# Other injection. LDAP, XPath, NoSQL, CRLF, header and log injection. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [code-projects Task Management System AdminLogin.php sql injection](https://agentprime.io/advisories/CVE-2026-19343.md) `CVE-2026-19343` · CVE record: code-projects Task Management System · CVSS 6.9 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Other injection, SQL injection - [NightTrek Ollama-mcp index.ts command injection](https://agentprime.io/advisories/CVE-2026-19334.md) `CVE-2026-19334` · CVE record: NightTrek Ollama-mcp · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Other injection, Command injection - [NightTrek Supabase-MCP generate_types command injection](https://agentprime.io/advisories/CVE-2026-19333.md) `CVE-2026-19333` · CVE record: NightTrek Supabase-MCP · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Other injection, Command injection - [NellyW8 MCP4EDA run_openlane/view_waveform command injection](https://agentprime.io/advisories/CVE-2026-19332.md) `CVE-2026-19332` · CVE record: NellyW8 MCP4EDA · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Other injection, Command injection - [andreahaku codex_mcp ask MCP Tool codex-process-simple.ts command injection](https://agentprime.io/advisories/CVE-2026-19329.md) `CVE-2026-19329` · CVE record: andreahaku codex_mcp · CVSS 4.8 Medium · Not analysed yet · Published 9 Aug 2026 · Tags: Other injection, Command injection - [MauricioMilano coder-api Projects Endpoint projects.ts createProject command injection](https://agentprime.io/advisories/CVE-2026-19284.md) `CVE-2026-19284` · CVE record: MauricioMilano coder-api · CVSS 4.8 Medium · Not analysed yet · Published 8 Aug 2026 · Tags: Other injection, Command injection - [andreahaku llm_memory_mcp GitHooksManager.ts auto.capture command injection](https://agentprime.io/advisories/CVE-2026-19282.md) `CVE-2026-19282` · CVE record: andreahaku llm_memory_mcp · CVSS 4.8 Medium · Not analysed yet · Published 8 Aug 2026 · Tags: Other injection, Command injection - [adolfosalasgomez3011 slidev-builder-mcp generateAssets Tool generateAssets.ts generateChart command injection](https://agentprime.io/advisories/CVE-2026-19281.md) `CVE-2026-19281` · CVE record: adolfosalasgomez3011 slidev-builder-mcp · CVSS 4.8 Medium · Not analysed yet · Published 8 Aug 2026 · Tags: Other injection, Command injection - [MIMICLab mcp-pdf-vision index.ts load_pdf command injection](https://agentprime.io/advisories/CVE-2026-19279.md) `CVE-2026-19279` · CVE record: MIMICLab mcp-pdf-vision · CVSS 4.8 Medium · Not analysed yet · Published 8 Aug 2026 · Tags: Other injection, Command injection - [abdullah1854 MCPGateway Claude Usage Range Endpoint claude-usage.ts getUsageByDateRange command injection](https://agentprime.io/advisories/CVE-2026-19268.md) `CVE-2026-19268` · CVE record: abdullah1854 MCPGateway · CVSS 5.3 Medium · Not analysed yet · Published 8 Aug 2026 · Tags: Other injection, Command injection - [Kirachon context-engine review-git-diff Endpoint gitUtils.ts execGitCommand command injection](https://agentprime.io/advisories/CVE-2026-19266.md) `CVE-2026-19266` · CVE record: Kirachon context-engine · CVSS 5.1 Medium · Not analysed yet · Published 8 Aug 2026 · Tags: Other injection, Command injection - [INQUIRELAB mcp-bridge-api Servers Endpoint mcp-bridge.js command injection](https://agentprime.io/advisories/CVE-2026-19263.md) `CVE-2026-19263` · CVE record: INQUIRELAB mcp-bridge-api · CVSS 6.9 Medium · Not analysed yet · Published 8 Aug 2026 · Tags: Other injection, Command injection - [Kakoune has a Critical RCE via Autorestore Backup Filename Injection](https://agentprime.io/advisories/CVE-2026-48120.md) `CVE-2026-48120` · CVE record: mawww kakoune · CVSS 8.6 High · Not analysed yet · Published 7 Aug 2026 · Tags: Other injection - [SourceCodester Simple Doctors Appointment System ajax.php delete_appointment sql injection](https://agentprime.io/advisories/CVE-2026-19231.md) `CVE-2026-19231` · CVE record: SourceCodester Simple Doctors Appointment System · CVSS 6.9 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Other injection, SQL injection - [SourceCodester Photo Share Website ajax.php signup sql injection](https://agentprime.io/advisories/CVE-2026-19211.md) `CVE-2026-19211` · CVE record: SourceCodester Photo Share Website · CVSS 6.9 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Other injection, SQL injection - [GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)](https://agentprime.io/advisories/GHSA-jm78-9fvv-mhgr.md) `GHSA-jm78-9fvv-mhgr`, `CVE-2026-76221`, `PYSEC-2026-3783` · PyPI `gitpython`: affected `<3.1.58`, fixed in `3.1.58` · CVSS 8.7 High · Not analysed yet · Published 7 Aug 2026 · Tags: Other injection, Command injection - [Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection](https://agentprime.io/advisories/CVE-2026-61477.md) `CVE-2026-61477` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 2.3 Low · Not analysed yet · Published 7 Aug 2026 · Tags: Other injection - [SourceCodester Photo Share Website ajax.php login sql injection](https://agentprime.io/advisories/CVE-2026-19196.md) `CVE-2026-19196` · CVE record: SourceCodester Photo Share Website · CVSS 6.9 Medium · Not analysed yet · Published 7 Aug 2026 · Tags: Other injection, SQL injection - [OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection and no size or rate limits](https://agentprime.io/advisories/CVE-2026-48083.md) `CVE-2026-48083` · CVE record: open-reception appointment-booking-software · CVSS 6.5 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection - [Dgraph: DQL Injection via unvalidated regexp filter argument in GraphQL query rewriter](https://agentprime.io/advisories/CVE-2026-63637.md) `CVE-2026-63637` · CVE record: dgraph-io dgraph · CVSS 8.6 High · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection - [itsourcecode Hospital Management System viewappointment.php sql injection](https://agentprime.io/advisories/CVE-2026-19071.md) `CVE-2026-19071` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Hospital Management System viewadmin.php sql injection](https://agentprime.io/advisories/CVE-2026-19070.md) `CVE-2026-19070` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Hospital Management System treatmentrecord.php sql injection](https://agentprime.io/advisories/CVE-2026-19069.md) `CVE-2026-19069` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Hospital Management System treatmentdetail.php sql injection](https://agentprime.io/advisories/CVE-2026-19068.md) `CVE-2026-19068` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Hospital Management System treatment.php sql injection](https://agentprime.io/advisories/CVE-2026-19067.md) `CVE-2026-19067` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, SQL injection - [chiuwingyan house selectall.action sql injection](https://agentprime.io/advisories/CVE-2026-19062.md) `CVE-2026-19062` · CVE record: chiuwingyan house · CVSS 6.9 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, SQL injection - [Ninja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default](https://agentprime.io/advisories/CVE-2026-15256.md) `CVE-2026-15256` · CVE record: Unknown Ninja Forms · CVSS 4.8 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection - [FoundationAgents MetaGPT code injection](https://agentprime.io/advisories/CVE-2026-19060.md) `CVE-2026-19060` · CVE record: FoundationAgents MetaGPT · CVSS 4.8 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, Code injection - [FoundationAgents MetaGPT data_interpreter.py DataInterpreter code injection](https://agentprime.io/advisories/CVE-2026-19058.md) `CVE-2026-19058` · CVE record: FoundationAgents MetaGPT · CVSS 4.8 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, Code injection - [NocteDefensor LudusMCP ludus_cli_execute cliWrapper.ts executeCommand command injection](https://agentprime.io/advisories/CVE-2026-19047.md) `CVE-2026-19047` · CVE record: NocteDefensor LudusMCP · CVSS 4.8 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, Command injection - [CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input](https://agentprime.io/advisories/GHSA-87v2-pfhj-r5x7.md) `GHSA-87v2-pfhj-r5x7`, `CVE-2026-68747`, `EEF-CVE-2026-68747` · Hex `html_sanitize_ex`: affected `>=0.3.1, <1.4.5 || >=1.5.0-rc.0, <1.5.4`, fixed in `1.4.5`, `1.5.4` · CVSS 2.3 Low · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection - [NocteDefensor LudusMCP get_credential_from_user secretDialog.ts SecretDialog.showSecretDialog command injection](https://agentprime.io/advisories/CVE-2026-19045.md) `CVE-2026-19045` · CVE record: NocteDefensor LudusMCP · CVSS 4.8 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, Command injection - [LeeSinLiang godot-mcp create_scene/add_node index.ts executeOperation command injection](https://agentprime.io/advisories/CVE-2026-19044.md) `CVE-2026-19044` · CVE record: LeeSinLiang godot-mcp · CVSS 4.8 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, Command injection - [MissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage command injection](https://agentprime.io/advisories/CVE-2026-19041.md) `CVE-2026-19041` · CVE record: MissionSquad mcp-api · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, Command injection - [Kino-Kafkaesque ssh-mcp-server SSH index.ts ssh_exec command injection](https://agentprime.io/advisories/CVE-2026-19039.md) `CVE-2026-19039` · CVE record: Kino-Kafkaesque ssh-mcp-server · CVSS 4.8 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, Command injection - [Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header Injection](https://agentprime.io/advisories/CVE-2026-0673.md) `CVE-2026-0673` · CVE record: bdthemes Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection - [OpenHands send_pull_request.py initialize_repo command injection](https://agentprime.io/advisories/CVE-2026-19022.md) `CVE-2026-19022` · CVE record: OpenHands · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, Command injection - [SourceCodester Computer Repair Shop Management System Master.php delete_product sql injection](https://agentprime.io/advisories/CVE-2026-19021.md) `CVE-2026-19021` · CVE record: SourceCodester Computer Repair Shop Management System · CVSS 6.9 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, SQL injection - [itsourcecode Hospital Management System servicetype.php sql injection](https://agentprime.io/advisories/CVE-2026-19020.md) `CVE-2026-19020` · CVE record: itsourcecode Hospital Management System · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, SQL injection - [Header Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log Forgery](https://agentprime.io/advisories/CVE-2026-0637.md) `CVE-2026-0637` · CVE record: WSO2 WSO2 API Manager and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, CWE-20 - [nearai ironclaw shell.rs classify_command_risk command injection](https://agentprime.io/advisories/CVE-2026-18980.md) `CVE-2026-18980` · CVE record: nearai ironclaw · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: Other injection, Command injection - [Rongzhitong Visual Integrated Command and Dispatch Platform findAll sql injection](https://agentprime.io/advisories/CVE-2026-18970.md) `CVE-2026-18970` · CVE record: Rongzhitong Visual Integrated Command and Dispatch Platform · CVSS 6.9 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection, SQL injection - [Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props](https://agentprime.io/advisories/GHSA-9473-5f9j-94wq.md) `GHSA-9473-5f9j-94wq`, `CVE-2026-71320` · npm `nuxt`: affected `>=3.4.0, <3.21.10 || >=4.0.0, <4.5.1`, fixed in `3.21.10`, `4.5.1` · CVSS 8.1 High · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection, Code injection - [rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines](https://agentprime.io/advisories/GHSA-8c48-q9wj-3w37.md) `GHSA-8c48-q9wj-3w37`, `BIT-rclone-2026-71311`, `CVE-2026-71311`, `GO-2026-6187` · Go `github.com/rclone/rclone`: affected `<1.75.0`, fixed in `1.75.0` · CVSS 6.4 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection - [imranrisal-dev Student-Management-System Login loginCheckTest.php sql injection](https://agentprime.io/advisories/CVE-2026-18958.md) `CVE-2026-18958` · CVE record: imranrisal-dev Student-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection, SQL injection - [boringproxy 0.10.0 SSH authorized_keys Injection via Tunnel Creation](https://agentprime.io/advisories/CVE-2026-70615.md) `CVE-2026-70615` · CVE record: boringproxy boringproxy · CVSS 8.5 High · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection - [Cisco IOS XE Software Security Hardening Release](https://agentprime.io/advisories/CVE-2026-20272.md) `CVE-2026-20272` · CVE record: Cisco Cisco IOS XE Software · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection - [Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary](https://agentprime.io/advisories/CVE-2026-16071.md) `CVE-2026-16071` · CVE record: Red Hat Red Hat build of Keycloak 26.4 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection, Privilege escalation - [H3C NX15 esps repeaterproc command injection](https://agentprime.io/advisories/CVE-2026-18902.md) `CVE-2026-18902` · CVE record: H3C NX15 · CVSS 8.6 High · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection, Command injection - [lavkush-maurya Student-Registration-System changepass.php sql injection](https://agentprime.io/advisories/CVE-2026-18896.md) `CVE-2026-18896` · CVE record: lavkush-maurya Student-Registration-System · CVSS 5.3 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection, SQL injection - [ESAFENET CDG usbkey;logindojojs sql injection](https://agentprime.io/advisories/CVE-2026-18859.md) `CVE-2026-18859` · CVE record: ESAFENET CDG · CVSS 6.9 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection, SQL injection - [Shandong Hoteam PDM Product Data Management System DataService GetStoredClassByFilter sql injection](https://agentprime.io/advisories/CVE-2026-18854.md) `CVE-2026-18854` · CVE record: Shandong Hoteam PDM Product Data Management System · CVSS 6.9 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: Other injection, SQL injection - [H3C NX15 esps reload.reload_config command injection](https://agentprime.io/advisories/CVE-2026-18814.md) `CVE-2026-18814` · CVE record: H3C NX15 · CVSS 8.6 High · Not analysed yet · Published 4 Aug 2026 · Tags: Other injection, Command injection - [H3C NX15 esps delete command injection](https://agentprime.io/advisories/CVE-2026-18813.md) `CVE-2026-18813` · CVE record: H3C NX15 · CVSS 8.6 High · Not analysed yet · Published 4 Aug 2026 · Tags: Other injection, Command injection - [H3C NX15 esps esps.ipv6.wan command injection](https://agentprime.io/advisories/CVE-2026-18812.md) `CVE-2026-18812` · CVE record: H3C NX15 · CVSS 8.6 High · Not analysed yet · Published 4 Aug 2026 · Tags: Other injection, Command injection - [H3C NX15 esps add command injection](https://agentprime.io/advisories/CVE-2026-18811.md) `CVE-2026-18811` · CVE record: H3C NX15 · CVSS 8.6 High · Not analysed yet · Published 4 Aug 2026 · Tags: Other injection, Command injection - [GL.iNet AX1800 RPC Endpoint oui-rpc.lua remove_rule command injection](https://agentprime.io/advisories/CVE-2026-18787.md) `CVE-2026-18787` · CVE record: GL.iNet AX1800 · CVSS 8.7 High · Not analysed yet · Published 4 Aug 2026 · Tags: Other injection, Command injection - [vibesurf-ai VibeSurf Python Validation code code injection](https://agentprime.io/advisories/CVE-2026-18770.md) `CVE-2026-18770` · CVE record: vibesurf-ai VibeSurf · CVSS 6.9 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Other injection, Code injection - [chetans9 core-php-admin-panel customers.php sql injection](https://agentprime.io/advisories/CVE-2026-18766.md) `CVE-2026-18766` · CVE record: chetans9 core-php-admin-panel · CVSS 5.3 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Other injection, SQL injection - [cemtan sar2html Search sar2html.py sql injection](https://agentprime.io/advisories/CVE-2026-18719.md) `CVE-2026-18719` · CVE record: cemtan sar2html · CVSS 5.3 Medium · Not analysed yet · Published 4 Aug 2026 · Tags: Other injection, SQL injection Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .