# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Out-of-bounds write in Google Chrome](https://agentprime.io/advisories/CVE-2026-79019.md)
  `CVE-2026-79019` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-79257.md)
  `CVE-2026-79257` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-79047.md)
  `CVE-2026-79047` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-78939.md)
  `CVE-2026-78939` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption
- [Out-of-bounds read in Google Chrome](https://agentprime.io/advisories/CVE-2026-78989.md)
  `CVE-2026-78989` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-79200.md)
  `CVE-2026-79200` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-79012.md)
  `CVE-2026-79012` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption
- [Use of uninitialized variable in Google Chrome](https://agentprime.io/advisories/CVE-2026-78935.md)
  `CVE-2026-78935` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-79150.md)
  `CVE-2026-79150` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-79052.md)
  `CVE-2026-79052` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-79290.md)
  `CVE-2026-79290` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-79282.md)
  `CVE-2026-79282` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption
- [Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution](https://agentprime.io/advisories/GHSA-w3fx-mc44-mf6j.md)
  `GHSA-w3fx-mc44-mf6j`, `CVE-2026-45018`, `PYSEC-2026-3812` · PyPI `chainlit`: affected `>=2.4.0rc0, <2.12.0`, fixed in `2.12.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [Consent bypass in python_repl tool via batch kwargs forwarding in Amazon Strands Agents Tools](https://agentprime.io/advisories/CVE-2026-78379.md)
  `CVE-2026-78379` · CVE record: Amazon strands-agents-tools · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-1427
- [Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature](https://agentprime.io/advisories/CVE-2026-79787.md)
  `CVE-2026-79787` · CVE record: Alluxio alluxio · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [AshAuthentication vulnerable to OAuth2/OIDC account takeover via email-based user matching](https://agentprime.io/advisories/GHSA-777c-2fxx-qr28.md)
  `GHSA-777c-2fxx-qr28`, `CVE-2026-49757`, `EEF-CVE-2026-49757` · Hex `ash_authentication`: affected `>=0.1.0, <4.14.0 || >=5.0.0-rc.0, <5.0.0-rc.10`, fixed in `4.14.0`, `5.0.0-rc.10` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)](https://agentprime.io/advisories/CVE-2026-76195.md)
  `CVE-2026-76195` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)](https://agentprime.io/advisories/CVE-2026-76197.md)
  `CVE-2026-76197` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2026-76193.md)
  `CVE-2026-76193` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [CVE-2026-19912](https://agentprime.io/advisories/CVE-2026-19912.md)
  `CVE-2026-19912` · CVE record: Kaltura Kaltura HTML5 Video Player, html5 library · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Path traversal, CWE-20
- [nextcloud-mcp-server: Unauthenticated \`POST /webhooks/nextcloud\` allows arbitrary vector data deletion when \`WEBHOOK_SECRET\` is unset ( default )](https://agentprime.io/advisories/GHSA-8vh3-g2qg-2h2c.md)
  `GHSA-8vh3-g2qg-2h2c`, `CVE-2026-55640`, `PYSEC-2026-3866` · PyPI `nextcloud-mcp-server`: affected `<0.117.2`, fixed in `0.117.2` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass
- [qwed-mcp has Unsafe SymPy \`parse_expr()\` Remote Code Execution via Unsanitized Math Expression Input](https://agentprime.io/advisories/GHSA-mw6r-2hvm-4rp2.md)
  `GHSA-mw6r-2hvm-4rp2`, `CVE-2026-55546`, `PYSEC-2026-3915` · PyPI `qwed-mcp`: affected `<0.2.1`, fixed in `0.2.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Code injection
- [PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)](https://agentprime.io/advisories/GHSA-6g6r-q6gw-w8fg.md)
  `GHSA-6g6r-q6gw-w8fg`, `CVE-2026-55536`, `PYSEC-2026-3886` · PyPI `praisonai`: affected `<4.6.58`, fixed in `4.6.58` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Broken access control, CWE-625
- [File Upload in TRTEK Software's Software Repository Management](https://agentprime.io/advisories/CVE-2026-16286.md)
  `CVE-2026-16286` · CVE record: TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Software Repository Management · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Unrestricted file upload
- [AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()](https://agentprime.io/advisories/CVE-2026-75803.md)
  `CVE-2026-75803` · CVE record: OpenSSL OpenSSL · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-354
- [Untrusted Sender DN Used as Format String in CMP Response Validation](https://agentprime.io/advisories/CVE-2026-63073.md)
  `CVE-2026-63073` · CVE record: OpenSSL OpenSSL · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption
- [Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Si…](https://agentprime.io/advisories/CVE-2026-77998.md)
  `CVE-2026-77998` · CVE record: miniorange.com SAML SSO Free for Joomla extension for Joomla and 4 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Broken access control
- [WatchGuard Agent improper authentication allows unauthenticated remote code execution](https://agentprime.io/advisories/CVE-2026-57910.md)
  `CVE-2026-57910` · CVE record: WatchGuard WatchGuard Agent · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Authentication bypass, Weak cryptography or TLS, CWE-494
- [WatchGuard Agent path traversal allows unauthenticated remote code execution](https://agentprime.io/advisories/CVE-2026-57909.md)
  `CVE-2026-57909` · CVE record: WatchGuard WatchGuard Agent · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Code injection, Authentication bypass
- [Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL paths](https://agentprime.io/advisories/CVE-2026-49845.md)
  `CVE-2026-49845` · CVE record: Apache Software Foundation Apache Hive · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Code injection
- [Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.url](https://agentprime.io/advisories/CVE-2026-55976.md)
  `CVE-2026-55976` · CVE record: Apache Software Foundation Apache Hive · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [TYPO3-EXT-SA-2026-022: Server-Side Template Injection in extension "powermail" (powermail)](https://agentprime.io/advisories/PKSA-dhfp-j236-nf9h.md)
  `PKSA-dhfp-j236-nf9h`, `CVE-2026-77136` · Packagist `in2code/powermail`: affected `<10.9.3 || >=11.0.0, <12.6.1 || >=13.0.0, <13.2.1`, fixed in `10.9.3`, `12.6.1`, `13.2.1` · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Code injection
- [Unauthenticated Remote Code Execution via Shell Injection in Web Management Interface](https://agentprime.io/advisories/CVE-2026-63586.md)
  `CVE-2026-63586` · CVE record: Weidmueller Interface IE-SR-2TX-WL and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Command injection
- [Cross-site scripting in the comments bundle (see GHSA-628f-v4f6-p37r)](https://agentprime.io/advisories/PKSA-3fqv-nq39-s3wg.md)
  `PKSA-3fqv-nq39-s3wg`, `CVE-2026-107845` · Packagist `contao/contao`: affected `>=4.0.0, <5.3.50 || >=5.4.0, <5.7.12`, fixed in `5.3.50`, `5.7.12` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Stack buffer overflow in OCPP GetConfiguration key parsing](https://agentprime.io/advisories/CVE-2026-13214.md)
  `CVE-2026-13214` · CVE record: zephyrproject zephyr · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Memory corruption
- [Grav Login Plugin before 3.9.1 Email Enumeration via Registration](https://agentprime.io/advisories/CVE-2026-72699.md)
  `CVE-2026-72699` · CVE record: getgrav grav-plugin-login · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Information disclosure
- [Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock](https://agentprime.io/advisories/CVE-2026-56710.md)
  `CVE-2026-56710` · CVE record: getgrav grav · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Broken access control
- [Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection](https://agentprime.io/advisories/CVE-2026-56705.md)
  `CVE-2026-56705` · CVE record: vrana adminer · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Path traversal
- [An issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in the Spring HttpInovkerServiceExporter component allows a remote attacker to execute arbitrary code via a crafted request to the console/heimd…](https://agentprime.io/advisories/CVE-2026-51368.md)
  `CVE-2026-51368` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2026 · Tags: Insecure deserialization
- [WordPress TranslatePress plugin <= 3.3.2 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-78267.md)
  `CVE-2026-78267` · CVE record: Cozmoslabs TranslatePress · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Privilege escalation
- [WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-78265.md)
  `CVE-2026-78265` · CVE record: Nexcess The Events Calendar · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Insecure deserialization
- [WordPress WP Project Manager plugin <= 4.0.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-78262.md)
  `CVE-2026-78262` · CVE record: weDevs WP Project Manager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Insecure deserialization
- [WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-32563.md)
  `CVE-2026-32563` · CVE record: A CPT ACPT (Pro) - Custom Post Types Plugin for WordPress · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Insecure deserialization
- [WordPress UltimateAI plugin <= 3.1.0 - Arbitrary File Upload vulnerability](https://agentprime.io/advisories/CVE-2026-32559.md)
  `CVE-2026-32559` · CVE record: tophive UltimateAI · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Unrestricted file upload
- [WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-32555.md)
  `CVE-2026-32555` · CVE record: PixelYourSite Professional Boost · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: SQL injection
- [WordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-32554.md)
  `CVE-2026-32554` · CVE record: WBW WooBeWoo Product Filter Pro · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: SQL injection
- [CakePHP: Potential Authentication bypass with CookieAuthenticator](https://agentprime.io/advisories/CVE-2026-77337.md)
  `CVE-2026-77337` · CVE record: cakephp authentication · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Authentication bypass, Denial of service
- [RansomLook API Key Disclosure Through /admin/apikeys HTML Source](https://agentprime.io/advisories/CVE-2026-78555.md)
  `CVE-2026-78555` · CVE record: ransomlook ransomlook · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Information disclosure, Hard-coded credentials
- [mcp-contextforge-gateway has RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server](https://agentprime.io/advisories/GHSA-xm98-3vcf-fph7.md)
  `GHSA-xm98-3vcf-fph7`, `CVE-2026-53710`, `PYSEC-2026-3862` · PyPI `mcp-contextforge-gateway`: affected `<1.0.2`, fixed in `1.0.2` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Code injection, CWE-693
- [Combodo iTop: Remote code execution using external auth variable value](https://agentprime.io/advisories/CVE-2026-39975.md)
  `CVE-2026-39975` · CVE record: Combodo iTop · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Code injection
- [Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes](https://agentprime.io/advisories/GHSA-v7h8-xhh6-gfj4.md)
  `GHSA-v7h8-xhh6-gfj4`, `CVE-2026-78329` · Maven `org.apache.camel:camel-undertow`: affected `>=4.11.0, <4.14.9 || >=4.15.0, <4.18.4 || >=4.19.0, <4.22.0`, fixed in `4.14.9`, `4.18.4`, `4.22.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-20
- [Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace](https://agentprime.io/advisories/GHSA-m5r8-w65q-8wjf.md)
  `GHSA-m5r8-w65q-8wjf`, `CVE-2026-71300` · Maven `org.apache.camel:camel-atmosphere-websocket`: affected `>=4.0.0, <4.14.9 || >=4.15.0, <4.18.4 || >=4.19.0, <4.22.0`, fixed in `4.14.9`, `4.18.4`, `4.22.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-20
- [Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir](https://agentprime.io/advisories/GHSA-2x37-89hj-2j95.md)
  `GHSA-2x37-89hj-2j95`, `CVE-2026-66906` · Maven `org.apache.camel:camel-azure-storage-blob`: affected `>=4.0.0, <4.14.9 || >=4.15.0, <4.18.4 || >=4.19.0, <4.22.0`, fixed in `4.14.9`, `4.18.4`, `4.22.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Path traversal
- [DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi](https://agentprime.io/advisories/CVE-2026-71921.md)
  `CVE-2026-71921` · CVE record: DrayTek Corporation VigorSwitch G2540xs and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [DrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray_apm](https://agentprime.io/advisories/CVE-2026-71914.md)
  `CVE-2026-71914` · CVE record: DrayTek Corporation VigorAP 918R and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Command injection
- [Stack-based buffer overflow in Google Nest](https://agentprime.io/advisories/CVE-2025-36939.md)
  `CVE-2025-36939` · CVE record: Google Nest · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Memory corruption
- [rConfig Core 8.0.0 < 8.2.10 Unauthorized Admin Registration via web.php](https://agentprime.io/advisories/CVE-2026-77915.md)
  `CVE-2026-77915` · CVE record: rconfig rconfig · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Authentication bypass, CWE-1188
- [Netis NC63 V3.0.0.3327 Stack Buffer Overflow via destHost Parameter](https://agentprime.io/advisories/CVE-2026-76071.md)
  `CVE-2026-76071` · CVE record: Netis Systems NC63 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Memory corruption
- [Netis NC63 V3.0.0.3327 Stack Buffer Overflow via Login Password Parameter](https://agentprime.io/advisories/CVE-2026-76070.md)
  `CVE-2026-76070` · CVE record: Netis Systems NC63 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Memory corruption
- [Konami's Metal Gear Online 3 contains a heap-based buffer overflow](https://agentprime.io/advisories/CVE-2026-19874.md)
  `CVE-2026-19874` · CVE record: Konami Metal Gear Online 3 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Aug 2026 · Tags: Memory corruption

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA4LTI0VDE1OjAyOjUxLjAyMjAwMFoiLCJDVkUtMjAyNi0xOTg3NCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA4LTI1VDIwOjEwOjAzLjgyODAwMFoiLCJDVkUtMjAyNi03OTEzMCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA4LTI1VDIwOjEwOjAzLjgyODAwMFoiLCJDVkUtMjAyNi03OTEzMCJd>. Everything for agents: <https://agentprime.io/llms.txt>.