# CWE-749.

Every Advisory and CVE whose sources give the weakness CWE-749, newest first.

## Records, newest first

- [FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands](https://agentprime.io/advisories/CVE-2026-116779.md)
  `CVE-2026-116779` · CVE record: signalwire freeswitch · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Command injection, CWE-749
- [SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution](https://agentprime.io/advisories/CVE-2026-92704.md)
  `CVE-2026-92704` · CVE record: sharpemu sharpemu · CVSS 8.3 High · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass, Cross-site request forgery (CSRF), CWE-346, CWE-350
- [Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile application](https://agentprime.io/advisories/CVE-2026-121145.md)
  `CVE-2026-121145` · CVE record: Tata Motors Tata Motors iRA 2.0 and 1 more · CVSS 7.1 High · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-346, CWE-749
- [Elo backends have code injection via unvalidated emission of programmatic AST fields](https://agentprime.io/advisories/GHSA-x9rp-7wh3-2rj5.md)
  `GHSA-x9rp-7wh3-2rj5`, `CVE-2026-44265` · npm `@enspirit/elo`: affected `<1.0.1`, fixed in `1.0.1` · CVSS 7.4 High · Not analysed yet · Published 3 Nov 2026 · Tags: SQL injection, Code injection, CWE-20, CWE-749
- [Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host](https://agentprime.io/advisories/CVE-2026-120091.md)
  `CVE-2026-120091` · CVE record: Temporal Technologies, Inc. Temporal Server · CVSS 8.7 High · Not analysed yet · Published 2 Nov 2026 · Tags: Command injection, Broken access control, CWE-749, CWE-1188
- [Unrestricted Command Execution via system.execute](https://agentprime.io/advisories/CVE-2026-66088.md)
  `CVE-2026-66088` · CVE record: Apereo Foundation openEQUELLA · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Command injection, CWE-749
- [Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-118606.md)
  `CVE-2026-118606` · CVE record: Alpine iLX-F511 · CVSS 8.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-749
- [Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2026-118602.md)
  `CVE-2026-118602` · CVE record: Alpine iLX-F511 · CVSS 7.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-749
- [Dynamic Library Loading Process Control in Autodesk Fusion Desktop](https://agentprime.io/advisories/CVE-2026-113775.md)
  `CVE-2026-113775` · CVE record: Autodesk Fusion · CVSS 7.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-749
- [Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives](https://agentprime.io/advisories/CVE-2026-116019.md)
  `CVE-2026-116019` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 24 Oct 2026 · Tags: CWE-749
- [Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites](https://agentprime.io/advisories/GHSA-f2ph-cmg5-wxc8.md)
  `GHSA-f2ph-cmg5-wxc8`, `CVE-2026-114125` · npm `storybook` and 5 more: affected `>=8.0.0, <8.6.19 || >=9.0.0, <9.1.21 || >=10.0.0, <10.6.2 || >=11.0.0-alpha.0, <11.0.0-alpha.6`, fixed in `8.6.19`, `9.1.21`, `10.6.2`, `11.0.0-alpha.6` · CVSS 8.6 High · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal, Code injection, Broken access control, CWE-346
- [Cisco Unified Communications Manager Improper Access Control Vulnerability](https://agentprime.io/advisories/CVE-2026-76487.md)
  `CVE-2026-76487` · CVE record: Cisco Cisco Unified Communications Manager · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-749
- [OnePlus OxygenOS exposed dangerous method vulnerability](https://agentprime.io/advisories/CVE-2026-70387.md)
  `CVE-2026-70387` · CVE record: OnePlus OxygenOS · CVSS 8.4 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control, CWE-749
- [Aix-DB 1.2.4 Authenticated RCE via ChatBI Common Agent Execute Tool](https://agentprime.io/advisories/CVE-2026-77926.md)
  `CVE-2026-77926` · CVE record: apconw Aix-DB · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-749
- [Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@](https://agentprime.io/advisories/CVE-2026-112780.md)
  `CVE-2026-112780` · CVE record: getgrav grav · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-749
- [Markdown Preview Enhanced: Blind Command Dispatch via Unvalidated Webview Message Handler](https://agentprime.io/advisories/CVE-2026-54702.md)
  `CVE-2026-54702` · CVE record: shd101wyy vscode-markdown-preview-enhanced · CVSS 7.3 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-749
- [Ivanti Neurons Patch for Intune: An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote…](https://agentprime.io/advisories/CVE-2026-109412.md)
  `CVE-2026-109412` · CVE record: Ivanti Neurons Patch for Intune · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-749
- [Broken Access Control in SAP NetWeaver Visual Composer](https://agentprime.io/advisories/CVE-2026-89110.md)
  `CVE-2026-89110` · CVE record: SAP_SE SAP NetWeaver Visual Composer · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-749
- [EdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPC](https://agentprime.io/advisories/CVE-2026-109556.md)
  `CVE-2026-109556` · CVE record: tianma-if EdgeEver · CVSS 7.3 High · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-749
- [NetEase Cloud Music RCE via os.navigateExternal IPC](https://agentprime.io/advisories/CVE-2026-109422.md)
  `CVE-2026-109422` · CVE record: NetEase NetEase Cloud Music for Windows · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-749
- [Smart Media4U Technology SHAREit App WebView JS Bridge syncInvoke routine](https://agentprime.io/advisories/CVE-2026-108897.md)
  `CVE-2026-108897` · CVE record: Smart Media4U Technology SHAREit App · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: CWE-749
- [Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium](https://agentprime.io/advisories/GHSA-9gvv-qjj3-2p6g.md)
  `GHSA-9gvv-qjj3-2p6g`, `CVE-2026-119978`, `CVE-2026-73483` · npm `flowise` and 1 more: affected `<3.1.3`, fixed in `3.1.3` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Command injection, CWE-749
- [MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change](https://agentprime.io/advisories/CVE-2026-106513.md)
  `CVE-2026-106513` · CVE record: MISP MISP · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control, CWE-749
- [Payload: Insufficient Access Control in Stripe REST Proxy](https://agentprime.io/advisories/GHSA-r9v2-gg2j-22q5.md)
  `GHSA-r9v2-gg2j-22q5`, `CVE-2026-105848` · npm `@payloadcms/plugin-stripe`: affected `<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 6.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control, CWE-749
- [Joyland AI WebView command injection](https://agentprime.io/advisories/CVE-2026-102667.md)
  `CVE-2026-102667` · CVE record: Joyland Joyland.ai · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-749
- [Flowring Agentflow 4.0 - Exposed Dangerous Method or Function](https://agentprime.io/advisories/CVE-2026-96430.md)
  `CVE-2026-96430` · CVE record: Flowring Technology Corp Agentflow 4.0 · CVSS 8.7 High · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-749
- [Exposure of Privileged IPC Functionality in Progress Telerik Fiddler Everywhere](https://agentprime.io/advisories/CVE-2026-86157.md)
  `CVE-2026-86157` · CVE record: Progress Software Progress® Telerik® Fiddler® Everywhere · CVSS 5.6 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-749
- [Exposed function in Qualcomm Package Manager and Qualcomm Software Center.](https://agentprime.io/advisories/CVE-2026-25255.md)
  `CVE-2026-25255` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-749
- [MaxKB: Prompt-injectable agent can lead to command execution](https://agentprime.io/advisories/CVE-2026-77521.md)
  `CVE-2026-77521` · CVE record: 1Panel-dev MaxKB · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Command injection, Privilege escalation, CWE-749
- [Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host](https://agentprime.io/advisories/CVE-2026-89139.md)
  `CVE-2026-89139` · CVE record: Temporal Technologies, Inc. Temporal Server · CVSS 8.7 High · Not analysed yet · Published 21 Sept 2026 · Tags: Command injection, CWE-749, CWE-1188
- [Acode: Exported TerminalService (bundled terminal plugin) lets any installed app execute arbitrary shell commands as Acode](https://agentprime.io/advisories/CVE-2026-68928.md)
  `CVE-2026-68928` · CVE record: Acode-Foundation Acode · CVSS 8.6 High · Not analysed yet · Published 18 Sept 2026 · Tags: Broken access control, CWE-749, CWE-926
- [Unsoundness in UTF-8 'String' trait](https://agentprime.io/advisories/GHSA-8mq4-3mwq-qvg6.md)
  `GHSA-8mq4-3mwq-qvg6`, `CVE-2026-92612`, `RUSTSEC-2026-0294` · crates.io `iceoryx2-bb-container`: affected `>=0.0.0-0, <0.10.0 || >=0.11.0-0`, fixed in `0.10.0` · CVSS 1.0 Low · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-749
- [Nuxt OG Image has unauthenticated SSRF via \`fonts\[\].path\` URL parameter](https://agentprime.io/advisories/GHSA-q8hw-4fvp-9rwv.md)
  `GHSA-q8hw-4fvp-9rwv`, `CVE-2026-61793` · npm `nuxt-og-image`: affected `>=6.0.2, <6.7.0`, fixed in `6.7.0` · CVSS 6.9 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-20, CWE-441, CWE-749
- [Cisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-20293.md)
  `CVE-2026-20293` · CVE record: Cisco Cisco Enterprise NFV Infrastructure Software and 3 more · CVSS 7.1 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-749
- [electerm before 5.3.15 Arbitrary Command Execution via Unvalidated runGlobalAsync IPC Bridge](https://agentprime.io/advisories/CVE-2026-86711.md)
  `CVE-2026-86711` · CVE record: electerm electerm · CVSS 7.5 High · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-749
- [ASUS Armoury Crate: Exposed Dangerous Method or Function in ASUS Armoury Crate allow a local user to cause a…](https://agentprime.io/advisories/CVE-2026-75810.md)
  `CVE-2026-75810` · CVE record: ASUS Armoury Crate · CVSS 5.7 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-749
- [asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter](https://agentprime.io/advisories/GHSA-9w56-46f6-3qhx.md)
  `GHSA-9w56-46f6-3qhx`, `CVE-2026-102734` · PyPI `asteval`: affected `<1.0.9`, fixed in `1.0.9` · CVSS 5.5 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-693, CWE-749, CWE-913
- [Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2026-18263.md)
  `CVE-2026-18263` · CVE record: Parallels RAS Client · CVSS 7.8 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-749
- [Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2026-18262.md)
  `CVE-2026-18262` · CVE record: Parallels RAS Client · CVSS 7.8 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-749
- [Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2026-13121.md)
  `CVE-2026-13121` · CVE record: Parallels RAS Client · CVSS 7.8 High · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-749
- [GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates](https://agentprime.io/advisories/GHSA-wf6j-gr27-g7ch.md)
  `GHSA-wf6j-gr27-g7ch`, `CVE-2024-45747` · Maven `org.geoserver:gs-main` and 2 more: affected `<2.27.0`, fixed in `2.27.0` · CVSS 7.2 High · Not analysed yet · Published 19 Aug 2026 · Tags: CWE-749
- [Streambert : Insecure Protocol Execution in open-external IPC Handler](https://agentprime.io/advisories/CVE-2026-52877.md)
  `CVE-2026-52877` · CVE record: truelockmc streambert · CVSS 8.3 High · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-20, CWE-749
- [Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication](https://agentprime.io/advisories/CVE-2026-66781.md)
  `CVE-2026-66781` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.11 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 18 Aug 2026 · Tags: CWE-749
- [Streambert Vulnerable to Arbitrary Binary Execution via Downloader IPC Handler](https://agentprime.io/advisories/CVE-2026-48056.md)
  `CVE-2026-48056` · CVE record: truelockmc streambert · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-20, CWE-749
- [Azure Confidential Ledger Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-68823.md)
  `CVE-2026-68823` · CVE record: Microsoft Azure Confidential Ledger · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-749
- [H3C NX15 Web API esps service.add routine](https://agentprime.io/advisories/CVE-2026-18901.md)
  `CVE-2026-18901` · CVE record: H3C NX15 · CVSS 8.6 High · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-749
- [In apusys, there is a possible escalation of privilege due to a missing bounds check.](https://agentprime.io/advisories/CVE-2026-20467.md)
  `CVE-2026-20467` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 6.0 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: CWE-749
- [\`nx graph\` dev server permissive CORS policy](https://agentprime.io/advisories/GHSA-g2r8-wvmj-jf5w.md)
  `GHSA-g2r8-wvmj-jf5w`, `CVE-2026-54753` · npm `nx`: affected `>=17.0.4, <22.7.2 || >=23.0.0-beta.0, <23.0.0-beta.2`, fixed in `22.7.2`, `23.0.0-beta.2` · CVSS 5.9 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-749, CWE-942
- [Exposed Reboot via Modbus](https://agentprime.io/advisories/CVE-2026-44107.md)
  `CVE-2026-44107` · CVE record: Phoenix Contact CHARX SEC-3150 and 3 more · CVSS 8.7 High · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-749
- [webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints](https://agentprime.io/advisories/GHSA-f5vj-f2hx-8m93.md)
  `GHSA-f5vj-f2hx-8m93`, `CVE-2026-14620` · npm `webpack-dev-server`: affected `<5.2.6`, fixed in `5.2.6` · CVSS 4.7 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Cross-site request forgery (CSRF), CWE-749
- [ownCloud Core: Updater has an exposed dangerous method or function](https://agentprime.io/advisories/CVE-2025-53827.md)
  `CVE-2025-53827` · CVE record: owncloud ownCloud Core · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-749
- [Microsoft Edge (Chromium-based) Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-45489.md)
  `CVE-2026-45489` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 6.5 Medium · Not analysed yet · Published 3 Jul 2026 · Tags: Authentication bypass, CWE-749
- [Appsmith: Caddy admin API exposed without authentication](https://agentprime.io/advisories/CVE-2026-55454.md)
  `CVE-2026-55454` · CVE record: appsmithorg appsmith · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-749, CWE-1188
- [@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)](https://agentprime.io/advisories/GHSA-x6qj-4h56-5rj5.md)
  `GHSA-x6qj-4h56-5rj5`, `CVE-2026-49993` · npm `@nuxt/rspack-builder` and 1 more: affected `>=3.15.4, <3.21.7 || >=4.0.0, <4.4.7`, fixed in `3.21.7`, `4.4.7` · CVSS 5.9 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-749
- [Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription](https://agentprime.io/advisories/CVE-2026-48783.md)
  `CVE-2026-48783` · CVE record: gitroomhq postiz-app · CVSS 4.8 Medium · Not analysed yet · Published 16 Jun 2026 · Tags: Broken access control, CWE-345, CWE-749
- [Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE](https://agentprime.io/advisories/GHSA-g8mr-85jm-7xhm.md)
  `GHSA-g8mr-85jm-7xhm`, `CVE-2026-53633` · npm `vite-plus` and 1 more: affected `<0.1.24`, fixed in `0.1.24` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jun 2026 · Tags: Broken access control, CWE-749
- [Hepta Platforms｜Heptabase - Exposed Dangerous](https://agentprime.io/advisories/CVE-2026-12060.md)
  `CVE-2026-12060` · CVE record: Hepta Platforms Heptabase · CVSS 6.9 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: CWE-749
- [Lenovo Application: A vulnerability was identified in the Lenovo Android Application…](https://agentprime.io/advisories/CVE-2026-7516.md)
  `CVE-2026-7516` · CVE record: Lenovo Application · CVSS 5.1 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: CWE-749
- [Arbitrary File Read, Write, Rename, and Delete in Logseq](https://agentprime.io/advisories/CVE-2026-47899.md)
  `CVE-2026-47899` · CVE record: logseq logseq · CVSS 8.7 High · Not analysed yet · Published 9 Jun 2026 · Tags: CWE-749
- [OpenStack Mistral allows Arbitrary Remote Code Execution when the API is exposed](https://agentprime.io/advisories/GHSA-9hfw-w3f4-c4p8.md)
  `GHSA-9hfw-w3f4-c4p8`, `CVE-2026-41283`, `PYSEC-2026-3486` · PyPI `mistral`: affected `>=20.0.0, <20.1.1`, fixed in `20.1.1` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Jun 2026 · Tags: Broken access control, CWE-749

Older: <https://agentprime.io/advisories/tag/cwe-749.md?cursor=WyIyMDI2LTA2LTA0VDA2OjMwOjI1LjAwMDAwMFoiLCJHSFNBLTloZnctdzNmNC1jNHA4Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-749>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-749/>. Everything for agents: <https://agentprime.io/llms.txt>.