# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first

- [Subnet Solutions PowerSYSTEM Center SQL Injection](https://agentprime.io/advisories/CVE-2026-63774.md)
  `CVE-2026-63774` · CVE record: Subnet Solutions PowerSYSTEM Center 2024 and 1 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Nov 2026 · Tags: SQL injection
- [Subnet Solutions PowerSYSTEM Center Incorrect Authorization](https://agentprime.io/advisories/CVE-2026-63017.md)
  `CVE-2026-63017` · CVE record: Subnet Solutions PowerSYSTEM Center 2020 and 2 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Nov 2026 · Tags: Broken access control
- [Excessive memory allocation when decompressing crafted streams in github.com/andybalholm/brotli](https://agentprime.io/advisories/GHSA-9v8h-qqgm-4m35.md)
  `GHSA-9v8h-qqgm-4m35`, `BIT-brotli-2026-111497`, `BIT-dotnet-2026-111497`, `BIT-dotnet-sdk-2026-111497`, `BIT-node-2026-111497`, `BIT-node-min-2026-111497`, `BIT-powershell-2026-111497`, `CVE-2026-111497`, `GHSA-c9gr-gmg4-2vqv`, `GO-2026-6888`, `PYSEC-2026-4322`, `PYSEC-2026-4323` · Go `github.com/andybalholm/brotli`: affected `<1.2.7`, fixed in `1.2.7` · CVSS 9.2 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.83 · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption, CWE-252
- [Kubeflow Pipelines API server lacks authorization for shared pipeline uploads](https://agentprime.io/advisories/CVE-2026-77596.md)
  `CVE-2026-77596` · CVE record: kubeflow pipelines · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Incorrect validation of TLS certificates in the MatchPoint Android app](https://agentprime.io/advisories/CVE-2026-111494.md)
  `CVE-2026-111494` · CVE record: TPC Software Matchpoint · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS
- [Insecure direct object reference (IDOR) vulnerability in the MatchPoint API](https://agentprime.io/advisories/CVE-2026-111490.md)
  `CVE-2026-111490` · CVE record: TPC Software Matchpoint · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform](https://agentprime.io/advisories/CVE-2026-111489.md)
  `CVE-2026-111489` · CVE record: TPC Software Matchpoint · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026
- [BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure](https://agentprime.io/advisories/CVE-2026-119757.md)
  `CVE-2026-119757` · CVE record: BTCPay Server BTCPay Server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Hard-coded credentials, Information disclosure
- [Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)](https://agentprime.io/advisories/CVE-2026-85076.md)
  `CVE-2026-85076` · CVE record: jhuckaby Cronicle · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Other injection, Broken access control
- [OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment](https://agentprime.io/advisories/CVE-2026-102940.md)
  `CVE-2026-102940` · CVE record: openemr openemr · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY](https://agentprime.io/advisories/CVE-2026-116790.md)
  `CVE-2026-116790` · CVE record: signalwire freeswitch · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands](https://agentprime.io/advisories/CVE-2026-116779.md)
  `CVE-2026-116779` · CVE record: signalwire freeswitch · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Command injection, CWE-749
- [FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling](https://agentprime.io/advisories/CVE-2026-116785.md)
  `CVE-2026-116785` · CVE record: signalwire freeswitch · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption, CWE-681
- [SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection](https://agentprime.io/advisories/CVE-2026-100358.md)
  `CVE-2026-100358` · CVE record: SuiteCRM SuiteCRM · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Code injection
- [SuiteCRM: LFI to RCE via AOW_WorkFlow](https://agentprime.io/advisories/CVE-2026-71550.md)
  `CVE-2026-71550` · CVE record: SuiteCRM SuiteCRM · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: File inclusion
- [LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/\<ID>](https://agentprime.io/advisories/CVE-2026-123198.md)
  `CVE-2026-123198` · CVE record: LMFDB LMFDB · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Code injection
- [kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts](https://agentprime.io/advisories/GHSA-5q7h-w9jf-cx97.md)
  `GHSA-5q7h-w9jf-cx97`, `CVE-2026-105769`, `GO-2026-6902` · Go `github.com/chainguard-dev/kaniko`: affected `<1.25.20`, fixed in `1.25.20` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Hard-coded credentials, CWE-346
- [OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command execution](https://agentprime.io/advisories/CVE-2026-54143.md)
  `CVE-2026-54143` · CVE record: tinyhumansai openhuman · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Command injection, Broken access control
- [OpenHuman: Yuanbao non-web channel can bypass human approval to execute \`node_exec\`](https://agentprime.io/advisories/CVE-2026-54141.md)
  `CVE-2026-54141` · CVE record: tinyhumansai openhuman · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Code injection, Broken access control
- [Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacks](https://agentprime.io/advisories/CVE-2026-119344.md)
  `CVE-2026-119344` · CVE record: ultravioletrs cocos · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-346
- [Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound](https://agentprime.io/advisories/CVE-2026-82907.md)
  `CVE-2026-82907` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Authentication bypass
- [Apache OFBiz: Unauthenticated RCE via login-page widget injection](https://agentprime.io/advisories/CVE-2026-83542.md)
  `CVE-2026-83542` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Code injection
- [Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names](https://agentprime.io/advisories/CVE-2026-117691.md)
  `CVE-2026-117691` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Weak cryptography or TLS
- [Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory](https://agentprime.io/advisories/CVE-2026-121489.md)
  `CVE-2026-121489` · CVE record: Apache Software Foundation Apache Juneau · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal
- [Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome](https://agentprime.io/advisories/CVE-2026-96677.md)
  `CVE-2026-96677` · CVE record: Apache Software Foundation Apache Juneau · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site scripting (XSS)
- [Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data](https://agentprime.io/advisories/CVE-2026-73117.md)
  `CVE-2026-73117` · CVE record: Apache Software Foundation Apache Juneau · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Other injection
- [Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects](https://agentprime.io/advisories/CVE-2026-73116.md)
  `CVE-2026-73116` · CVE record: Apache Software Foundation Apache Juneau · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Hard-coded credentials
- [Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults](https://agentprime.io/advisories/CVE-2026-73101.md)
  `CVE-2026-73101` · CVE record: Apache Software Foundation Apache Juneau · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure
- [Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors](https://agentprime.io/advisories/CVE-2026-73100.md)
  `CVE-2026-73100` · CVE record: Apache Software Foundation Apache Juneau · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure
- [Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override](https://agentprime.io/advisories/CVE-2026-73099.md)
  `CVE-2026-73099` · CVE record: Apache Software Foundation Apache Juneau · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Cross-site request forgery (CSRF)
- [Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing](https://agentprime.io/advisories/CVE-2026-73098.md)
  `CVE-2026-73098` · CVE record: Apache Software Foundation Apache Juneau · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Code injection
- [Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user](https://agentprime.io/advisories/CVE-2026-100109.md)
  `CVE-2026-100109` · CVE record: Unknown Security For WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [OS command injection in OPNsense os-acme-client](https://agentprime.io/advisories/CVE-2026-123025.md)
  `CVE-2026-123025` · CVE record: OPNsense os-acme-client · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Command injection
- [Integer underflow in G4KLX DStarGateway](https://agentprime.io/advisories/CVE-2026-122992.md)
  `CVE-2026-122992` · CVE record: G4KLX DStarGateway · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Memory corruption
- [Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicy](https://agentprime.io/advisories/CVE-2026-122313.md)
  `CVE-2026-122313` · CVE record: kyverno kyverno · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Privilege escalation
- [Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument](https://agentprime.io/advisories/CVE-2026-122311.md)
  `CVE-2026-122311` · CVE record: kyverno kyverno · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal
- [Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath](https://agentprime.io/advisories/CVE-2026-122310.md)
  `CVE-2026-122310` · CVE record: kyverno kyverno · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-436
- [Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader](https://agentprime.io/advisories/CVE-2026-122304.md)
  `CVE-2026-122304` · CVE record: kyverno kyverno · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy](https://agentprime.io/advisories/CVE-2026-122303.md)
  `CVE-2026-122303` · CVE record: kyverno kyverno · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control
- [Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check](https://agentprime.io/advisories/CVE-2026-122302.md)
  `CVE-2026-122302` · CVE record: kyverno kyverno · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Privilege escalation
- [Edimax BR-6208AC mp command injection](https://agentprime.io/advisories/CVE-2026-122051.md)
  `CVE-2026-122051` · CVE record: Edimax BR-6208AC · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Other injection, Command injection
- [Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing](https://agentprime.io/advisories/CVE-2026-115770.md)
  `CVE-2026-115770` · CVE record: pocket-id pocket-id · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-345
- [VitaFit Cloud API Authentication Bypass via POST /front/login/sns/](https://agentprime.io/advisories/CVE-2026-54384.md)
  `CVE-2026-54384` · CVE record: Shenzhen Shine Industrial Co., Ltd. VitaFit · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [GLPI: MFA bypass](https://agentprime.io/advisories/CVE-2026-52848.md)
  `CVE-2026-52848` · CVE record: glpi-project glpi · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [VitaFit Cloud API Broken Access Control via S3 Token Endpoint](https://agentprime.io/advisories/CVE-2026-54378.md)
  `CVE-2026-54378` · CVE record: Shenzhen Shine Industrial Co., Ltd. VitaFit · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Hard-coded credentials
- [Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy](https://agentprime.io/advisories/CVE-2026-57566.md)
  `CVE-2026-57566` · CVE record: readest readest · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Server-side request forgery (SSRF)
- [GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover](https://agentprime.io/advisories/CVE-2026-102894.md)
  `CVE-2026-102894` · CVE record: gpustack gpustack · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin](https://agentprime.io/advisories/CVE-2026-102895.md)
  `CVE-2026-102895` · CVE record: gpustack gpustack · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass, CWE-346
- [Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise](https://agentprime.io/advisories/CVE-2026-97693.md)
  `CVE-2026-97693` · CVE record: xerrors Yuxi · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Command injection, Broken access control, Hard-coded credentials
- [IBM Watson Speech Services Cartridge is vulnerable to a Use After Free condition in cryptography wheels OpenSSL](https://agentprime.io/advisories/CVE-2026-82418.md)
  `CVE-2026-82418` · CVE record: IBM Watson Speech Services Cartridge · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Memory corruption
- [Comfast CF-WR632AX Multipart webmgnt path traversal](https://agentprime.io/advisories/CVE-2026-122013.md)
  `CVE-2026-122013` · CVE record: Comfast CF-WR632AX · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Path traversal
- [vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php](https://agentprime.io/advisories/CVE-2025-71457.md)
  `CVE-2025-71457` · CVE record: vtenext vtenext · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-620
- [WPO365 LOGIN before 45.2 SAML Replay Protection Bypass](https://agentprime.io/advisories/CVE-2026-122220.md)
  `CVE-2026-122220` · CVE record: wpo365 WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again](https://agentprime.io/advisories/CVE-2026-113373.md)
  `CVE-2026-113373` · CVE record: Sonatype Nexus Repository 3 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [Linksys E5350 Setup Wizard apply.cgi save_settings missing authentication](https://agentprime.io/advisories/CVE-2026-121933.md)
  `CVE-2026-121933` · CVE record: Linksys E5350 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Authentication bypass
- [ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary](https://agentprime.io/advisories/CVE-2026-113780.md)
  `CVE-2026-113780` · CVE record: espressif esp-idf · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Memory corruption
- [bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list](https://agentprime.io/advisories/CVE-2026-107846.md)
  `CVE-2026-107846` · CVE record: bitcoinjs bitcoinjs-lib · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-354
- [Linksys E5350 apply.cgi system os command injection](https://agentprime.io/advisories/CVE-2026-121932.md)
  `CVE-2026-121932` · CVE record: Linksys E5350 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Command injection
- [Linksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injection](https://agentprime.io/advisories/CVE-2026-121931.md)
  `CVE-2026-121931` · CVE record: Linksys WRT54GL · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Command injection
- [Linksys WRT54GL Ping Diagnostic apply.cgi system os command injection](https://agentprime.io/advisories/CVE-2026-121930.md)
  `CVE-2026-121930` · CVE record: Linksys WRT54GL · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2026 · Tags: Command injection

Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTExLTA0VDE4OjMwOjExLjEzMTAwMFoiLCJDVkUtMjAyNi0xMjE5MzAiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/>. Everything for agents: <https://agentprime.io/llms.txt>.