# CWE-829.

Every Advisory and CVE whose sources give the weakness CWE-829, newest first.

## Records, newest first (an older page)

- [Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-1342.md)
  `CVE-2026-1342` · CVE record: IBM Verify Identity Access Container and 3 more · CVSS 8.5 High · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-829
- [OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup](https://agentprime.io/advisories/GHSA-2qrv-rc5x-2g2h.md)
  `GHSA-2qrv-rc5x-2g2h`, `CVE-2026-41295` · npm `openclaw`: affected `<2026.4.2`, fixed in `2026.4.2` · CVSS 8.5 High · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-829
- [OpenClaw: OpenShell \`mirror\` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup](https://agentprime.io/advisories/GHSA-42mx-vp8m-j7qh.md)
  `GHSA-42mx-vp8m-j7qh`, `CVE-2026-41355` · npm `openclaw`: affected `<2026.3.28`, fixed in `2026.3.28` · CVSS 5.4 Medium · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-829
- [omd: Local privilege escalation when executing omd commands as root](https://agentprime.io/advisories/CVE-2025-39666.md)
  `CVE-2025-39666` · CVE record: Checkmk GmbH Checkmk · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Apr 2026 · Tags: CWE-426, CWE-829
- [OpenClaw: Workspace \`.env\` can override the bundled plugin trust root](https://agentprime.io/advisories/GHSA-qcj9-wwgw-6gm8.md)
  `GHSA-qcj9-wwgw-6gm8`, `CVE-2026-41396` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 8.5 High · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-15, CWE-829
- [OpenClaw: Workspace \`.env\` can override the bundled hooks root and load attacker hook code](https://agentprime.io/advisories/GHSA-3qpv-xf3v-mm45.md)
  `GHSA-3qpv-xf3v-mm45`, `CVE-2026-41336` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 8.5 High · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-15, CWE-829
- [FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout](https://agentprime.io/advisories/CVE-2026-34442.md)
  `CVE-2026-34442` · CVE record: freescout-help-desk freescout · CVSS 5.4 Medium · Not analysed yet · Published 31 Mar 2026 · Tags: Open redirect, CWE-20, CWE-829
- [Duplicate Advisory: OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories](https://agentprime.io/advisories/GHSA-j5qh-5234-4rqp.md)
  `GHSA-j5qh-5234-4rqp` · npm `openclaw`: affected `<2026.3.12`, fixed in `2026.3.12` · CVSS 9.8 Critical · Withdrawn · Not analysed yet · Published 31 Mar 2026 · Tags: CWE-829
- [Elevation of Privileges in Symantec Data Loss Prevention Windows Endpoint](https://agentprime.io/advisories/CVE-2026-3991.md)
  `CVE-2026-3991` · CVE record: Broadcom Data Loss Prevention · CVSS 7.8 High · Not analysed yet · Published 30 Mar 2026 · Tags: CWE-829
- [Wazuh Provisioning Scripts / Build Infrastructure Improper Certificate Validation leading to MITM and RCE](https://agentprime.io/advisories/CVE-2025-15612.md)
  `CVE-2025-15612` · CVE record: Wazuh Wazuh Provisioning Scripts (Agent Build Environment) · CVSS 6.3 Medium · Not analysed yet · Published 27 Mar 2026 · Tags: Weak cryptography or TLS, CWE-829
- [HCL Aftermarket DPC is affected by Cross Domain Script Include vulnerability](https://agentprime.io/advisories/CVE-2025-55273.md)
  `CVE-2025-55273` · CVE record: HCL Aftermarket DPC · CVSS 4.3 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-829
- [FastGPT has Arbitrary Code Execution in GitHub Actions via pull_request_target in fastgpt-preview-image.yml](https://agentprime.io/advisories/CVE-2026-33075.md)
  `CVE-2026-33075` · CVE record: labring FastGPT · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2026 · Tags: CWE-494, CWE-829
- [Arbitrary code execution via crafted project files in Kiro IDE](https://agentprime.io/advisories/CVE-2026-4295.md)
  `CVE-2026-4295` · CVE record: AWS Kiro IDE · CVSS 8.5 High · Not analysed yet · Published 17 Mar 2026 · Tags: CWE-829
- [ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack](https://agentprime.io/advisories/GHSA-hqmj-h5c6-369m.md)
  `GHSA-hqmj-h5c6-369m`, `CVE-2026-28500`, `PYSEC-2026-103` · PyPI `onnx`: affected `<1.21.0rc1`, fixed in `1.21.0rc1` · CVSS 8.6 High · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-345, CWE-494, CWE-693, CWE-829
- [DLL Injection Privilege Escalation](https://agentprime.io/advisories/CVE-2026-4255.md)
  `CVE-2026-4255` · CVE record: thermalright TR-VISION HOME · CVSS 8.4 High · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-829
- [OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories](https://agentprime.io/advisories/GHSA-99qw-6mr3-36qr.md)
  `GHSA-99qw-6mr3-36qr`, `CVE-2026-32920` · npm `openclaw`: affected `<2026.3.12`, fixed in `2026.3.12` · CVSS 8.6 High · Not analysed yet · Published 13 Mar 2026 · Tags: CWE-829
- [An issue pertaining to CWE-829: Inclusion of Functionality from Untrusted Control Sphere was discovered in Miazzy oa-front-service master.](https://agentprime.io/advisories/CVE-2025-70046.md)
  `CVE-2025-70046` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Mar 2026 · Tags: CWE-829
- [WordPress Royal Elementor Addons plugin <= 1.7.1052 - Other vulnerability Type vulnerability](https://agentprime.io/advisories/CVE-2026-28135.md)
  `CVE-2026-28135` · CVE record: WP Royal Royal Elementor Addons · CVSS 8.2 High · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-829
- [OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL](https://agentprime.io/advisories/GHSA-p4wh-cr8m-gm6c.md)
  `GHSA-p4wh-cr8m-gm6c`, `CVE-2026-22217` · npm `openclaw`: affected `>=2026.2.22, <2026.2.23`, fixed in `2026.2.23` · CVSS 5.8 Medium · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-184, CWE-829
- [OpenClaw: safeBins static default trusted dirs allow writable-dir binary hijack (\`jq\`)](https://agentprime.io/advisories/GHSA-5gj7-jf77-q2q2.md)
  `GHSA-5gj7-jf77-q2q2`, `CVE-2026-32009` · npm `openclaw`: affected `<2026.2.24`, fixed in `2026.2.24` · CVSS 7.0 High · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-426, CWE-428, CWE-829
- [Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites.](https://agentprime.io/advisories/CVE-2026-1628.md)
  `CVE-2026-1628` · CVE record: Mattermost Mattermost · CVSS 4.6 Medium · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-829
- [CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage](https://agentprime.io/advisories/GHSA-jfrq-hj9f-c8qx.md)
  `GHSA-jfrq-hj9f-c8qx`, `CVE-2026-26862` · npm `clevertap-web-sdk`: affected `<1.15.3`, fixed in `1.15.3` · CVSS 8.3 High · Not analysed yet · Published 27 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-829
- [GNU inetutils: telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by…](https://agentprime.io/advisories/CVE-2026-28372.md)
  `CVE-2026-28372` · CVE record: GNU inetutils · CVSS 7.4 High · Not analysed yet · Published 27 Feb 2026 · Tags: CWE-829
- [OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the \`pull_request_target\` event while checking ou...](https://agentprime.io/advisories/GHSA-9jgv-x8cq-296q.md)
  `GHSA-9jgv-x8cq-296q`, `CVE-2026-27941`, `PYSEC-2026-2246` · PyPI `openlit`: affected `>=1.36.2, <1.37.1`, fixed in `1.37.1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Feb 2026 · Tags: CWE-829
- [ADB-Explorer: UNC Path Support in ManualAdbPath Leads to Remote Code Execution (RCE)](https://agentprime.io/advisories/CVE-2026-27615.md)
  `CVE-2026-27615` · CVE record: Alex4SSB ADB-Explorer · CVSS 8.8 High · Not analysed yet · Published 25 Feb 2026 · Tags: CWE-40, CWE-829
- [ADB Explorer Vulnerable to RCE via Insufficient Input Validation](https://agentprime.io/advisories/CVE-2026-26959.md)
  `CVE-2026-26959` · CVE record: Alex4SSB ADB-Explorer · CVSS 7.8 High · Not analysed yet · Published 19 Feb 2026 · Tags: CWE-829
- [Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde](https://agentprime.io/advisories/GHSA-w7h5-55jg-cq2f.md)
  `GHSA-w7h5-55jg-cq2f`, `CVE-2026-26974` · npm `@tygo-van-den-hurk/slyde`: affected `<0.0.5`, fixed in `0.0.5` · CVSS 7.6 High · Not analysed yet · Published 18 Feb 2026 · Tags: CWE-829
- [OpenS100 Portrayal Engine Unrestricted Lua Standard Library Access](https://agentprime.io/advisories/CVE-2026-22208.md)
  `CVE-2026-22208` · CVE record: OpenS100 Project OpenS100 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Feb 2026 · Tags: CWE-749, CWE-829
- [Roundcube Webmail: Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS)…](https://agentprime.io/advisories/CVE-2026-26079.md)
  `CVE-2026-26079` · CVE record: Roundcube Webmail · CVSS 4.7 Medium · Not analysed yet · Published 11 Feb 2026 · Tags: CWE-829
- [vscode-spell-checker has a workspace-trust bypass Code Execution](https://agentprime.io/advisories/CVE-2026-25931.md)
  `CVE-2026-25931` · CVE record: streetsidesoftware vscode-spell-checker · CVSS 7.8 High · Not analysed yet · Published 9 Feb 2026 · Tags: Broken access control, CWE-807, CWE-829
- [In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while checking out and executing untrusted pull request code.](https://agentprime.io/advisories/CVE-2026-1699.md)
  `CVE-2026-1699` · CVE record: Eclipse Foundation Eclipse Theia - Website · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Jan 2026 · Tags: CWE-829
- [Langflow affected by Remote Code Execution via validate_code() exec()](https://agentprime.io/advisories/GHSA-g22f-v6f7-2hrh.md)
  `GHSA-g22f-v6f7-2hrh`, `CVE-2026-0770`, `PYSEC-2026-1525` · PyPI `langflow`: affected `<=1.7.3`, no fixed version yet · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.63 · Not analysed yet · Published 23 Jan 2026 · Tags: CWE-829
- [Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts](https://agentprime.io/advisories/CVE-2026-22865.md)
  `CVE-2026-22865` · CVE record: gradle gradle · CVSS 8.6 High · Not analysed yet · Published 16 Jan 2026 · Tags: CWE-494, CWE-829
- [Gradle fails to disable repositories which can expose builds to malicious artifacts](https://agentprime.io/advisories/CVE-2026-22816.md)
  `CVE-2026-22816` · CVE record: gradle gradle · CVSS 8.6 High · Not analysed yet · Published 16 Jan 2026 · Tags: CWE-494, CWE-829
- [UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation](https://agentprime.io/advisories/GHSA-vrgw-pc9c-qrrc.md)
  `GHSA-vrgw-pc9c-qrrc`, `CVE-2025-68924` · NuGet `UmbracoForms`: affected `<=8.13.16`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 13 Jan 2026 · Tags: Code injection, Insecure deserialization, Broken access control, CWE-829
- [FASTJSON Includes Functionality from Untrusted Control Sphere](https://agentprime.io/advisories/GHSA-jm7w-5684-pvh8.md)
  `GHSA-jm7w-5684-pvh8`, `CVE-2025-70974` · Maven `com.alibaba:fastjson`: affected `<1.2.48`, fixed in `1.2.48` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jan 2026 · Tags: CWE-829
- [Sony BRAVIA Digital Signage 1.7.8 Unauthenticated Remote File Inclusion](https://agentprime.io/advisories/CVE-2020-36924.md)
  `CVE-2020-36924` · CVE record: Pro-Bravia Sony BRAVIA Digital Signage · CVSS 5.3 Medium · Not analysed yet · Published 6 Jan 2026 · Tags: CWE-829
- [FIBARO System Home Center 5.021 Remote File Inclusion via Proxy API](https://agentprime.io/advisories/CVE-2020-36905.md)
  `CVE-2020-36905` · CVE record: FIBAR GROUP S.A. Home Center 3 and 2 more · CVSS 5.1 Medium · Not analysed yet · Published 6 Jan 2026 · Tags: CWE-829
- [theshit vulnerable to unsafe loading of user-owned Python rules when running as root](https://agentprime.io/advisories/GHSA-95qg-89c2-w5hj.md)
  `GHSA-95qg-89c2-w5hj`, `CVE-2025-69257`, `RUSTSEC-2025-0139` · crates.io `theshit`: affected `>=0.0.0-0, <0.1.1`, fixed in `0.1.1` · CVSS 6.7 Medium · Not analysed yet · Published 30 Dec 2025 · Tags: Privilege escalation, Broken access control, CWE-829
- [Mintlify Platform: The Static Asset API in Mintlify Platform before 2025-11-15 allows remote attackers to…](https://agentprime.io/advisories/CVE-2025-67842.md)
  `CVE-2025-67842` · CVE record: Mintlify Mintlify Platform · CVSS 6.4 Medium · Not analysed yet · Published 19 Dec 2025 · Tags: CWE-829
- [JetBrains TeamCity: In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via…](https://agentprime.io/advisories/CVE-2025-68162.md)
  `CVE-2025-68162` · CVE record: JetBrains TeamCity · CVSS 2.7 Low · Not analysed yet · Published 16 Dec 2025 · Tags: CWE-829
- [NXLog Agent before 6.11 can load a file specified by the OPENSSL_CONF environment variable.](https://agentprime.io/advisories/CVE-2025-67900.md)
  `CVE-2025-67900` · CVE record: NXLog NXLog Agent · CVSS 8.1 High · Not analysed yet · Published 14 Dec 2025 · Tags: CWE-829
- [n8n vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook](https://agentprime.io/advisories/GHSA-wpqc-h9wp-chmq.md)
  `GHSA-wpqc-h9wp-chmq`, `CVE-2025-65964` · npm `n8n`: affected `>=0.123.1, <1.119.2`, fixed in `1.119.2` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-829
- [Akamai Guardicore Platform Agent: The GC-AGENTS-SERVICE running as part of Akamai´s Guardicore Platform Agent for Windows…](https://agentprime.io/advisories/CVE-2025-53841.md)
  `CVE-2025-53841` · CVE record: Akamai Guardicore Platform Agent · CVSS 7.8 High · Not analysed yet · Published 3 Dec 2025 · Tags: CWE-829
- [FACTION Unauthenticated Custom Extension Upload leads to RCE](https://agentprime.io/advisories/CVE-2025-66022.md)
  `CVE-2025-66022` · CVE record: factionsecurity faction · CVSS 9.7 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Nov 2025 · Tags: Authentication bypass, CWE-829
- [NVIDIA NeMo Framework: NVIDIA NeMo framework contains a vulnerability in a predefined variable…](https://agentprime.io/advisories/CVE-2025-33205.md)
  `CVE-2025-33205` · CVE record: NVIDIA NeMo Framework · CVSS 7.3 High · Not analysed yet · Published 25 Nov 2025 · Tags: CWE-829
- [A vulnerability has been identified in Spectrum Power 4 (All versions < V4.70 SP12 Update 2).](https://agentprime.io/advisories/CVE-2024-32011.md)
  `CVE-2024-32011` · CVE record: Siemens Spectrum Power 4 · CVSS 8.7 High · Not analysed yet · Published 11 Nov 2025 · Tags: CWE-829
- [Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events](https://agentprime.io/advisories/GHSA-cm35-v4vp-5xvx.md)
  `GHSA-cm35-v4vp-5xvx`, `CVE-2025-64496`, `PYSEC-2026-1729` · npm `open-webui` and 1 more: affected `<0.6.35`, fixed in `0.6.35` · CVSS 7.3 High · Not analysed yet · Published 7 Nov 2025 · Tags: Code injection, CWE-501, CWE-829, CWE-830
- [Scripts for the module Global_Shipping executable on BRAIN2 Server](https://agentprime.io/advisories/CVE-2025-12509.md)
  `CVE-2025-12509` · CVE record: Bizerba BRAIN2 · CVSS 8.4 High · Not analysed yet · Published 31 Oct 2025 · Tags: CWE-829
- [n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook](https://agentprime.io/advisories/GHSA-xgp7-7qjq-vg47.md)
  `GHSA-xgp7-7qjq-vg47`, `CVE-2025-62726` · npm `n8n`: affected `<1.113.0`, fixed in `1.113.0` · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2025 · Tags: CWE-829
- [Local File Inclusion in ArkSigner's AcBakImzala](https://agentprime.io/advisories/CVE-2025-11023.md)
  `CVE-2025-11023` · CVE record: ArkSigner Software and Hardware Inc. AcBakImzala · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2025 · Tags: File inclusion, CWE-829
- [An arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co.](https://agentprime.io/advisories/CVE-2025-41390.md)
  `CVE-2025-41390` · CVE record: Truffle Security Co. TruffleHog · CVSS 7.8 High · Not analysed yet · Published 20 Oct 2025 · Tags: CWE-829
- [HCL MyXalytics is affected by a Cross-Domain Script Include vulnerability.](https://agentprime.io/advisories/CVE-2025-52655.md)
  `CVE-2025-52655` · CVE record: HCL HCL MyXalytics · CVSS 3.1 Low · Not analysed yet · Published 10 Oct 2025 · Tags: CWE-829
- [Anki: Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute…](https://agentprime.io/advisories/CVE-2025-62186.md)
  `CVE-2025-62186` · CVE record: Ankitects Anki · CVSS 6.7 Medium · Not analysed yet · Published 7 Oct 2025 · Tags: CWE-829
- [IBM Security Verify Access code execution](https://agentprime.io/advisories/CVE-2025-36355.md)
  `CVE-2025-36355` · CVE record: IBM Security Verify Access Appliance and 1 more · CVSS 8.5 High · Not analysed yet · Published 6 Oct 2025 · Tags: CWE-829
- [Cursor CLI: Arbitrary Code Execution Possible through Permissive CLI Config](https://agentprime.io/advisories/CVE-2025-61592.md)
  `CVE-2025-61592` · CVE record: cursor cursor · CVSS 8.8 High · Not analysed yet · Published 3 Oct 2025 · Tags: CWE-829
- [Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions](https://agentprime.io/advisories/GHSA-2jjv-qf24-vfm4.md)
  `GHSA-2jjv-qf24-vfm4`, `CVE-2025-59828` · npm `@anthropic-ai/claude-code`: affected `<1.0.39`, fixed in `1.0.39` · CVSS 7.7 High · Not analysed yet · Published 24 Sept 2025 · Tags: Broken access control, CWE-829
- [DNN allows loading unused themes on anonymous clients through query parameters](https://agentprime.io/advisories/GHSA-wq2j-w9pm-7x2p.md)
  `GHSA-wq2j-w9pm-7x2p`, `CVE-2025-59535` · NuGet `DotNetNuke.Core`: affected `<10.1.0`, fixed in `10.1.0` · CVSS 6.5 Medium · Not analysed yet · Published 22 Sept 2025 · Tags: Information disclosure, CWE-20, CWE-829
- [Electron has ASAR Integrity Bypass via resource modification](https://agentprime.io/advisories/GHSA-vmqv-hx8q-j7mg.md)
  `GHSA-vmqv-hx8q-j7mg`, `CVE-2025-55305` · npm `electron`: affected `<35.7.5 || >=36.0.0-alpha.1, <36.8.1 || >=37.0.0-alpha.1, <37.3.1 || >=38.0.0-alpha.1, <38.0.0-beta.6`, fixed in `35.7.5`, `36.8.1`, `37.3.1`, `38.0.0-beta.6` · CVSS 6.1 Medium · Not analysed yet · Published 3 Sept 2025 · Tags: Code injection, CWE-829
- [JetBrains IntelliJ IDEA: In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to…](https://agentprime.io/advisories/CVE-2025-57729.md)
  `CVE-2025-57729` · CVE record: JetBrains IntelliJ IDEA · CVSS 6.5 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: CWE-829

Newest: <https://agentprime.io/advisories/tag/cwe-829.md>
Older: <https://agentprime.io/advisories/tag/cwe-829.md?cursor=WyIyMDI1LTA4LTIwVDA5OjEzOjU4LjU3OTAwMFoiLCJDVkUtMjAyNS01NzcyOSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-829&cursor=WyIyMDI2LTA0LTEwVDE5OjI2OjQ0LjAwMDAwMFoiLCJHSFNBLTJnM3ctY3BjNC1jaHI0Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-829/?cursor=WyIyMDI2LTA0LTEwVDE5OjI2OjQ0LjAwMDAwMFoiLCJHSFNBLTJnM3ctY3BjNC1jaHI0Il0>. Everything for agents: <https://agentprime.io/llms.txt>.