# CWE-426.

Every Advisory and CVE whose sources give the weakness CWE-426, newest first.

## Records, newest first (an older page)

- [Untrusted search path in Siemens COMOS V10.4.5 and others](https://agentprime.io/advisories/CVE-2025-40945.md)
  `CVE-2025-40945` · CVE record: Siemens COMOS V10.4.5 and 4 more · CVSS 8.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-426
- [Tencent PC Manager QMUDisk Driver qmudisk64.sys uncontrolled search path](https://agentprime.io/advisories/CVE-2026-15515.md)
  `CVE-2026-15515` · CVE record: Tencent PC Manager · CVSS 7.3 High · Not analysed yet · Published 13 Jul 2026 · Tags: CWE-426, CWE-427
- [App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc](https://agentprime.io/advisories/CVE-2026-49145.md)
  `CVE-2026-49145` · CVE record: PETDANCE App::Ack · CVSS 7.5 High · Not analysed yet · Published 8 Jul 2026 · Tags: Path traversal, CWE-426
- [Untrusted Search Path](https://agentprime.io/advisories/CVE-2026-6901.md)
  `CVE-2026-6901` · CVE record: B&R Industrial Automation GmbH APROL · CVSS 8.4 High · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-426
- [OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows](https://agentprime.io/advisories/GHSA-8wg3-5mcm-fjq8.md)
  `GHSA-8wg3-5mcm-fjq8`, `CVE-2026-53819` · npm `openclaw`: affected `<2026.5.27`, fixed in `2026.5.27` · CVSS 8.7 High · Not analysed yet · Published 2 Jul 2026 · Tags: CWE-426
- [PBackupVSS.exe in Matrix42 Empirum before 25.5 and 26.x before 26.2 creates a named pipe (\\\\.\pipe\PBackupVSS) with a DACL that grants GENERIC_READ and GENERIC_WRITE permissions to all authenticated…](https://agentprime.io/advisories/CVE-2026-57919.md)
  `CVE-2026-57919` · CVE record · CVSS 7.8 High · Not analysed yet · Published 29 Jun 2026 · Tags: Broken access control, CWE-426
- [Notepad++: Privilege Escalation in the Installer via Uncontrolled Executable Search Path](https://agentprime.io/advisories/CVE-2026-46710.md)
  `CVE-2026-46710` · CVE record: notepad-plus-plus notepad-plus-plus · CVSS 7.5 High · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-426
- [OpenClaw: Workspace-derived service PATH could influence trash command selection](https://agentprime.io/advisories/GHSA-rx78-29qr-5hq8.md)
  `GHSA-rx78-29qr-5hq8`, `CVE-2026-53865` · npm `openclaw`: affected `<2026.5.2`, fixed in `2026.5.2` · CVSS 7.2 High · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-426
- [OpenClaw: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots](https://agentprime.io/advisories/GHSA-wc84-j36w-pw4x.md)
  `GHSA-wc84-j36w-pw4x`, `CVE-2026-53858` · npm `openclaw`: affected `<2026.5.2`, fixed in `2026.5.2` · CVSS 7.0 High · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-426
- [OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install](https://agentprime.io/advisories/GHSA-24vr-rprv-67rf.md)
  `GHSA-24vr-rprv-67rf`, `CVE-2026-53846` · npm `openclaw`: affected `<2026.4.29`, fixed in `2026.4.29` · CVSS 7.0 High · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-426
- [OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution](https://agentprime.io/advisories/GHSA-fq9j-vw4w-fr6v.md)
  `GHSA-fq9j-vw4w-fr6v`, `CVE-2026-53842` · npm `openclaw`: affected `<2026.5.2`, fixed in `2026.5.2` · CVSS 7.0 High · Not analysed yet · Published 18 Jun 2026 · Tags: CWE-426
- [Duplicate Advisory: Workspace-derived service PATH could influence trash command selection](https://agentprime.io/advisories/GHSA-2w22-3f6x-3hf4.md)
  `GHSA-2w22-3f6x-3hf4` · npm `openclaw`: affected `*`, no fixed version yet · CVSS 7.1 High · Withdrawn · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-426
- [Duplicate Advisory: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots](https://agentprime.io/advisories/GHSA-4qgr-57jq-93vh.md)
  `GHSA-4qgr-57jq-93vh` · npm `openclaw`: affected `*`, no fixed version yet · CVSS 7.1 High · Withdrawn · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-426
- [Duplicate Advisory: Workspace .env npm_execpath could influence bundled runtime dependency install](https://agentprime.io/advisories/GHSA-qp5j-jr73-m2pw.md)
  `GHSA-qp5j-jr73-m2pw` · npm `openclaw`: affected `*`, no fixed version yet · CVSS 7.1 High · Withdrawn · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-426
- [Duplicate Advisory: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution](https://agentprime.io/advisories/GHSA-9fr2-p65v-gqxq.md)
  `GHSA-9fr2-p65v-gqxq` · PyPI `openclaw`: affected `*`, no fixed version yet · CVSS 7.1 High · Withdrawn · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-426
- [Withdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY](https://agentprime.io/advisories/GHSA-gv7w-rqvm-qjhr.md)
  `GHSA-gv7w-rqvm-qjhr` · npm `esbuild`: affected `>=0.17.0, <0.28.1`, fixed in `0.28.1` · CVSS 8.1 High · Withdrawn · Not analysed yet · Published 12 Jun 2026 · Tags: CWE-426, CWE-494
- [Kitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol](https://agentprime.io/advisories/CVE-2026-54055.md)
  `CVE-2026-54055` · CVE record: kovidgoyal kitty · CVSS 5.0 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: Path traversal, Race condition, CWE-426
- [AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance](https://agentprime.io/advisories/GHSA-r236-5pc3-3qcp.md)
  `GHSA-r236-5pc3-3qcp`, `CVE-2026-11401`, `GO-2026-5601` · Go `github.com/aws/aws-advanced-go-wrapper/auth-helpers` and 10 more: affected `<1.1.1`, fixed in `1.1.1` · CVSS 8.6 High · Not analysed yet · Published 11 Jun 2026 · Tags: CWE-426
- [Windows Narrator Braille Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-48565.md)
  `CVE-2026-48565` · CVE record: Microsoft Windows Narrator Braille · CVSS 7.8 High · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-426
- [Windows Storage Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-47648.md)
  `CVE-2026-47648` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.0 High · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-426
- [Local Privilege Escalation via Dynamic Library Injection in Waves Central for macOS](https://agentprime.io/advisories/CVE-2026-24064.md)
  `CVE-2026-24064` · CVE record: Waves Audio Ltd. Waves Central · CVSS 7.8 High · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-426
- [ouroboros-ai Vulnerable to Remote Code Execution via Untrusted Project-Directory .env](https://agentprime.io/advisories/GHSA-c4m7-2gwp-vw76.md)
  `GHSA-c4m7-2gwp-vw76`, `CVE-2026-47211`, `PYSEC-2026-2857` · PyPI `ouroboros-ai`: affected `<0.39.0`, fixed in `0.39.0` · CVSS 8.4 High · Not analysed yet · Published 29 May 2026 · Tags: CWE-426
- [RTK improperly trusts project-local filter configuration, allowing silent tampering of command output shown to LLM](https://agentprime.io/advisories/GHSA-fvvm-949w-qj4w.md)
  `GHSA-fvvm-949w-qj4w`, `CVE-2026-45792` · crates.io `rtk`: affected `<0.32.0`, fixed in `0.32.0` · CVSS 6.9 Medium · Not analysed yet · Published 20 May 2026 · Tags: CWE-345, CWE-426
- [Turbo: Unexpected local code execution during Yarn Berry detection](https://agentprime.io/advisories/GHSA-3qcw-2rhx-2726.md)
  `GHSA-3qcw-2rhx-2726`, `CVE-2026-45772` · npm `turbo` and 2 more: affected `>=1.1.0, <2.9.14`, fixed in `2.9.14` · CVSS 0.0 None · Not analysed yet · Published 19 May 2026 · Tags: CWE-426
- [Algernon: handler.lua discovery walks parent directories above the server root](https://agentprime.io/advisories/GHSA-xwcr-wm99-g9jc.md)
  `GHSA-xwcr-wm99-g9jc`, `CVE-2026-45721`, `GO-2026-5772` · Go `github.com/xyproto/algernon`: affected `<1.17.7`, fixed in `1.17.7` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 May 2026 · Tags: Information disclosure, CWE-20, CWE-426
- [GlobalProtect App: Local Privilege Escalation Vulnerabilities](https://agentprime.io/advisories/CVE-2026-0251.md)
  `CVE-2026-0251` · CVE record: Palo Alto Networks GlobalProtect App and 1 more · CVSS 5.9 Medium · Not analysed yet · Published 13 May 2026 · Tags: CWE-426
- [Untrusted search path in Zoom Communications Zoom Rooms](https://agentprime.io/advisories/CVE-2026-30906.md)
  `CVE-2026-30906` · CVE record: Zoom Communications Zoom Rooms · CVSS 7.8 High · Not analysed yet · Published 13 May 2026 · Tags: CWE-426
- [Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-42830.md)
  `CVE-2026-42830` · CVE record: Microsoft Azure Monitor Agent Metrics Extension · CVSS 6.5 Medium · Not analysed yet · Published 12 May 2026 · Tags: CWE-426
- [CloudNativePG's metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE](https://agentprime.io/advisories/GHSA-423p-g724-fr39.md)
  `GHSA-423p-g724-fr39`, `CVE-2026-44477`, `GO-2026-5106` · Go `github.com/cloudnative-pg/cloudnative-pg`: affected `<1.28.3 || >=1.29.0, <1.29.1`, fixed in `1.28.3`, `1.29.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 May 2026 · Tags: Privilege escalation, CWE-271, CWE-426
- [Openshift-controller-manager: openshift container platform: information disclosure via environment variable injection](https://agentprime.io/advisories/CVE-2026-7309.md)
  `CVE-2026-7309` · CVE record: Red Hat Red Hat OpenShift Container Platform 4 · CVSS 4.3 Medium · Not analysed yet · Published 28 Apr 2026 · Tags: CWE-426
- [uutils coreutils has an Untrusted Search Path](https://agentprime.io/advisories/GHSA-mh5c-xrmh-m794.md)
  `GHSA-mh5c-xrmh-m794`, `CVE-2026-35368` · crates.io `coreutils`: affected `<=0.8.0`, no fixed version yet · CVSS 7.2 High · Not analysed yet · Published 22 Apr 2026 · Tags: CWE-426
- [Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows](https://agentprime.io/advisories/GHSA-5cwg-9f6j-9jvx.md)
  `GHSA-5cwg-9f6j-9jvx`, `CVE-2026-35603` · npm `@anthropic-ai/claude-code`: affected `<2.1.75`, fixed in `2.1.75` · CVSS 5.4 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: CWE-426
- [Mobatek MobaXterm Home Edition msimg32.dll uncontrolled search path](https://agentprime.io/advisories/CVE-2026-6421.md)
  `CVE-2026-6421` · CVE record: Mobatek MobaXterm Home Edition · CVSS 7.3 High · Not analysed yet · Published 17 Apr 2026 · Tags: CWE-426, CWE-427
- [Untrusted search path in Yubico libfido2 and others](https://agentprime.io/advisories/CVE-2026-40947.md)
  `CVE-2026-40947` · CVE record: Yubico libfido2 and 2 more · CVSS 2.9 Low · Not analysed yet · Published 15 Apr 2026 · Tags: CWE-426
- [Adobe Framemaker | Untrusted Search Path (CWE-426)](https://agentprime.io/advisories/CVE-2026-27290.md)
  `CVE-2026-27290` · CVE record: Adobe Adobe Framemaker · CVSS 8.6 High · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-426
- [PraisonAI Vulnerable to RCE via Automatic tools.py Import](https://agentprime.io/advisories/GHSA-g985-wjh9-qxxc.md)
  `GHSA-g985-wjh9-qxxc`, `CVE-2026-40287`, `PYSEC-2026-2914`, `PYSEC-2026-2947` · PyPI `praisonai` and 1 more: affected `<4.5.139`, fixed in `4.5.139` · CVSS 8.4 High · Not analysed yet · Published 10 Apr 2026 · Tags: Code injection, CWE-426
- [PraisonAI Vulnerable to Implicit Execution of Arbitrary Code via Automatic \`tools.py\` Loading](https://agentprime.io/advisories/GHSA-2g3w-cpc4-chr4.md)
  `GHSA-2g3w-cpc4-chr4`, `CVE-2026-40156`, `PYSEC-2026-2895` · PyPI `praisonai`: affected `<4.5.128`, fixed in `4.5.128` · CVSS 7.8 High · Not analysed yet · Published 10 Apr 2026 · Tags: Code injection, CWE-426, CWE-829
- [opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking](https://agentprime.io/advisories/GHSA-hfvc-g4fc-pqhx.md)
  `GHSA-hfvc-g4fc-pqhx`, `CVE-2026-39883`, `GO-2026-5426` · Go `go.opentelemetry.io/otel/sdk`: affected `>=1.15.0, <1.43.0`, fixed in `1.43.0` · CVSS 7.3 High · Not analysed yet · Published 8 Apr 2026 · Tags: CWE-426
- [OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config](https://agentprime.io/advisories/GHSA-vfw7-6rhc-6xxg.md)
  `GHSA-vfw7-6rhc-6xxg`, `CVE-2026-41384` · npm `openclaw`: affected `<2026.3.24`, fixed in `2026.3.24` · CVSS 8.5 High · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-15, CWE-426
- [omd: Local privilege escalation when executing omd commands as root](https://agentprime.io/advisories/CVE-2025-39666.md)
  `CVE-2025-39666` · CVE record: Checkmk GmbH Checkmk · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-426, CWE-829
- [Hirschmann Industrial HiVision External Application Path Hijacking Leading to Arbitrary Code Execution](https://agentprime.io/advisories/CVE-2022-4987.md)
  `CVE-2022-4987` · CVE record: Belden Hirschmann Industrial HiVision · CVSS 7.0 High · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-426
- [Foxit PDF Editor/Reader Installer Uncontrolled Search Path Privilege Escalation](https://agentprime.io/advisories/CVE-2026-3780.md)
  `CVE-2026-3780` · CVE record: Foxit Software Inc. Foxit PDF Reader and 1 more · CVSS 7.3 High · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-426
- [OpenClaw has a CWD \`.env\` environment variable injection which bypasses host-env policy and allows config takeover](https://agentprime.io/advisories/GHSA-8rh7-6779-cjqq.md)
  `GHSA-8rh7-6779-cjqq`, `CVE-2026-41294` · npm `openclaw`: affected `<2026.3.28`, fixed in `2026.3.28` · CVSS 8.5 High · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-15, CWE-426
- [openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification](https://agentprime.io/advisories/GHSA-j48q-4c78-rhf9.md)
  `GHSA-j48q-4c78-rhf9`, `CVE-2026-74872`, `PYSEC-2026-3742` · PyPI `openssl-encrypt`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Mar 2026 · Tags: CWE-426, CWE-427
- [OpenClaw has an Arbitrary Malicious Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-m3mh-3mpg-37hw.md)
  `GHSA-m3mh-3mpg-37hw`, `CVE-2026-35641` · npm `openclaw`: affected `<2026.3.24`, fixed in `2026.3.24` · CVSS 8.4 High · Not analysed yet · Published 30 Mar 2026 · Tags: CWE-349, CWE-426
- [UltraVNC Service version.dll uncontrolled search path](https://agentprime.io/advisories/CVE-2026-4962.md)
  `CVE-2026-4962` · CVE record: UltraVNC · CVSS 7.3 High · Not analysed yet · Published 27 Mar 2026 · Tags: CWE-426, CWE-427
- [Flos Freeware Notepad2 TextShaping.dll uncontrolled search path](https://agentprime.io/advisories/CVE-2026-4546.md)
  `CVE-2026-4546` · CVE record: Flos Freeware Notepad2 · CVSS 7.3 High · Not analysed yet · Published 22 Mar 2026 · Tags: CWE-426, CWE-427
- [Flos Freeware Notepad2 PROPSYS.dll uncontrolled search path](https://agentprime.io/advisories/CVE-2026-4545.md)
  `CVE-2026-4545` · CVE record: Flos Freeware Notepad2 · CVSS 7.3 High · Not analysed yet · Published 22 Mar 2026 · Tags: CWE-426, CWE-427
- [DLL Sideloading in ScreenToGif](https://agentprime.io/advisories/CVE-2026-33156.md)
  `CVE-2026-33156` · CVE record: NickeManarin ScreenToGif · CVSS 7.8 High · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-426, CWE-427
- [Greenshot Vulnerable to OS Command Injection via ExternalCommand Plugin](https://agentprime.io/advisories/CVE-2026-25792.md)
  `CVE-2026-25792` · CVE record: greenshot greenshot · CVSS 6.5 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-426
- [Illustrator | Untrusted Search Path (CWE-426)](https://agentprime.io/advisories/CVE-2026-21333.md)
  `CVE-2026-21333` · CVE record: Adobe Illustrator Desktop 2026 and 1 more · CVSS 8.6 High · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-426
- [Windows GDI Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-25190.md)
  `CVE-2026-25190` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 7.8 High · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-426
- [UltraVNC Windows Service cryptbase.dll uncontrolled search path](https://agentprime.io/advisories/CVE-2026-3787.md)
  `CVE-2026-3787` · CVE record: UltraVNC · CVSS 7.3 High · Not analysed yet · Published 8 Mar 2026 · Tags: CWE-426, CWE-427
- [TimescaleDB uses untrusted search path during extension upgrade](https://agentprime.io/advisories/CVE-2026-29089.md)
  `CVE-2026-29089` · CVE record: timescale timescaledb · CVSS 8.8 High · Not analysed yet · Published 6 Mar 2026 · Tags: CWE-426
- [OpenClaw's \`tools.exec.safeBins\` PATH-hijack allowed trojan binaries to bypass allowlist checks](https://agentprime.io/advisories/GHSA-g75x-8qqm-2vxp.md)
  `GHSA-g75x-8qqm-2vxp`, `CVE-2026-32015` · npm `openclaw`: affected `>=2026.1.21, <2026.2.19`, fixed in `2026.2.19` · CVSS 7.3 High · Not analysed yet · Published 3 Mar 2026 · Tags: Broken access control, CWE-426
- [OpenClaw: safeBins static default trusted dirs allow writable-dir binary hijack (\`jq\`)](https://agentprime.io/advisories/GHSA-5gj7-jf77-q2q2.md)
  `GHSA-5gj7-jf77-q2q2`, `CVE-2026-32009` · npm `openclaw`: affected `<2026.2.24`, fixed in `2026.2.24` · CVSS 7.0 High · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-426, CWE-428, CWE-829
- [OpenClaw's shell env fallback trusts unvalidated SHELL path from host environment](https://agentprime.io/advisories/GHSA-f8mp-vj46-cq8v.md)
  `GHSA-f8mp-vj46-cq8v`, `CVE-2026-32032` · npm `openclaw`: affected `<2026.2.22`, fixed in `2026.2.22` · CVSS 7.3 High · Not analysed yet · Published 3 Mar 2026 · Tags: Command injection, CWE-426
- [OpenClaw's tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode](https://agentprime.io/advisories/GHSA-qhrr-grqp-6x2g.md)
  `GHSA-qhrr-grqp-6x2g` · npm `openclaw`: affected `<2026.2.22`, fixed in `2026.2.22` · CVSS 4.0, no score published · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-426
- [OpenClaw: macOS optional allowlist basename matching could bypass path-based policy](https://agentprime.io/advisories/GHSA-7f4q-9rqh-x36p.md)
  `GHSA-7f4q-9rqh-x36p`, `CVE-2026-32016` · npm `openclaw`: affected `<2026.2.22`, fixed in `2026.2.22` · CVSS 7.3 High · Not analysed yet · Published 3 Mar 2026 · Tags: Broken access control, CWE-426
- [OpenClaw: system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebind](https://agentprime.io/advisories/GHSA-q399-23r3-hfx4.md)
  `GHSA-q399-23r3-hfx4`, `CVE-2026-31997` · npm `openclaw`: affected `<2026.3.1`, fixed in `2026.3.1` · CVSS 4.4 Medium · Not analysed yet · Published 2 Mar 2026 · Tags: Race condition, CWE-426

Newest: <https://agentprime.io/advisories/tag/cwe-426.md>
Older: <https://agentprime.io/advisories/tag/cwe-426.md?cursor=WyIyMDI2LTAzLTAyVDIyOjAzOjI5LjAwMDAwMFoiLCJHSFNBLXEzOTktMjNyMy1oZng0Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-426&cursor=WyIyMDI2LTA3LTE0VDE3OjA1OjE2LjQxNzAwMFoiLCJDVkUtMjAyNi01NzA5NyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-426/?cursor=WyIyMDI2LTA3LTE0VDE3OjA1OjE2LjQxNzAwMFoiLCJDVkUtMjAyNi01NzA5NyJd>. Everything for agents: <https://agentprime.io/llms.txt>.