# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Eval Injection in google/langfun via default lf.query protocol](https://agentprime.io/advisories/CVE-2026-75062.md)
  `CVE-2026-75062` · CVE record: Google langfun · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Code injection, CWE-1188
- [block: stop the timeout timer when releasing a never added disk](https://agentprime.io/advisories/CVE-2026-80589.md)
  `CVE-2026-80589` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026
- [mptcp: avoid combining some incoming suboptions](https://agentprime.io/advisories/CVE-2026-80587.md)
  `CVE-2026-80587` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026
- [mptcp: options: reset DSS fields in case of unexpected size](https://agentprime.io/advisories/CVE-2026-80586.md)
  `CVE-2026-80586` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026
- [mptcp: fastopen: only mark MPTFO subflows with SYN data](https://agentprime.io/advisories/CVE-2026-80585.md)
  `CVE-2026-80585` · CVE record: Linux Linux · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026
- [libceph: fix multiple unsafe decodes in decode_locker()](https://agentprime.io/advisories/CVE-2026-80561.md)
  `CVE-2026-80561` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026
- [libceph: Avoid using invalid osd indices from primary_temp](https://agentprime.io/advisories/CVE-2026-80558.md)
  `CVE-2026-80558` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026
- [libceph: fix OOB read in decode_watchers() via missing bounds check](https://agentprime.io/advisories/CVE-2026-80557.md)
  `CVE-2026-80557` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026
- [s390/vfio_ccw: Limit the number of channel program segments](https://agentprime.io/advisories/CVE-2026-80554.md)
  `CVE-2026-80554` · CVE record: Linux Linux · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026
- [s390/vfio_ccw: Ensure first IDAW remains constant](https://agentprime.io/advisories/CVE-2026-80551.md)
  `CVE-2026-80551` · CVE record: Linux Linux · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026
- [ceph: avoid fs reclaim while using current->journal_info](https://agentprime.io/advisories/CVE-2026-80528.md)
  `CVE-2026-80528` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026
- [ovpn: finish crypto callback cleanup before peer release](https://agentprime.io/advisories/CVE-2026-80519.md)
  `CVE-2026-80519` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026
- [sctp: validate cookie AUTH state before use](https://agentprime.io/advisories/CVE-2026-74752.md)
  `CVE-2026-74752` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026
- [riscv: lib: Fix ZBB strnlen reading past count boundary](https://agentprime.io/advisories/CVE-2026-74751.md)
  `CVE-2026-74751` · CVE record: Linux Linux · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026
- [netfilter: flowtable: publish GC-visible tuple last](https://agentprime.io/advisories/CVE-2026-74746.md)
  `CVE-2026-74746` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026
- [ipvlan: inherit needed_headroom and needed_tailroom from phy_dev](https://agentprime.io/advisories/CVE-2026-74744.md)
  `CVE-2026-74744` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026
- [macvlan: inherit needed_headroom and needed_tailroom from lowerdev](https://agentprime.io/advisories/CVE-2026-74743.md)
  `CVE-2026-74743` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026
- [net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG](https://agentprime.io/advisories/CVE-2026-74737.md)
  `CVE-2026-74737` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026
- [Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system](https://agentprime.io/advisories/GHSA-79gf-7frw-68m9.md)
  `GHSA-79gf-7frw-68m9`, `BIT-kyverno-2026-54523`, `CVE-2026-54523`, `GO-2026-6296` · Go `github.com/kyverno/kyverno`: affected `>=1.18.0, <1.18.2`, fixed in `1.18.2` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Broken access control
- [Use of Hard-coded LDAP Credentials in TÜBİTAK BİLGEM's Liderahenk](https://agentprime.io/advisories/CVE-2026-75896.md)
  `CVE-2026-75896` · CVE record: TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Hard-coded credentials
- [Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String Injection](https://agentprime.io/advisories/CVE-2026-12717.md)
  `CVE-2026-12717` · CVE record: Google Cloud BigQuery Data Transfer Service · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Other injection
- [ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment](https://agentprime.io/advisories/CVE-2026-18080.md)
  `CVE-2026-18080` · CVE record: wedevs ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Unrestricted file upload
- [Improper access control in Ubiquiti Inc UniFi Protect AI Key](https://agentprime.io/advisories/CVE-2026-77557.md)
  `CVE-2026-77557` · CVE record: Ubiquiti Inc UniFi Protect AI Key · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Broken access control
- [Improper input validation in Ubiquiti Inc UniFi Talk Application](https://agentprime.io/advisories/CVE-2026-77554.md)
  `CVE-2026-77554` · CVE record: Ubiquiti Inc UniFi Talk Application · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-20
- [Improper access control in Ubiquiti Inc UniFi Access Application](https://agentprime.io/advisories/CVE-2026-77553.md)
  `CVE-2026-77553` · CVE record: Ubiquiti Inc UniFi Access Application · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Broken access control
- [Improper input validation in Ubiquiti Inc UniFi Enterprise Audio/Video Bridge](https://agentprime.io/advisories/CVE-2026-77552.md)
  `CVE-2026-77552` · CVE record: Ubiquiti Inc UniFi Enterprise Audio/Video Bridge · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-20
- [Improper access control in Ubiquiti Inc UniFi Connect Display Cast Pro](https://agentprime.io/advisories/CVE-2026-77551.md)
  `CVE-2026-77551` · CVE record: Ubiquiti Inc UniFi Connect Display Cast Pro · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Broken access control
- [CRLF injection in Ubiquiti Inc UniFi OS Server and others](https://agentprime.io/advisories/CVE-2026-77550.md)
  `CVE-2026-77550` · CVE record: Ubiquiti Inc UniFi OS Server and 4 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Other injection
- [CRLF injection in Ubiquiti Inc UniFi OS Server and others](https://agentprime.io/advisories/CVE-2026-77549.md)
  `CVE-2026-77549` · CVE record: Ubiquiti Inc UniFi OS Server and 4 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Other injection
- [Grav before 1.0.18 Authentication Bypass via Scoped API Key](https://agentprime.io/advisories/CVE-2026-80204.md)
  `CVE-2026-80204` · CVE record: getgrav grav · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Broken access control
- [Grav before 1.0.18 Authentication Bypass via Scoped API Key](https://agentprime.io/advisories/CVE-2026-80203.md)
  `CVE-2026-80203` · CVE record: getgrav grav · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Broken access control
- [Improper input validation in Ubiquiti Inc UniFi Protect Application](https://agentprime.io/advisories/CVE-2026-77548.md)
  `CVE-2026-77548` · CVE record: Ubiquiti Inc UniFi Protect Application · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-20
- [Improper input validation in Ubiquiti Inc UniFi Access Application](https://agentprime.io/advisories/CVE-2026-77547.md)
  `CVE-2026-77547` · CVE record: Ubiquiti Inc UniFi Access Application · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-20
- [Improper input validation in Ubiquiti Inc UniFi Access Application](https://agentprime.io/advisories/CVE-2026-77546.md)
  `CVE-2026-77546` · CVE record: Ubiquiti Inc UniFi Access Application · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-20
- [Active debug code in Ubiquiti Inc UniFi OS Server and others](https://agentprime.io/advisories/CVE-2026-77545.md)
  `CVE-2026-77545` · CVE record: Ubiquiti Inc UniFi OS Server and 4 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-489
- [TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter](https://agentprime.io/advisories/CVE-2026-80349.md)
  `CVE-2026-80349` · CVE record: TarsCloud TarsWeb · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Authentication bypass
- [Improper input validation in Ubiquiti Inc UniFi Access Application](https://agentprime.io/advisories/CVE-2026-77543.md)
  `CVE-2026-77543` · CVE record: Ubiquiti Inc UniFi Access Application · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-20
- [Improper input validation in Ubiquiti Inc UID Enterprise Agent](https://agentprime.io/advisories/CVE-2026-77542.md)
  `CVE-2026-77542` · CVE record: Ubiquiti Inc UID Enterprise Agent · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-20
- [Improper access control in Ubiquiti Inc UniFi Network Application](https://agentprime.io/advisories/CVE-2026-77541.md)
  `CVE-2026-77541` · CVE record: Ubiquiti Inc UniFi Network Application · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Broken access control
- [Improper input validation in Ubiquiti Inc UniFi OS Server](https://agentprime.io/advisories/CVE-2026-77540.md)
  `CVE-2026-77540` · CVE record: Ubiquiti Inc UniFi OS Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-20
- [Improper input validation in Ubiquiti Inc UniFi OS Server](https://agentprime.io/advisories/CVE-2026-77539.md)
  `CVE-2026-77539` · CVE record: Ubiquiti Inc UniFi OS Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-20
- [Improper input validation in Ubiquiti Inc UniFi Protect Application](https://agentprime.io/advisories/CVE-2026-77537.md)
  `CVE-2026-77537` · CVE record: Ubiquiti Inc UniFi Protect Application · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-20
- [Improper access control in Ubiquiti Inc UniFi OS Server and others](https://agentprime.io/advisories/CVE-2026-77536.md)
  `CVE-2026-77536` · CVE record: Ubiquiti Inc UniFi OS Server and 4 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Broken access control
- [Improper input validation in Ubiquiti Inc UniFi Network Application](https://agentprime.io/advisories/CVE-2026-77535.md)
  `CVE-2026-77535` · CVE record: Ubiquiti Inc UniFi Network Application · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-20
- [OpenRGB: local and remote system compromise via arbitrary file write using attacker controlled strings](https://agentprime.io/advisories/CVE-2026-59683.md)
  `CVE-2026-59683` · CVE record: CalcProgrammer1 OpenRGB · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Path traversal
- [Improper access control in Ubiquiti Inc UniFi OS Server and others](https://agentprime.io/advisories/CVE-2026-77534.md)
  `CVE-2026-77534` · CVE record: Ubiquiti Inc UniFi OS Server and 4 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Broken access control
- [Improper input validation in Ubiquiti Inc UniFi Protect Application](https://agentprime.io/advisories/CVE-2026-77533.md)
  `CVE-2026-77533` · CVE record: Ubiquiti Inc UniFi Protect Application · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-20
- [Thinking Software Technology｜EFence - Arbitrary File Upload](https://agentprime.io/advisories/CVE-2026-80235.md)
  `CVE-2026-80235` · CVE record: Thinking Software Technology EFence · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Unrestricted file upload
- [Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write](https://agentprime.io/advisories/CVE-2026-18431.md)
  `CVE-2026-18431` · CVE record: themefusion Avada (Fusion) Builder and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Broken access control
- [Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid software](https://agentprime.io/advisories/CVE-2026-15203.md)
  `CVE-2026-15203` · CVE record: Danfoss iC7-Automation SP and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-1191
- [TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure](https://agentprime.io/advisories/CVE-2026-19632.md)
  `CVE-2026-19632` · CVE record: cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-640
- [Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability](https://agentprime.io/advisories/GHSA-h3x4-894j-xpx5.md)
  `GHSA-h3x4-894j-xpx5`, `BIT-tomcat-2026-68525`, `CVE-2026-68525` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=11.0.0-M1, <11.0.25 || >=10.1.0-M1, <10.1.58 || >=9.0.0-M1, <9.0.121 || >=8.5.0, <=8.5.100 || >=7.0.0, <=7.0.109`, fixed in `11.0.25`, `10.1.58`, `9.0.121` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Broken access control
- [Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability](https://agentprime.io/advisories/GHSA-gcx9-497g-6cp6.md)
  `GHSA-gcx9-497g-6cp6`, `BIT-tomcat-2026-65182`, `CVE-2026-65182` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=11.0.0-M1, <11.0.25 || >=10.1.0-M1, <10.1.58 || >=9.0.0-M1, <9.0.121 || >=8.5.0, <=8.5.100 || >=7.0.0, <=7.0.109`, fixed in `11.0.25`, `10.1.58`, `9.0.121` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Broken access control
- [Apache Tomcat - HTTP/2 no-authority bypass of strict SNI validation](https://agentprime.io/advisories/GHSA-f525-44xv-f2qj.md)
  `GHSA-f525-44xv-f2qj`, `BIT-tomcat-2026-65637`, `CVE-2026-65637` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=11.0.20, <11.0.25 || >=10.1.53, <10.1.59 || >=9.0.115, <9.0.121`, fixed in `11.0.25`, `10.1.59`, `9.0.121` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-20
- [Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability](https://agentprime.io/advisories/GHSA-9xv2-5v5q-p794.md)
  `GHSA-9xv2-5v5q-p794`, `BIT-tomcat-2026-65905`, `CVE-2026-65905` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=11.0.0-M1, <11.0.25 || >=10.1.0-M1, <10.1.58 || >=9.0.0.M1, <9.0.121 || >=8.5.0, <=8.5.100 || >=7.0.30, <=7.0.109`, fixed in `11.0.25`, `10.1.58`, `9.0.121` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Authentication bypass
- [In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command execution vulnerability.](https://agentprime.io/advisories/CVE-2026-75414.md)
  `CVE-2026-75414` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Code injection
- [JeecgBoot v3.9.2 is vulnerable to Remote command execution.](https://agentprime.io/advisories/CVE-2026-75411.md)
  `CVE-2026-75411` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Code injection
- [The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 is vulnerable to Server-side request forgery (SSRF).](https://agentprime.io/advisories/CVE-2026-75340.md)
  `CVE-2026-75340` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Server-side request forgery (SSRF)
- [disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control.](https://agentprime.io/advisories/CVE-2026-75338.md)
  `CVE-2026-75338` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: Broken access control
- [Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.json.](https://agentprime.io/advisories/CVE-2026-75336.md)
  `CVE-2026-75336` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Aug 2026 · Tags: SQL injection

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA4LTI2VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNi03NTMzNiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA4LTI2VDE1OjI4OjQ3LjAwMDAwMFoiLCJHSFNBLWpydzYtN3g0cS13MjVqIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA4LTI2VDE1OjI4OjQ3LjAwMDAwMFoiLCJHSFNBLWpydzYtN3g0cS13MjVqIl0>. Everything for agents: <https://agentprime.io/llms.txt>.