# CWE-150.

Every Advisory and CVE whose sources give the weakness CWE-150, newest first.

## Records, newest first

- [dysk before 3.8.2 Terminal Escape Sequence Injection via Mount Metadata](https://agentprime.io/advisories/CVE-2026-121547.md)
  `CVE-2026-121547` · CVE record: Canop dysk · CVSS 1.0 Low · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-150
- [CUPS fax option values bypass the CVE-2026-34980 control-character sanitizer (incomplete fix)](https://agentprime.io/advisories/CVE-2026-55467.md)
  `CVE-2026-55467` · CVE record: OpenPrinting cups · CVSS 2.5 Low · Not analysed yet · Published 15 Oct 2026 · Tags: Other injection, Code injection, CWE-150
- [Terminal escape sequence injection in Hex via unneutralized server-supplied output](https://agentprime.io/advisories/CVE-2026-81856.md)
  `CVE-2026-81856` · CVE record: hexpm hex · CVSS 2.3 Low · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-150
- [openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code Generation](https://agentprime.io/advisories/GHSA-5293-mq8x-g3xj.md)
  `GHSA-5293-mq8x-g3xj`, `CVE-2026-105801`, `PYSEC-2026-4245` · PyPI `openapi-python-client`: affected `<0.29.1`, fixed in `0.29.1` · CVSS 8.4 High · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection, CWE-116, CWE-150
- [Meta Platforms, Inc Sapling SCM: In Sapling SCM prior to v0.2.20260929-102736…](https://agentprime.io/advisories/CVE-2026-104026.md)
  `CVE-2026-104026` · CVE record: Meta Platforms, Inc Sapling SCM · CVSS 7.8 High · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-150
- [Collectl: collectl: colmux does not sanitize ansi/vt100 terminal escape sequences in data received from remote collectl instances](https://agentprime.io/advisories/CVE-2026-103431.md)
  `CVE-2026-103431` · CVE record · CVSS 7.7 High · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-150
- [Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter](https://agentprime.io/advisories/GHSA-cxf4-7mrp-vvpr.md)
  `GHSA-cxf4-7mrp-vvpr`, `CVE-2026-102601`, `PKSA-w9tt-7782-78jx` · Packagist `league/flysystem`: affected `<3.35.3`, fixed in `3.35.3` · CVSS 3.5 Low · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-150
- [spaceship-prompt through 4.22.5 Terminal Escape Sequence Injection](https://agentprime.io/advisories/CVE-2026-100867.md)
  `CVE-2026-100867` · CVE record: spaceship-prompt spaceship-prompt · CVSS 4.8 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: CWE-150
- [onefetch through 2.28.1 Terminal Escape Sequence Injection](https://agentprime.io/advisories/CVE-2026-100866.md)
  `CVE-2026-100866` · CVE record: o2sh onefetch · CVSS 4.8 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: CWE-150
- [Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint](https://agentprime.io/advisories/GHSA-g7f6-rxc4-qhph.md)
  `GHSA-g7f6-rxc4-qhph`, `CVE-2026-93421`, `PYSEC-2026-4105` · PyPI `mesop`: affected `<1.3.4`, fixed in `1.3.4` · CVSS 5.3 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: Other injection, CWE-150
- [MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection](https://agentprime.io/advisories/CVE-2026-90895.md)
  `CVE-2026-90895` · CVE record: MISP MISP · CVSS 8.4 High · Not analysed yet · Published 14 Sept 2026 · Tags: Information disclosure, Hard-coded credentials, Broken access control, CWE-150
- [procs through 0.14.12 Terminal Escape Sequence Injection via Command](https://agentprime.io/advisories/CVE-2026-90773.md)
  `CVE-2026-90773` · CVE record: dalance procs · CVSS 2.4 Low · Not analysed yet · Published 13 Sept 2026 · Tags: CWE-150
- [Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata](https://agentprime.io/advisories/GHSA-j59f-776f-23hp.md)
  `GHSA-j59f-776f-23hp`, `CVE-2026-82710`, `EEF-CVE-2026-82710` · Hex `usage_rules`: affected `>=0.1.18, <1.2.8`, fixed in `1.2.8` · CVSS 2.3 Low · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-150
- [Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata](https://agentprime.io/advisories/GHSA-cj7w-j579-gc42.md)
  `GHSA-cj7w-j579-gc42`, `CVE-2026-82584`, `EEF-CVE-2026-82584` · Hex `igniter`: affected `>=0.8.1, <0.8.4`, fixed in `0.8.4` · CVSS 2.3 Low · Not analysed yet · Published 7 Sept 2026 · Tags: CWE-150
- [OpenAI Codex CLI: OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS…](https://agentprime.io/advisories/CVE-2026-19591.md)
  `CVE-2026-19591` · CVE record: OpenAI Codex CLI and 2 more · CVSS 8.8 High · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-150
- [pickem vulnerable to terminal escape-sequence injection via unsanitized item text](https://agentprime.io/advisories/GHSA-8qx3-8gm5-9cj2.md)
  `GHSA-8qx3-8gm5-9cj2` · npm `pickem`: affected `<1.0.7`, fixed in `1.0.7` · CVSS 4.0, no score published · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-150
- [Ember has unneutralized terminal escape/control sequences from Caddy logs injected into the operator's TUI](https://agentprime.io/advisories/GHSA-x3g7-qrwc-f6c5.md)
  `GHSA-x3g7-qrwc-f6c5`, `CVE-2026-54162`, `GO-2026-6270` · Go `github.com/alexandre-daubois/ember`: affected `<1.4.2`, fixed in `1.4.2` · CVSS 4.7 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-150
- [broot Terminal Escape Sequence Injection via Unsanitized File and Directory Names in the Tree View](https://agentprime.io/advisories/CVE-2026-72847.md)
  `CVE-2026-72847` · CVE record: Canop broot · CVSS 2.4 Low · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-150
- [powerlevel10k Control Character Injection via package.json Version](https://agentprime.io/advisories/CVE-2026-75483.md)
  `CVE-2026-75483` · CVE record: romkatv powerlevel10k · CVSS 4.8 Medium · Not analysed yet · Published 17 Aug 2026 · Tags: CWE-150
- [Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml](https://agentprime.io/advisories/CVE-2026-73036.md)
  `CVE-2026-73036` · CVE record: Bash-it Bash-it · CVSS 4.6 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-150
- [Kitty: Command injection into the child shell via chained @kitty-echo + @kitty-ssh DCS escape sequences](https://agentprime.io/advisories/CVE-2026-72913.md)
  `CVE-2026-72913` · CVE record: kovidgoyal kitty · CVSS 7.3 High · Not analysed yet · Published 10 Aug 2026 · Tags: Command injection, Other injection, CWE-150
- [npm-check-updates 23.0.2 Terminal Injection via Unsanitized Escape Sequences](https://agentprime.io/advisories/CVE-2026-73035.md)
  `CVE-2026-73035` · CVE record: raineorshine npm-check-updates · CVSS 5.3 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: CWE-150
- [GitHub CLI: Terminal escape sequence injection in multiple \`gh\` commands](https://agentprime.io/advisories/CVE-2026-64654.md)
  `CVE-2026-64654` · CVE record: cli cli · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-150
- [Oh My Posh: Terminal escape sequence injection via unsanitized prompt segment data](https://agentprime.io/advisories/GHSA-fwjx-9p69-h25h.md)
  `GHSA-fwjx-9p69-h25h`, `CVE-2026-73506`, `GO-2026-6111` · Go `github.com/jandedobbeleer/oh-my-posh`: affected `<29.35.1`, fixed in `29.35.1` · CVSS 6.1 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: CWE-150
- [Shescape: Shell injection via unescaped parentheses on Windows with CMD](https://agentprime.io/advisories/GHSA-w4hw-qcx7-56pr.md)
  `GHSA-w4hw-qcx7-56pr`, `CVE-2026-73414` · npm `shescape`: affected `<2.1.14 || >=3.0.0, <3.0.1`, fixed in `2.1.14`, `3.0.1` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jul 2026 · Tags: Command injection, CWE-150
- [SQL injection in syslog-ng SQL destionation driver](https://agentprime.io/advisories/CVE-2026-39879.md)
  `CVE-2026-39879` · CVE record: syslog-ng syslog-ng · CVSS 7.1 High · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-150
- [OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UI](https://agentprime.io/advisories/CVE-2026-62948.md)
  `CVE-2026-62948` · CVE record: openwrt openwrt · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jul 2026 · Tags: Cross-site scripting (XSS), Other injection, CWE-150
- [App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes](https://agentprime.io/advisories/CVE-2026-49147.md)
  `CVE-2026-49147` · CVE record: PETDANCE App::Ack · CVSS 7.5 High · Not analysed yet · Published 8 Jul 2026 · Tags: CWE-150
- [Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections](https://agentprime.io/advisories/CVE-2026-11373.md)
  `CVE-2026-11373` · CVE record: JASEI Net::Statsite::Client · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jun 2026 · Tags: Other injection, CWE-150
- [Kitty vulnerable to command injection via unsanitized OSC 21 query reply](https://agentprime.io/advisories/CVE-2026-54057.md)
  `CVE-2026-54057` · CVE record: kovidgoyal kitty · CVSS 7.3 High · Not analysed yet · Published 12 Jun 2026 · Tags: Code injection, CWE-150
- [Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections](https://agentprime.io/advisories/CVE-2026-50639.md)
  `CVE-2026-50639` · CVE record: PEVANS Metrics::Any::Adapter::SignalFx · CVSS 6.5 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: Other injection, CWE-150
- [Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections](https://agentprime.io/advisories/CVE-2026-50638.md)
  `CVE-2026-50638` · CVE record: PEVANS Metrics::Any::Adapter::DogStatsd · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Jun 2026 · Tags: Other injection, CWE-150
- [Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections](https://agentprime.io/advisories/CVE-2026-50637.md)
  `CVE-2026-50637` · CVE record: PEVANS Metrics::Any::Adapter::Statsd · CVSS 8.2 High · Not analysed yet · Published 10 Jun 2026 · Tags: Other injection, CWE-150
- [DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags](https://agentprime.io/advisories/CVE-2026-11362.md)
  `CVE-2026-11362` · CVE record: BINARY DataDog::DogStatsd · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Jun 2026 · Tags: Other injection, CWE-150
- [DataDog::DogStatsd versions through 0.07 for Perl allow metric injections](https://agentprime.io/advisories/CVE-2026-9270.md)
  `CVE-2026-9270` · CVE record: BINARY DataDog::DogStatsd · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Jun 2026 · Tags: Other injection, CWE-150
- [Etsy::StatsD versions through 1.002002 for Perl allow metric injections](https://agentprime.io/advisories/CVE-2026-46741.md)
  `CVE-2026-46741` · CVE record: SANBEG Etsy::StatsD · CVSS 7.5 High · Not analysed yet · Published 4 Jun 2026 · Tags: Other injection, CWE-150
- [Net::Statsd versions before 0.13 for Perl allow metric injections](https://agentprime.io/advisories/CVE-2026-46739.md)
  `CVE-2026-46739` · CVE record: COSIMO Net::Statsd · CVSS 5.3 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: Other injection, CWE-150
- [Net::Async::Statsd::Client versions through 0.005 for Perl allow metric injections](https://agentprime.io/advisories/CVE-2026-8722.md)
  `CVE-2026-8722` · CVE record: TEAM Net::Async::Statsd::Client · CVSS 6.5 Medium · Not analysed yet · Published 3 Jun 2026 · Tags: Other injection, CWE-150
- [Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections](https://agentprime.io/advisories/CVE-2026-46740.md)
  `CVE-2026-46740` · CVE record: RRWO Mojolicious::Plugin::Statsd · CVSS 5.3 Medium · Not analysed yet · Published 26 May 2026 · Tags: Other injection, CWE-150
- [GitHub CLI: GitHub Actions log output in \`gh run view\` allows terminal escape sequence injection](https://agentprime.io/advisories/GHSA-crc3-h8v6-qh57.md)
  `GHSA-crc3-h8v6-qh57`, `CVE-2026-45803`, `GO-2026-5335` · Go `github.com/cli/cli` and 1 more: affected `>=1.6.0, <=1.14.0`, no fixed version yet · CVSS 3.5 Low · Not analysed yet · Published 19 May 2026 · Tags: CWE-150
- [Claude HUD 0.0.12 Terminal Injection via OSC 8 Hyperlinks](https://agentprime.io/advisories/CVE-2026-47090.md)
  `CVE-2026-47090` · CVE record: jarrodwatts claude-hud · CVSS 2.4 Low · Not analysed yet · Published 18 May 2026 · Tags: CWE-150
- [Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections](https://agentprime.io/advisories/CVE-2026-8788.md)
  `CVE-2026-8788` · CVE record: RRWO Net::Statsd::Lite · CVSS 7.3 High · Not analysed yet · Published 18 May 2026 · Tags: Other injection, CWE-150
- [Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections](https://agentprime.io/advisories/CVE-2026-46720.md)
  `CVE-2026-46720` · CVE record: RRWO Net::Statsd::Tiny · CVSS 8.2 High · Not analysed yet · Published 17 May 2026 · Tags: Other injection, CWE-150
- [Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections](https://agentprime.io/advisories/CVE-2026-46719.md)
  `CVE-2026-46719` · CVE record: RRWO Net::Statsd::Lite · CVSS 6.5 Medium · Not analysed yet · Published 16 May 2026 · Tags: Other injection, CWE-150
- [Tabby: Dragging and Dropping a File into Tabby Can Lead to Code Execution](https://agentprime.io/advisories/CVE-2026-45038.md)
  `CVE-2026-45038` · CVE record: Eugeny tabby · CVSS 8.4 High · Not analysed yet · Published 15 May 2026 · Tags: CWE-150
- [KDE KCoreAddons: In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments…](https://agentprime.io/advisories/CVE-2026-41526.md)
  `CVE-2026-41526` · CVE record: KDE KCoreAddons · CVSS 6.5 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: CWE-150
- [BaseCookie.js_output() does not neutralize embedded characters](https://agentprime.io/advisories/CVE-2026-6019.md)
  `CVE-2026-6019` · CVE record: Python Software Foundation CPython · CVSS 2.1 Low · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-150
- [Inspektor Gadget uses unsanitized ANSI Escape Sequences In \`columns\` Output Mode](https://agentprime.io/advisories/GHSA-34r5-6j7w-235f.md)
  `GHSA-34r5-6j7w-235f`, `CVE-2026-25996`, `GO-2026-5068` · Go `github.com/inspektor-gadget/inspektor-gadget`: affected `<0.49.1`, fixed in `0.49.1` · CVSS 6.9 Medium · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-150
- [MuPDF < 1.27 mutool ANSI Injection via Metadata](https://agentprime.io/advisories/CVE-2026-40505.md)
  `CVE-2026-40505` · CVE record: Artifex Software Inc. MuPDF · CVSS 4.8 Medium · Not analysed yet · Published 16 Apr 2026 · Tags: CWE-150
- [Microsoft Power Apps Desktop Client Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-26149.md)
  `CVE-2026-26149` · CVE record: Microsoft Microsoft Power Apps Desktop Client · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-150
- [OpenClaw has ACP CLI approval prompt ANSI escape sequence injection](https://agentprime.io/advisories/GHSA-4hmj-39m8-jwc7.md)
  `GHSA-4hmj-39m8-jwc7`, `CVE-2026-35651` · npm `openclaw`: affected `>=2026.2.13, <2026.3.28`, fixed in `2026.3.28` · CVSS 5.3 Medium · Not analysed yet · Published 29 Mar 2026 · Tags: CWE-116, CWE-150
- [AWS SDK for PHP has CloudFront Policy Document Injection via Special Characters](https://agentprime.io/advisories/GHSA-27qh-8cxx-2cr5.md)
  `GHSA-27qh-8cxx-2cr5`, `PKSA-4t1p-xpk2-nsss` · Packagist `aws/aws-sdk-php`: affected `>=3.11.7, <3.371.4`, fixed in `3.371.4` · CVSS 4.0, no score published · Not analysed yet · Published 27 Mar 2026 · Tags: Other injection, CWE-20, CWE-150
- [Mattermost allows attackers to manipulate administrator terminals via crafted messages containing ANSI and OSC escape sequences](https://agentprime.io/advisories/GHSA-3439-vqgj-2gcf.md)
  `GHSA-3439-vqgj-2gcf`, `CVE-2026-3108`, `GO-2026-5067` · Go `github.com/mattermost/mattermost/server/v8`: affected `>=8.0.0-20260105080200-d27a2195068d, <8.0.0-20260217110922-b7d4a1f1f59b || >=10.11.0-rc1, <10.11.11 || >=11.2.0-rc1, <11.2.3 || >=11.3.0-rc1, <11.3.2 || >=11.4.0-rc1, <11.4.1`, fixed in `8.0.0-20260217110922-b7d4a1f1f59b`, `10.11.11`, `11.2.3`, `11.3.2`, `11.4.1` · CVSS 8.0 High · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-150
- [QuRouter](https://agentprime.io/advisories/CVE-2025-62845.md)
  `CVE-2025-62845` · CVE record: QNAP Systems Inc. QuRouter · CVSS 5.6 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-150
- [Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance.](https://agentprime.io/advisories/CVE-2025-15311.md)
  `CVE-2025-15311` · CVE record: Tanium Tanium Appliance · CVSS 7.8 High · Not analysed yet · Published 5 Feb 2026 · Tags: CWE-150
- [Mailpit has an SMTP Header Injection via Regex Bypass in github.com/axllent/mailpit](https://agentprime.io/advisories/GHSA-54wq-72mp-cq7c.md)
  `GHSA-54wq-72mp-cq7c`, `CVE-2026-23829`, `GO-2026-4333` · Go `github.com/axllent/mailpit`: affected `<1.28.3`, fixed in `1.28.3` · CVSS 5.3 Medium · Not analysed yet · Published 3 Feb 2026 · Tags: Other injection, CWE-150
- [Word Copilot Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-21521.md)
  `CVE-2026-21521` · CVE record: Microsoft Microsoft 365 Word Copilot · CVSS 7.4 High · Not analysed yet · Published 22 Jan 2026 · Tags: CWE-150
- [badkeys vulnerable to ASCII control character injection on console via malformed input](https://agentprime.io/advisories/GHSA-wjpc-4f29-83h3.md)
  `GHSA-wjpc-4f29-83h3`, `CVE-2026-21439`, `PYSEC-2026-1212` · PyPI `badkeys`: affected `<0.0.16`, fixed in `0.0.16` · CVSS 2.0 Low · Not analysed yet · Published 5 Jan 2026 · Tags: CWE-150
- [Apache HTTP Server: CGI environment variable override](https://agentprime.io/advisories/CVE-2025-65082.md)
  `CVE-2025-65082` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 6.5 Medium · Not analysed yet · Published 5 Dec 2025 · Tags: CWE-150
- [Soft Serve does not sanitize ANSI escape sequences in user input in github.com/charmbracelet/soft-serve](https://agentprime.io/advisories/GHSA-fv2r-r8mp-pg48.md)
  `GHSA-fv2r-r8mp-pg48`, `CVE-2025-64494`, `GO-2025-4106` · Go `github.com/charmbracelet/soft-serve`: affected `<0.11.0`, fixed in `0.11.0` · CVSS 4.6 Medium · Not analysed yet · Published 17 Nov 2025 · Tags: CWE-150

Older: <https://agentprime.io/advisories/tag/cwe-150.md?cursor=WyIyMDI1LTExLTE3VDE5OjExOjIzLjAwMDAwMFoiLCJHSFNBLWZ2MnItcjhtcC1wZzQ4Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-150>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-150/>. Everything for agents: <https://agentprime.io/llms.txt>.