# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [RansomLook Missing Authorization in Web Configuration Editor Allows Application Configuration Modification](https://agentprime.io/advisories/CVE-2026-78387.md)
  `CVE-2026-78387` · CVE record: ransomlook ransomlook · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Broken access control
- [phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache](https://agentprime.io/advisories/CVE-2026-67602.md)
  `CVE-2026-67602` · CVE record: phpipam phpipam · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-706
- [Remote Code Execution](https://agentprime.io/advisories/CVE-2026-59568.md)
  `CVE-2026-59568` · CVE record: Zscaler Client Connector · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-20
- [Authentication bypass between ZCC and client connector portal](https://agentprime.io/advisories/CVE-2026-59564.md)
  `CVE-2026-59564` · CVE record: Zscaler Client Connector · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Authentication bypass
- [RansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data](https://agentprime.io/advisories/CVE-2026-78372.md)
  `CVE-2026-78372` · CVE record: ransomlook ransomlook · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Broken access control
- [Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Sin…](https://agentprime.io/advisories/CVE-2026-77995.md)
  `CVE-2026-77995` · CVE record: miniorange.com miniOrange OAuth Client (free) extension for Joomla and 3 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Broken access control
- [RansomLook Unauthenticated Database Export Exposes Private Data](https://agentprime.io/advisories/CVE-2026-78370.md)
  `CVE-2026-78370` · CVE record: ransomlook ransomlook · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Broken access control
- [IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification](https://agentprime.io/advisories/CVE-2026-78365.md)
  `CVE-2026-78365` · CVE record: Roskus Prospero Flow CRM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Broken access control
- [WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-66650.md)
  `CVE-2026-66650` · CVE record: Theme-Rex FreightCo · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Insecure deserialization
- [WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-66648.md)
  `CVE-2026-66648` · CVE record: MVPThemes Jawn · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Privilege escalation
- [WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-66587.md)
  `CVE-2026-66587` · CVE record: WPCafe WP Cafe Pro · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: File inclusion
- [WordPress Affiliate Pro - Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-32558.md)
  `CVE-2026-32558` · CVE record: RedefiningTheWeb Affiliate Pro - Affiliate Program for WooCommerce & WordPress · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Privilege escalation
- [WordPress Woo Essential plugin <= 4.3.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-32551.md)
  `CVE-2026-32551` · CVE record: DiviNext Woo Essential · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: SQL injection
- [WordPress Digits plugin <= 9.2 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-28165.md)
  `CVE-2026-28165` · CVE record: UnitedOver, LLC Digits · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Privilege escalation
- [Instance template path traversal allows arbitrary host file write as root](https://agentprime.io/advisories/CVE-2026-66897.md)
  `CVE-2026-66897` · CVE record: Canonical LXD · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Path traversal
- [Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5](https://agentprime.io/advisories/CVE-2026-77994.md)
  `CVE-2026-77994` · CVE record: joomlack.fr Page Builder CK extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: SQL injection
- [DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory](https://agentprime.io/advisories/CVE-2026-78251.md)
  `CVE-2026-78251` · CVE record: DJI Neo and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Hard-coded credentials
- [4MOSAn Security Technology｜4MOSAn GCB Doctor - OS Command Injection](https://agentprime.io/advisories/CVE-2026-78211.md)
  `CVE-2026-78211` · CVE record: 4MOSAn Security Technology 4MOSAn GCB Doctor · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [UTT HiPER 1250GW HTTP Request aspRemoteApConfTempSend strcpy stack-based overflow](https://agentprime.io/advisories/CVE-2026-78169.md)
  `CVE-2026-78169` · CVE record: UTT HiPER 1250GW · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Memory corruption
- [EFM ipTIME T24000M Session Validation httpcon_check_session_url improper authentication](https://agentprime.io/advisories/CVE-2026-78168.md)
  `CVE-2026-78168` · CVE record: EFM ipTIME T24000M · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Authentication bypass
- [EFM ipTIME T16000M Session Validation httpcon_check_session_url improper authentication](https://agentprime.io/advisories/CVE-2026-78167.md)
  `CVE-2026-78167` · CVE record: EFM ipTIME T16000M · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Authentication bypass
- [exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization](https://agentprime.io/advisories/CVE-2026-78207.md)
  `CVE-2026-78207` · CVE record: exceljs exceljs · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Prototype pollution
- [An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the process_command_opts() function in tools/tiffcrop.c](https://agentprime.io/advisories/CVE-2026-52490.md)
  `CVE-2026-52490` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Code injection
- [DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float](https://agentprime.io/advisories/CVE-2026-78183.md)
  `CVE-2026-78183` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Aug 2026 · Tags: Memory corruption
- [Untrusted Search Path in StackGres](https://agentprime.io/advisories/CVE-2026-78155.md)
  `CVE-2026-78155` · CVE record: OnGres StackGres · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Aug 2026 · Tags: CWE-426
- [RestrictMate < 1.3.0 - Unauthenticated Privilege Escalation to Administrator](https://agentprime.io/advisories/CVE-2026-13598.md)
  `CVE-2026-13598` · CVE record: Unknown RestrictMate · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Aug 2026 · Tags: Privilege escalation
- [Comfast CF-N1-S Web Management mbox-config sub_41AD7C stack-based overflow](https://agentprime.io/advisories/CVE-2026-78050.md)
  `CVE-2026-78050` · CVE record: Comfast CF-N1-S · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026 · Tags: Memory corruption
- [NFS: Pin the 'struct nfs_server' during a FREE_STATEID call](https://agentprime.io/advisories/CVE-2026-74730.md)
  `CVE-2026-74730` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026
- [ovpn: skip rehash for peers already removed from by_id](https://agentprime.io/advisories/CVE-2026-74727.md)
  `CVE-2026-74727` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026
- [btrfs: lzo: reject inline extents without valid headers](https://agentprime.io/advisories/CVE-2026-74723.md)
  `CVE-2026-74723` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026
- [vdpa/mlx5: Fix buffer length in create_direct_keys()](https://agentprime.io/advisories/CVE-2026-74712.md)
  `CVE-2026-74712` · CVE record: Linux Linux · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026
- [udp: fix potential use-after-free in tunnel segmentation](https://agentprime.io/advisories/CVE-2026-74705.md)
  `CVE-2026-74705` · CVE record: Linux Linux · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026
- [sctp: clear control chunk transport if it is being removed](https://agentprime.io/advisories/CVE-2026-74688.md)
  `CVE-2026-74688` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026
- [ipvs: clear IPv4 options after rebasing tunnel ICMP errors](https://agentprime.io/advisories/CVE-2026-74669.md)
  `CVE-2026-74669` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026
- [net: fix skb length accounting after generic XDP frag adjustment](https://agentprime.io/advisories/CVE-2026-74665.md)
  `CVE-2026-74665` · CVE record: Linux Linux · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026
- [inet: frags: publish queues before arming timer](https://agentprime.io/advisories/CVE-2026-74662.md)
  `CVE-2026-74662` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026
- [net/x25: fix use-after-free of the socket by its timers](https://agentprime.io/advisories/CVE-2026-74628.md)
  `CVE-2026-74628` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026
- [dibs: initialise dibs->lock in dibs_dev_alloc()](https://agentprime.io/advisories/CVE-2026-74617.md)
  `CVE-2026-74617` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026
- [xdp: reject clones that overrun skb_shared_info tailroom](https://agentprime.io/advisories/CVE-2026-74616.md)
  `CVE-2026-74616` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026
- [veth: fix skb length accounting after XDP frag adjustment](https://agentprime.io/advisories/CVE-2026-74612.md)
  `CVE-2026-74612` · CVE record: Linux Linux · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026
- [tls: rx: restore msg_iter before TLS 1.3 optimistic retry](https://agentprime.io/advisories/CVE-2026-74611.md)
  `CVE-2026-74611` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026
- [smb: client: Fix use-after-free in cifs_try_adding_channels()](https://agentprime.io/advisories/CVE-2026-74608.md)
  `CVE-2026-74608` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026
- [ip6_tunnel: clear skb2->cb\[\] in ip6ip6_err()](https://agentprime.io/advisories/CVE-2026-74597.md)
  `CVE-2026-74597` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026
- [mm/filemap: \_\_filemap_add_folio() restore index before retrying](https://agentprime.io/advisories/CVE-2026-74591.md)
  `CVE-2026-74591` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026
- [sctp: keep chunk->transport in step with the list it is queued on](https://agentprime.io/advisories/CVE-2026-74588.md)
  `CVE-2026-74588` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026
- [sctp: fix use-after-free of cached ASCONF chunk](https://agentprime.io/advisories/CVE-2026-74587.md)
  `CVE-2026-74587` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026
- [sctp: clear new_transport when removing a peer](https://agentprime.io/advisories/CVE-2026-74586.md)
  `CVE-2026-74586` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026
- [WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission](https://agentprime.io/advisories/CVE-2026-4703.md)
  `CVE-2026-4703` · CVE record: westguard WS Form LITE – Drag & Drop Contact Form Builder · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026 · Tags: Insecure deserialization
- [Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2](https://agentprime.io/advisories/CVE-2026-76606.md)
  `CVE-2026-76606` · CVE record: fabrikar.com Fabrik extension for Joomla · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026 · Tags: Path traversal
- [Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2](https://agentprime.io/advisories/CVE-2026-76602.md)
  `CVE-2026-76602` · CVE record: fabrikar.com Fabrik extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026 · Tags: SQL injection
- [Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition parameter in Fabrik < 4.7.2](https://agentprime.io/advisories/CVE-2026-76571.md)
  `CVE-2026-76571` · CVE record: fabrikar.com Fabrik extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026 · Tags: SQL injection
- [Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2](https://agentprime.io/advisories/CVE-2026-76605.md)
  `CVE-2026-76605` · CVE record: fabrikar.com Fabrik extension for Joomla · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026 · Tags: Code injection
- [Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2](https://agentprime.io/advisories/CVE-2026-77992.md)
  `CVE-2026-77992` · CVE record: fabrikar.com Fabrik extension for Joomla · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026 · Tags: Code injection
- [Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2](https://agentprime.io/advisories/CVE-2026-76604.md)
  `CVE-2026-76604` · CVE record: fabrikar.com Fabrik extension for Joomla · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026 · Tags: Code injection
- [Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2](https://agentprime.io/advisories/CVE-2026-76607.md)
  `CVE-2026-76607` · CVE record: fabrikar.com Fabrik extension for Joomla · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026 · Tags: Broken access control
- [Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them](https://agentprime.io/advisories/CVE-2026-75866.md)
  `CVE-2026-75866` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026 · Tags: Broken access control
- [Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret](https://agentprime.io/advisories/CVE-2026-75870.md)
  `CVE-2026-75870` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026 · Tags: CWE-1394
- [TRENDnet TEW-821DAP NTP Timezone Configuration apply_time.cgi uci_safe_get stack-based overflow](https://agentprime.io/advisories/CVE-2026-77946.md)
  `CVE-2026-77946` · CVE record: TRENDnet TEW-821DAP · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026 · Tags: Memory corruption
- [Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys](https://agentprime.io/advisories/CVE-2026-78003.md)
  `CVE-2026-78003` · CVE record: mailgun Mailgun for WordPress · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [Missing Authorization in Application Integration QueryEngineTask](https://agentprime.io/advisories/CVE-2026-12710.md)
  `CVE-2026-12710` · CVE record: Google Cloud Application Integration · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Aug 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA4LTIyVDA4OjEzOjAwLjA5NTAwMFoiLCJDVkUtMjAyNi0xMjcxMCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA4LTI0VDE1OjAyOjUxLjAyMjAwMFoiLCJDVkUtMjAyNi0xOTg3NCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA4LTI0VDE1OjAyOjUxLjAyMjAwMFoiLCJDVkUtMjAyNi0xOTg3NCJd>. Everything for agents: <https://agentprime.io/llms.txt>.