# CWE-61.

Every Advisory and CVE whose sources give the weakness CWE-61, newest first.

## Records, newest first

- [LXC: lxc-copy host-context hostname update follows symlink](https://agentprime.io/advisories/CVE-2026-100395.md)
  `CVE-2026-100395` · CVE record: lxc lxc · CVSS 6.8 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal, CWE-61
- [nvm prints the contents of any readable file through a symlinked .nvmrc](https://agentprime.io/advisories/CVE-2026-121747.md)
  `CVE-2026-121747` · CVE record: nvm-sh nvm · CVSS 6.7 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal, Information disclosure, CWE-61
- [Malicious client could set xattr value outside of BuildKit state directory](https://agentprime.io/advisories/CVE-2026-121520.md)
  `CVE-2026-121520` · CVE record: Moby BuildKit · CVSS 4.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-61
- [NVIDIA Slurm: NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that…](https://agentprime.io/advisories/CVE-2026-65109.md)
  `CVE-2026-65109` · CVE record: NVIDIA Slurm · CVSS 4.7 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-61
- [Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink](https://agentprime.io/advisories/CVE-2026-119336.md)
  `CVE-2026-119336` · CVE record: pi-hole pi-hole · CVSS 7.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal, CWE-61
- [zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.](https://agentprime.io/advisories/GHSA-hjqx-j4rw-g7xv.md)
  `GHSA-hjqx-j4rw-g7xv`, `CVE-2026-115908` · crates.io `zip`: affected `>=7.2.0, <9.0.0`, fixed in `9.0.0` · CVSS 7.4 High · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal, CWE-61
- [Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination](https://agentprime.io/advisories/CVE-2026-115424.md)
  `CVE-2026-115424` · CVE record: Red Hat Red Hat OpenShift Container Platform 4 and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-61
- [AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink](https://agentprime.io/advisories/CVE-2026-102740.md)
  `CVE-2026-102740` · CVE record: AsyncHttpClient async-http-client · CVSS 5.8 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control, CWE-61, CWE-379
- [Import Symlink Following Remote Code Execution Vulnerability in QuMagie](https://agentprime.io/advisories/CVE-2026-50612.md)
  `CVE-2026-50612` · CVE record: QNAP Systems Inc. QuMagie · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-61
- [Symlink creation in qsyncsrv.cgi](https://agentprime.io/advisories/CVE-2026-41541.md)
  `CVE-2026-41541` · CVE record: QNAP Systems Inc. Qsync Central · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-61
- [Filesystem sandbox escape when renaming symlinks with trailing slashes](https://agentprime.io/advisories/GHSA-m9f7-9w4p-gv38.md)
  `GHSA-m9f7-9w4p-gv38`, `CVE-2026-118688`, `RUSTSEC-2026-0352` · crates.io `wasmtime-wasi`: affected `>=0.0.0-0, <36.0.18 || >=37.0.0, <48.0.6 || >=49.0.0, <49.0.3`, fixed in `36.0.18`, `48.0.6`, `49.0.3` · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-61
- [denji ngx_cache_purge: ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain…](https://agentprime.io/advisories/CVE-2026-108981.md)
  `CVE-2026-108981` · CVE record: denji ngx_cache_purge · CVSS 3.6 Low · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-61
- [Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied](https://agentprime.io/advisories/GHSA-p8v3-89rh-jxc7.md)
  `GHSA-p8v3-89rh-jxc7`, `CVE-2026-107810`, `GO-2026-6707` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074146-a467ed652591`, fixed in `1.9.10-0.20260728074146-a467ed652591` · CVSS 8.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Path traversal, CWE-61
- [ImageMagick: Policy Bypass in delegate symlink cleanup due to missing check](https://agentprime.io/advisories/CVE-2026-106566.md)
  `CVE-2026-106566` · CVE record: ImageMagick ImageMagick · CVSS 4.0 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-61
- [Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction](https://agentprime.io/advisories/CVE-2026-107174.md)
  `CVE-2026-107174` · CVE record: Red Hat OpenShift Serverless and 3 more · CVSS 6.4 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-61
- [Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code](https://agentprime.io/advisories/CVE-2026-103435.md)
  `CVE-2026-103435` · CVE record: Anthropic @anthropic-ai/claude-code · CVSS 7.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal, Race condition, CWE-61
- [Backstage: TechDocs arbitrary file read via mkdocs snippets](https://agentprime.io/advisories/CVE-2026-106507.md)
  `CVE-2026-106507` · CVE record: backstage backstage and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal, CWE-61
- [gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive.](https://agentprime.io/advisories/CVE-2026-105712.md)
  `CVE-2026-105712` · CVE record: GnuPG GnuPG · CVSS 3.6 Low · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-61
- [Dulwich: Symlink write-through in checkout(paths=\[\]) via raw os.open bypasses all symlink protections](https://agentprime.io/advisories/GHSA-8w8g-wq8h-fq33.md)
  `GHSA-8w8g-wq8h-fq33`, `CVE-2026-114096` · PyPI `dulwich`: affected `>=0.24.0, <1.2.8`, fixed in `1.2.8` · CVSS 7.3 High · Not analysed yet · Published 2 Oct 2026 · Tags: Path traversal, CWE-61
- [Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc](https://agentprime.io/advisories/CVE-2026-97024.md)
  `CVE-2026-97024` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-61
- [Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin](https://agentprime.io/advisories/CVE-2026-97023.md)
  `CVE-2026-97023` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 7.1 High · Not analysed yet · Published 28 Sept 2026 · Tags: CWE-61
- [Language Servers for AWS vulnerable to arbitrary file write](https://agentprime.io/advisories/GHSA-6v3r-4p5c-mrp5.md)
  `GHSA-6v3r-4p5c-mrp5`, `CVE-2026-12958` · npm `@aws/lsp-codewhisperer`: affected `<0.0.117`, fixed in `0.0.117` · CVSS 8.5 High · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-61
- [Flatpak: In Flatpak before 1.18.1, the revokefs writer…](https://agentprime.io/advisories/CVE-2026-96808.md)
  `CVE-2026-96808` · CVE record: Flatpak Flatpak · CVSS 7.4 High · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-61
- [Flatpak: In Flatpak before 1.18.1, a malicious sandboxed app can replace \~/.var/app/$appid/.ld.so…](https://agentprime.io/advisories/CVE-2026-96807.md)
  `CVE-2026-96807` · CVE record: Flatpak Flatpak · CVSS 4.0 Medium · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-61
- [Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste](https://agentprime.io/advisories/CVE-2026-91202.md)
  `CVE-2026-91202` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 1 more · CVSS 6.1 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-61
- [HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-91099.md)
  `CVE-2026-91099` · CVE record: HP Inc. HP Linux Imaging and Printing Software (HPLIP) · CVSS 5.1 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-61
- [Flatpak: In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write…](https://agentprime.io/advisories/CVE-2026-90616.md)
  `CVE-2026-90616` · CVE record: Flatpak Flatpak · CVSS 7.4 High · Not analysed yet · Published 12 Sept 2026 · Tags: CWE-61
- [Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink](https://agentprime.io/advisories/CVE-2026-77159.md)
  `CVE-2026-77159` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-61
- [OCaml opam: In the opam package before 2.5.2 for OCaml…](https://agentprime.io/advisories/CVE-2026-57825.md)
  `CVE-2026-57825` · CVE record: OCaml opam · CVSS 5.7 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-61
- [NLTK: Downloader.download follows hardlinks and overwrites outside-root files](https://agentprime.io/advisories/GHSA-f794-5jv7-7672.md)
  `GHSA-f794-5jv7-7672`, `CVE-2026-81727`, `PYSEC-2026-3741` · PyPI `nltk`: affected `<3.10.3`, fixed in `3.10.3` · CVSS 6.9 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: Path traversal, CWE-61
- [Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink) Following vulnerability.](https://agentprime.io/advisories/CVE-2026-79939.md)
  `CVE-2026-79939` · CVE record: Dell Power Protect Cyber Recovery and 1 more · CVSS 5.8 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-61
- [Predictable temporary file in /tmp allows symlink attack in LACT](https://agentprime.io/advisories/CVE-2026-75038.md)
  `CVE-2026-75038` · CVE record: ilya-zlobintsev LACT · CVSS 6.9 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-61
- [Runtipi: Authenticated arbitrary file write via backup restore symlink planting](https://agentprime.io/advisories/CVE-2026-55168.md)
  `CVE-2026-55168` · CVE record: runtipi runtipi · CVSS 6.5 Medium · Not analysed yet · Published 21 Aug 2026 · Tags: Path traversal, CWE-61
- [Incus vulnerable to root RCE via image backup.yaml symlink](https://agentprime.io/advisories/CVE-2026-63125.md)
  `CVE-2026-63125` · CVE record: lxc incus · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2026 · Tags: Path traversal, CWE-61
- [Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature](https://agentprime.io/advisories/CVE-2026-64846.md)
  `CVE-2026-64846` · CVE record: NixOS nix · CVSS 2.8 Low · Not analysed yet · Published 20 Aug 2026 · Tags: Race condition, CWE-61
- [Filesystem sandbox escape when paths or symlinks contain trailing slashes](https://agentprime.io/advisories/GHSA-vqjp-4c8c-hfgg.md)
  `GHSA-vqjp-4c8c-hfgg`, `CVE-2026-115392`, `RUSTSEC-2026-0269` · crates.io `wasmtime`: affected `>=0.0.0-0, <24.0.13 || >=25.0.0, <36.0.14 || >=37.0.0, <46.0.3 || >=47.0.0, <47.0.4`, fixed in `24.0.13`, `36.0.14`, `46.0.3`, `47.0.4` · CVSS 8.8 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-61
- [Dell AppSync: Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1…](https://agentprime.io/advisories/CVE-2026-32657.md)
  `CVE-2026-32657` · CVE record: Dell AppSync and 4 more · CVSS 7.3 High · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-61
- [crun follows rootfs /dev symlink while creating default devices](https://agentprime.io/advisories/CVE-2026-47766.md)
  `CVE-2026-47766` · CVE record: containers crun · CVSS 5.1 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: CWE-61
- [rsync < 3.5.0 Arbitrary File Read via Symlink Following](https://agentprime.io/advisories/CVE-2026-53802.md)
  `CVE-2026-53802` · CVE record: RsyncProject rsync · CVSS 8.4 High · Not analysed yet · Published 13 Aug 2026 · Tags: CWE-61
- [Smarty: Symlink path traversal out of trusted directories](https://agentprime.io/advisories/GHSA-f6wf-28g6-769x.md)
  `GHSA-f6wf-28g6-769x`, `CVE-2026-62992`, `PKSA-zw1q-6h4d-mf1m` · Packagist `smarty/smarty`: affected `<4.5.7 || >=5.0.0, <5.8.2`, fixed in `4.5.7`, `5.8.2` · CVSS 6.9 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Path traversal, CWE-61
- [\`proot-distro install\` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive](https://agentprime.io/advisories/GHSA-9xq3-3fqg-4vg7.md)
  `GHSA-9xq3-3fqg-4vg7`, `CVE-2026-54574`, `PYSEC-2026-3608` · PyPI `proot-distro`: affected `<5.1.5`, fixed in `5.1.5` · CVSS 8.2 High · Not analysed yet · Published 29 Jul 2026 · Tags: CWE-61
- [skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source](https://agentprime.io/advisories/GHSA-6xx4-9wp6-65p7.md)
  `GHSA-6xx4-9wp6-65p7` · crates.io `skilo`: affected `>=0.5.0, <0.11.1`, fixed in `0.11.1` · CVSS 6.5 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal, CWE-61
- [Authenticated RCE via Symlink Following in Cribl Stream Pack Git Import](https://agentprime.io/advisories/CVE-2026-56748.md)
  `CVE-2026-56748` · CVE record: Cribl Cribl Stream · CVSS 8.7 High · Not analysed yet · Published 27 Jul 2026 · Tags: CWE-61
- [perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink](https://agentprime.io/advisories/CVE-2026-17459.md)
  `CVE-2026-17459` · CVE record: perwendel spark · CVSS 5.3 Medium · Not analysed yet · Published 26 Jul 2026 · Tags: Path traversal, CWE-61
- [Datasets Symlink-following Arbitrary File Write via Extractor.extract()](https://agentprime.io/advisories/CVE-2026-65010.md)
  `CVE-2026-65010` · CVE record: huggingface datasets · CVSS 4.4 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: CWE-61
- [Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys](https://agentprime.io/advisories/CVE-2026-12080.md)
  `CVE-2026-12080` · CVE record: Red Hat Red Hat Enterprise Linux 9 and 4 more · CVSS 7.3 High · Not analysed yet · Published 20 Jul 2026 · Tags: CWE-61
- [LPE from suricata user to root due to chown in %post in suricata packaging](https://agentprime.io/advisories/CVE-2026-59674.md)
  `CVE-2026-59674` · CVE record: SUSE openSUSE Tumbleweed · CVSS 7.1 High · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-61
- [Root escape via symlink plus trailing slash in os](https://agentprime.io/advisories/GO-2026-4970.md)
  `GO-2026-4970`, `BIT-golang-2026-39822`, `CVE-2026-39822` · Go `stdlib`: affected `<1.25.12 || >=1.26.0-0, <1.26.5 || >=1.27.0-0, <1.27.0-rc.2`, fixed in `1.25.12`, `1.26.5`, `1.27.0-rc.2` · CVSS 7.8 High · Not analysed yet · Published 7 Jul 2026 · Tags: CWE-61
- [zcaceres markdownify-mcp Markdownify.ts assertPathAllowed symlink](https://agentprime.io/advisories/CVE-2026-14699.md)
  `CVE-2026-14699` · CVE record: zcaceres markdownify-mcp · CVSS 4.8 Medium · Not analysed yet · Published 5 Jul 2026 · Tags: Path traversal, CWE-61
- [Snowflake CLI Arbitrary Local File Read and Exfiltration Through Improper File Path Restriction](https://agentprime.io/advisories/CVE-2026-13748.md)
  `CVE-2026-13748` · CVE record: Snowflake Snowflake CLI · CVSS 6.3 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Path traversal, CWE-61
- [Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit](https://agentprime.io/advisories/GHSA-ccv6-r384-xp75.md)
  `GHSA-ccv6-r384-xp75`, `CVE-2026-55447`, `PYSEC-2026-378` · PyPI `langflow`: affected `<1.9.2`, fixed in `1.9.2` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Information disclosure, CWE-61
- [Cargo crates in third party registries can override the cached source of other crates](https://agentprime.io/advisories/GHSA-jq42-7mfv-hm57.md)
  `GHSA-jq42-7mfv-hm57`, `CVE-2026-5223` · crates.io `cargo`: affected `<0.97.0`, fixed in `0.97.0` · CVSS 6.5 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-61
- [extract-zip unvalidated symlink path traversal](https://agentprime.io/advisories/GHSA-jmr9-qjv8-65gv.md)
  `GHSA-jmr9-qjv8-65gv`, `CVE-2026-56876` · npm `extract-zip`: affected `<=2.0.1`, no fixed version yet · CVSS 8.6 High · Not analysed yet · Published 26 Jun 2026 · Tags: Path traversal, CWE-61
- [KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite](https://agentprime.io/advisories/GHSA-q3jc-42cq-33fj.md)
  `GHSA-q3jc-42cq-33fj`, `CVE-2026-13218`, `GO-2026-6914` · Go `kubevirt.io/kubevirt`: affected `<=1.10.0-rc.0`, no fixed version yet · CVSS 4.2 Medium · Not analysed yet · Published 26 Jun 2026 · Tags: CWE-61
- [Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption](https://agentprime.io/advisories/CVE-2026-13201.md)
  `CVE-2026-13201` · CVE record: Red Hat Red Hat Container Native Virtualization 4.12 and 4 more · CVSS 7.3 High · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-61
- [OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree](https://agentprime.io/advisories/GHSA-wcmj-x466-56mm.md)
  `GHSA-wcmj-x466-56mm`, `CVE-2026-74796`, `GO-2026-5705` · Go `github.com/opentofu/opentofu`: affected `<1.10.10 || >=1.11.0, <1.11.7`, fixed in `1.10.10`, `1.11.7` · CVSS 7.0 High · Not analysed yet · Published 23 Jun 2026 · Tags: Path traversal, CWE-61
- [Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym](https://agentprime.io/advisories/GHSA-89mr-xqfv-758m.md)
  `GHSA-89mr-xqfv-758m`, `CVE-2026-52811`, `GO-2026-5249` · Go `gogs.io/gogs`: affected `<0.14.3`, fixed in `0.14.3` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jun 2026 · Tags: Path traversal, CWE-61
- [rasta-mouse pwnlift: pwnlift before d7a9544, in a privileged deployment…](https://agentprime.io/advisories/CVE-2026-56815.md)
  `CVE-2026-56815` · CVE record: rasta-mouse pwnlift · CVSS 7.4 High · Not analysed yet · Published 23 Jun 2026 · Tags: CWE-61
- [runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations](https://agentprime.io/advisories/GHSA-xjvp-4fhw-gc47.md)
  `GHSA-xjvp-4fhw-gc47`, `CVE-2026-41579`, `GO-2026-5761` · Go `github.com/opencontainers/runc`: affected `<1.3.6 || >=1.4.0, <1.4.3 || >=1.5.0-rc.1, <1.5.0-rc.3`, fixed in `1.3.6`, `1.4.3`, `1.5.0-rc.3` · CVSS 3.3 Low · Not analysed yet · Published 22 Jun 2026 · Tags: CWE-61
- [ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer](https://agentprime.io/advisories/GHSA-wvrh-2f4m-924v.md)
  `GHSA-wvrh-2f4m-924v`, `CVE-2026-58198` · PyPI `chatterbot`: affected `<1.2.14`, fixed in `1.2.14` · CVSS 5.5 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Path traversal, Race condition, CWE-61

Older: <https://agentprime.io/advisories/tag/cwe-61.md?cursor=WyIyMDI2LTA2LTE5VDIyOjA4OjA4LjAwMDAwMFoiLCJHSFNBLXd2cmgtMmY0bS05MjR2Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-61>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-61/>. Everything for agents: <https://agentprime.io/llms.txt>.