p5xg-68wr-hm3m`, `CVE-2026-25940` · npm `jspdf`: affected `<4.2.0`, fixed in `4.2.0` · CVSS 8.1 High · Not analysed yet · Published 19 Feb 2026 · Tags: CWE-116
- [jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method](https://agentprime.io/advisories/GHSA-9vjf-qc39-jprp.md)
  `GHSA-9vjf-qc39-jprp`, `CVE-2026-25755` · npm `jspdf`: affected `<4.2.0`, fixed in `4.2.0` · CVSS 8.1 High · Not analysed yet · Published 19 Feb 2026 · Tags: Code injection, CWE-116
- [Fabric.js Affected by Stored XSS via SVG Export](https://agentprime.io/advisories/GHSA-hfvx-25r5-qc3w.md)
  `GHSA-hfvx-25r5-qc3w`, `CVE-2026-27013` · npm `fabric`: affected `<7.2.0`, fixed in `7.2.0` · CVSS 7.6 High · Not analysed yet · Published 18 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [LibreNMS has a Stored XSS in Custom OID - unit parameter missing strip_tags()](https://agentprime.io/advisories/GHSA-fqx6-693c-f55g.md)
  `GHSA-fqx6-693c-f55g`, `CVE-2026-27016`, `PKSA-vfym-rfx7-wjpv` · Packagist `librenms/librenms`: affected `>=24.10.0, <26.2.0`, fixed in `26.2.0` · CVSS 5.4 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [FileRise affected by HTML Injection using color property in file tags](https://agentprime.io/advisories/CVE-2026-25230.md)
  `CVE-2026-25230` · CVE record: error311 FileRise · CVSS 4.6 Medium · Not analysed yet · Published 9 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Tanium addressed an improper output sanitization vulnerability in TanOS.](https://agentprime.io/advisories/CVE-2025-15312.md)
  `CVE-2025-15312` · CVE record: Tanium Tanium Appliance · CVSS 6.6 Medium · Not analysed yet · Published 5 Feb 2026 · Tags: CWE-116
- [HtmlSanitizer has a bypass via template tag](https://agentprime.io/advisories/GHSA-j92c-7v7g-gj3f.md)
  `GHSA-j92c-7v7g-gj3f`, `CVE-2026-25543` · NuGet `HtmlSanitizer`: affected `<9.0.892 || >=9.1.878-beta, <9.1.893-beta`, fixed in `9.0.892`, `9.1.893-beta` · CVSS 6.3 Medium · Not analysed yet · Published 3 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution](https://agentprime.io/advisories/GHSA-pqxr-3g65-p328.md)
  `GHSA-pqxr-3g65-p328`, `CVE-2026-24737` · npm `jspdf`: affected `<4.1.0`, fixed in `4.1.0` · CVSS 8.1 High · Not analysed yet · Published 2 Feb 2026 · Tags: Code injection, CWE-116
- [Discourse allows script execution in uploaded HTML/XML files on S3](https://agentprime.io/advisories/CVE-2025-66488.md)
  `CVE-2025-66488` · CVE record: discourse discourse · CVSS 4.6 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: CWE-116
- [CSS-based exfiltration of the content from partially encrypted emails when allowing remote content](https://agentprime.io/advisories/CVE-2026-0818.md)
  `CVE-2026-0818` · CVE record: Mozilla Thunderbird · CVSS 4.3 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: Information disclosure, Cross-site request forgery (CSRF), CWE-116
- [Tenda W30E V2 Lacks X-Content-Type-Options Header](https://agentprime.io/advisories/CVE-2026-24439.md)
  `CVE-2026-24439` · CVE record: Shenzhen Tenda Technology Co., Ltd. W30E V2 · CVSS 2.1 Low · Not analysed yet · Published 26 Jan 2026 · Tags: CWE-116
- [Typemill has Reflected XSS via login error view template](https://agentprime.io/advisories/CVE-2026-24127.md)
  `CVE-2026-24127` · CVE record: typemill typemill · CVSS 5.4 Medium · Not analysed yet · Published 23 Jan 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Docmost is vulnerable to stored Cross-Site Scripting (XSS) through Mermaid rendering](https://agentprime.io/advisories/CVE-2026-23630.md)
  `CVE-2026-23630` · CVE record: docmost docmost · CVSS 6.3 Medium · Not analysed yet · Published 21 Jan 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [5ire vulnerable to Remote Code Execution (RCE)](https://agentprime.io/advisories/CVE-2026-22792.md)
  `CVE-2026-22792` · CVE record: nanbingxyz 5ire · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jan 2026 · Tags: CWE-116
- [OnboardLite has stored Cross-site Scripting issue that may lead to admin Account Take Over](https://agentprime.io/advisories/CVE-2026-23880.md)
  `CVE-2026-23880` · CVE record: HackUCF OnboardLite · CVSS 7.3 High · Not analysed yet · Published 19 Jan 2026 · Tags: Cross-site scripting (XSS), CWE-20, CWE-116
- [Stored Cross-Site Scripting in Altium Live Support Center Comment Endpoint](https://agentprime.io/advisories/CVE-2026-1011.md)
  `CVE-2026-1011` · CVE record: Altium Altium Live · CVSS 6.1 Medium · Not analysed yet · Published 15 Jan 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [ApprovedRevs allows bypassing the inline CSS sanitizer](https://agentprime.io/advisories/CVE-2026-22712.md)
  `CVE-2026-22712` · CVE record: The Wikimedia Foundation Mediawiki - ApprovedRevs Extension · CVSS 2.3 Low · Not analysed yet · Published 9 Jan 2026 · Tags: CWE-116
- [Coolify has Stored XSS in Project Name](https://agentprime.io/advisories/CVE-2025-59158.md)
  `CVE-2025-59158` · CVE record: coollabsio coolify · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Jan 2026 · Tags: CWE-116
- [Improper output encoding in Roundcube Webmail](https://agentprime.io/advisories/CVE-2025-68460.md)
  `CVE-2025-68460` · CVE record: Roundcube Webmail · CVSS 7.2 High · Not analysed yet · Published 18 Dec 2025 · Tags: CWE-116
- [Improper Encoding or Escaping of Output in GitLab](https://agentprime.io/advisories/CVE-2025-12734.md)
  `CVE-2025-12734` · CVE record: GitLab GitLab · CVSS 3.5 Low · Not analysed yet · Published 11 Dec 2025 · Tags: CWE-116
- [Improper Encoding or Escaping of Output in GitLab](https://agentprime.io/advisories/CVE-2025-8405.md)
  `CVE-2025-8405` · CVE record: GitLab GitLab · CVSS 7.7 High · Not analysed yet · Published 11 Dec 2025 · Tags: CWE-116
- [Server-Side Request Forgery (SSRF) in SAP BusinessObjects Business Intelligence Platform](https://agentprime.io/advisories/CVE-2025-42896.md)
  `CVE-2025-42896` · CVE record: SAP_SE SAP BusinessObjects Business Intelligence Platform · CVSS 5.4 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-116
- [Nextcloud Deck app allows to spoof file extensions by using RTLO characters](https://agentprime.io/advisories/CVE-2025-66548.md)
  `CVE-2025-66548` · CVE record: nextcloud security-advisories · CVSS 3.3 Low · Not analysed yet · Published 5 Dec 2025 · Tags: CWE-116
- [Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'](https://agentprime.io/advisories/GHSA-8wvc-869r-xfqf.md)
  `GHSA-8wvc-869r-xfqf`, `CVE-2025-65959` · npm `open-webui`: affected `<0.6.37`, fixed in `0.6.37` · CVSS 8.7 High · Not analysed yet · Published 4 Dec 2025 · Tags: Cross-site scripting (XSS), CWE-116
- [PX Enterprise Improper Sanitization Vulnerability](https://agentprime.io/advisories/CVE-2025-9127.md)
  `CVE-2025-9127` · CVE record: Pure Storage PX Enterprise · CVSS 8.4 High · Not analysed yet · Published 4 Dec 2025 · Tags: CWE-116
- [Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final...](https://agentprime.io/advisories/GHSA-2mm6-624x-fqrr.md)
  `GHSA-2mm6-624x-fqrr`, `CVE-2025-13742`, `PYSEC-2025-154` · PyPI `pretix`: affected `>=1.0.0, <2025.7.2`, fixed in `2025.7.2` · CVSS 2.4 Low · Not analysed yet · Published 27 Nov 2025 · Tags: CWE-116
- [Emby Server is Vulnerable to Remote Code Execution Through XSS in Admin Dashboard](https://agentprime.io/advisories/CVE-2025-64325.md)
  `CVE-2025-64325` · CVE record: EmbySupport Emby.Security · CVSS 8.4 High · Not analysed yet · Published 18 Nov 2025 · Tags: Cross-site scripting (XSS), CWE-116
- [SolarWinds Serv-U Logic Abuse - Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2025-40547.md)
  `CVE-2025-40547` · CVE record: SolarWinds Serv-U · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Nov 2025 · Tags: CWE-116
- [FactoryTalk® DataMosaix™ Private Cloud – Persistent XSS](https://agentprime.io/advisories/CVE-2025-11085.md)
  `CVE-2025-11085` · CVE record: Rockwell Automation FactoryTalk® DataMosaix™ Private Cloud · CVSS 8.6 High · Not analysed yet · Published 11 Nov 2025 · Tags: CWE-116
- [A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32.](https://agentprime.io/advisories/CVE-2025-63785.md)
  `CVE-2025-63785` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 7 Nov 2025 · Tags: Cross-site scripting (XSS), CWE-20, CWE-116
- [MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets (<>) in the From: header of SMTP DATA.](https://agentprime.io/advisories/CVE-2025-61084.md)
  `CVE-2025-61084` · CVE record · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2025 · Tags: CWE-20, CWE-116
- [motionEye vulnerable to RCE via unsanitized motion config parameter](https://agentprime.io/advisories/GHSA-j945-qm58-4gjx.md)
  `GHSA-j945-qm58-4gjx`, `CVE-2025-60787`, `PYSEC-2026-1680` · PyPI `motioneye`: affected `<0.43.1b5`, fixed in `0.43.1b5` · CVSS 7.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.18 · Not analysed yet · Published 3 Nov 2025 · Tags: Command injection, CWE-20, CWE-116
- [Nagios XI < 5.8.6 Core Config Manager (CCM) Reflected XSS via Test Command](https://agentprime.io/advisories/CVE-2021-47694.md)
  `CVE-2021-47694` · CVE record: Nagios XI · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Cross-site scripting (XSS), CWE-116
- [DOS Vulnerability in ZTE MC889A Pro product](https://agentprime.io/advisories/CVE-2025-46583.md)
  `CVE-2025-46583` · CVE record: ZTE MC889A Pro · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: CWE-116
- [Potential user-assisted code execution in “Copy as cURL” command](https://agentprime.io/advisories/CVE-2025-11713.md)
  `CVE-2025-11713` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2025 · Tags: CWE-116
- [An OBJECT tag type attribute overrode browser behavior on web resources without a content-type](https://agentprime.io/advisories/CVE-2025-11712.md)
  `CVE-2025-11712` · CVE record: Mozilla Firefox and 1 more · CVSS 6.1 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: CWE-116
- [python-ldap is Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination](https://agentprime.io/advisories/GHSA-p34h-wq7j-h5v6.md)
  `GHSA-p34h-wq7j-h5v6`, `CVE-2025-61912`, `PYSEC-2026-1846` · PyPI `python-ldap`: affected `<3.4.5`, fixed in `3.4.5` · CVSS 5.5 Medium · Not analysed yet · Published 10 Oct 2025 · Tags: CWE-116, CWE-170
- [A HTML injection vulnerability exists in Perfex CRM v3.3.1.](https://agentprime.io/advisories/CVE-2025-55903.md)
  `CVE-2025-55903` · CVE record · CVSS 8.3 High · Not analysed yet · Published 10 Oct 2025 · Tags: CWE-116
- [pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters](https://agentprime.io/advisories/GHSA-cjjf-27cc-pvmv.md)
  `GHSA-cjjf-27cc-pvmv`, `CVE-2025-61773`, `PYSEC-2026-1816` · PyPI `pyload-ng`: affected `<0.5.0b3.dev91`, fixed in `0.5.0b3.dev91` · CVSS 8.1 High · Not analysed yet · Published 9 Oct 2025 · Tags: Other injection, Cross-site scripting (XSS), Code injection, CWE-116

Newest: <https://agentprime.io/advisories/tag/cwe-116.md>
Older: <https://agentprime.io/advisories/tag/cwe-116.md?cursor=WyIyMDI1LTEwLTA5VDE1OjE5OjQ4LjAwMDAwMFoiLCJHSFNBLWNqamYtMjdjYy1wdm12Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-116&cursor=WyIyMDI2LTAzLTE5VDIwOjEwOjQzLjIwMjAwMFoiLCJDVkUtMjAyNi0zMzMwMSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-116/?cursor=WyIyMDI2LTAzLTE5VDIwOjEwOjQzLjIwMjAwMFoiLCJDVkUtMjAyNi0zMzMwMSJd>. Everything for agents: <https://agentprime.io/llms.txt>.