# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Authentication](https://agentprime.io/advisories/CVE-2026-78362.md)
  `CVE-2026-78362` · CVE record: Unknown SEO Flow by LupsOnline · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Privilege escalation
- [Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log](https://agentprime.io/advisories/CVE-2026-83627.md)
  `CVE-2026-83627` · CVE record: wpmudev Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Code injection
- [MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery](https://agentprime.io/advisories/CVE-2026-13447.md)
  `CVE-2026-13447` · CVE record: inspireui MStore API – Create Native Android & iOS Apps On The Cloud · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Authentication bypass
- [OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation](https://agentprime.io/advisories/GHSA-rh53-xvx2-j327.md)
  `GHSA-rh53-xvx2-j327`, `CVE-2026-73842`, `GO-2026-6428` · Go `github.com/openchoreo/openchoreo`: affected `<1.0.3 || >=1.1.0, <1.1.3 || >=1.2.0-rc.1, <1.2.0`, fixed in `1.0.3`, `1.1.3`, `1.2.0` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Privilege escalation, Authentication bypass, Broken access control
- [IXON VPN Client CRLF Injection](https://agentprime.io/advisories/CVE-2026-75925.md)
  `CVE-2026-75925` · CVE record: IXON IXON VPN Client · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Other injection
- [SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers](https://agentprime.io/advisories/GHSA-h4v5-crx2-3cv4.md)
  `GHSA-h4v5-crx2-3cv4`, `CVE-2026-72793`, `GO-2026-6424` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260725132049-2d8b98395a91`, fixed in `0.0.0-20260725132049-2d8b98395a91` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Hard-coded credentials
- [SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers](https://agentprime.io/advisories/GHSA-h6w7-xxcf-w2mq.md)
  `GHSA-h6w7-xxcf-w2mq`, `CVE-2026-72795`, `GO-2026-6425` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260725125659-1ca1c3c9d94b`, fixed in `0.0.0-20260725125659-1ca1c3c9d94b` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Broken access control
- [SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf](https://agentprime.io/advisories/GHSA-34fj-mwm6-fjfg.md)
  `GHSA-34fj-mwm6-fjfg`, `CVE-2026-72794`, `GO-2026-6420` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260725123945-77421530be4a`, fixed in `0.0.0-20260725123945-77421530be4a` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Hard-coded credentials
- [SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns](https://agentprime.io/advisories/GHSA-mfrj-v65r-979c.md)
  `GHSA-mfrj-v65r-979c`, `CVE-2026-72798`, `GO-2026-6415` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260724121519-426991d155c0`, fixed in `0.0.0-20260724121519-426991d155c0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Broken access control
- [Path traversal in SonicWall Network Security Manager (NSM)](https://agentprime.io/advisories/CVE-2026-81939.md)
  `CVE-2026-81939` · CVE record: SonicWall Network Security Manager (NSM) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Path traversal
- [Missing authorization in SonicWall Network Security Manager (NSM)](https://agentprime.io/advisories/CVE-2026-78328.md)
  `CVE-2026-78328` · CVE record: SonicWall Network Security Manager (NSM) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Broken access control
- [OS command injection in SonicWall Network Security Manager (NSM)](https://agentprime.io/advisories/CVE-2026-78327.md)
  `CVE-2026-78327` · CVE record: SonicWall Network Security Manager (NSM) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Command injection
- [CodeWhale: SSRF bypass - TOCTOU on DNS failure for DNS pinning](https://agentprime.io/advisories/GHSA-6v2g-fpxh-pmmh.md)
  `GHSA-6v2g-fpxh-pmmh`, `CVE-2026-75856` · crates.io `codewhale-tui` and 3 more: affected `>=0.8.41, <0.8.64`, fixed in `0.8.64` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Nango < 0.71.6 Missing Authentication RCE via runner tRPC server](https://agentprime.io/advisories/CVE-2026-9317.md)
  `CVE-2026-9317` · CVE record: NangoHQ nango · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed](https://agentprime.io/advisories/CVE-2026-18658.md)
  `CVE-2026-18658` · CVE record: IBM Operational Decision Manager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: SQL injection
- [IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image](https://agentprime.io/advisories/CVE-2026-19274.md)
  `CVE-2026-19274` · CVE record: IBM Observability with Instana (Agent) · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Broken access control
- [Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi](https://agentprime.io/advisories/CVE-2026-44402.md)
  `CVE-2026-44402` · CVE record: Voltronic Power SNMP Web Pro · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Unrestricted file upload
- [SadTalker OS Command Injection via Audio Filename](https://agentprime.io/advisories/CVE-2026-85696.md)
  `CVE-2026-85696` · CVE record: OpenTalker SadTalker · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Command injection
- [FastChat Unauthenticated Worker Registration SSRF and Model Spoofing](https://agentprime.io/advisories/CVE-2026-85695.md)
  `CVE-2026-85695` · CVE record: lm-sys FastChat · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [LaVague 0.2.35 Remote Code Execution via eval extraction](https://agentprime.io/advisories/CVE-2026-85694.md)
  `CVE-2026-85694` · CVE record: lavague-ai LaVague · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Code injection
- [TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer](https://agentprime.io/advisories/CVE-2026-85688.md)
  `CVE-2026-85688` · CVE record: TEN-framework ten-framework · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [zerox 1.1.20 OS Command Injection via Document URL File Extension](https://agentprime.io/advisories/CVE-2026-85672.md)
  `CVE-2026-85672` · CVE record: getomni-ai zerox · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Command injection
- [xiaobei through 5.5.2 Unauthenticated Webhook Message Injection](https://agentprime.io/advisories/CVE-2026-85667.md)
  `CVE-2026-85667` · CVE record: TeamWiseFlow xiaobei · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch](https://agentprime.io/advisories/CVE-2026-85663.md)
  `CVE-2026-85663` · CVE record: aimhubio aim · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode](https://agentprime.io/advisories/CVE-2026-85661.md)
  `CVE-2026-85661` · CVE record: haris-musa excel-mcp-server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Path traversal
- [cli-mcp-server 0.2.5 Command Allowlist Bypass via Shell Substitution](https://agentprime.io/advisories/CVE-2026-85660.md)
  `CVE-2026-85660` · CVE record: MladenSU cli-mcp-server · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Command injection
- [sift 17.1.3 Prototype Pollution Remote Code Execution via $where](https://agentprime.io/advisories/CVE-2026-85625.md)
  `CVE-2026-85625` · CVE record: crcn sift.js · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Prototype pollution
- [Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function](https://agentprime.io/advisories/CVE-2026-85620.md)
  `CVE-2026-85620` · CVE record: crystaldba postgres-mcp · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Broken access control
- [OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker](https://agentprime.io/advisories/CVE-2026-85614.md)
  `CVE-2026-85614` · CVE record: Openpanel-dev openpanel · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass](https://agentprime.io/advisories/CVE-2026-85602.md)
  `CVE-2026-85602` · CVE record: getgrav grav-plugin-form · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: CWE-807
- [Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth](https://agentprime.io/advisories/CVE-2026-85595.md)
  `CVE-2026-85595` · CVE record: traefik traefik · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes](https://agentprime.io/advisories/CVE-2026-82923.md)
  `CVE-2026-82923` · CVE record: Unknown AI Website Builder (GitHub build) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Broken access control
- [@fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target](https://agentprime.io/advisories/CVE-2026-85184.md)
  `CVE-2026-85184` · CVE record: @fastify/middie @fastify/middie · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: CWE-436
- [Apache Allura: Server-side request forgery](https://agentprime.io/advisories/CVE-2026-80181.md)
  `CVE-2026-80181` · CVE record: Apache Software Foundation Apache Allura · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Hard-coded password in Xing Inc. XING CPTrans-ME-X](https://agentprime.io/advisories/CVE-2026-70403.md)
  `CVE-2026-70403` · CVE record: Xing Inc. XING CPTrans-ME-X · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Hard-coded credentials
- [XING CPTrans-ME-X contains a Use of Default Password (CWE-1393).](https://agentprime.io/advisories/CVE-2026-69657.md)
  `CVE-2026-69657` · CVE record: Xing Inc. XING CPTrans-ME-X · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: CWE-1393
- [OS command injection in Xing Inc. XING CPTrans-ME-X](https://agentprime.io/advisories/CVE-2026-62928.md)
  `CVE-2026-62928` · CVE record: Xing Inc. XING CPTrans-ME-X · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Command injection
- [Canva: The Canva Android App before 2.376.0 allowed an external origin to be loaded in a…](https://agentprime.io/advisories/CVE-2026-85085.md)
  `CVE-2026-85085` · CVE record: Canva Canva · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: CWE-940
- [Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter](https://agentprime.io/advisories/CVE-2026-11613.md)
  `CVE-2026-11613` · CVE record: Divi Engine Divi Ajax Filter · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: File inclusion
- [Stack-based buffer overflow in FreeIPMI](https://agentprime.io/advisories/CVE-2026-85509.md)
  `CVE-2026-85509` · CVE record: FreeIPMI FreeIPMI · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in FreeIPMI](https://agentprime.io/advisories/CVE-2026-85508.md)
  `CVE-2026-85508` · CVE record: FreeIPMI FreeIPMI · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in FreeIPMI](https://agentprime.io/advisories/CVE-2026-85507.md)
  `CVE-2026-85507` · CVE record: FreeIPMI FreeIPMI · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in FreeIPMI](https://agentprime.io/advisories/CVE-2026-85506.md)
  `CVE-2026-85506` · CVE record: FreeIPMI FreeIPMI · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in FreeIPMI](https://agentprime.io/advisories/CVE-2026-85504.md)
  `CVE-2026-85504` · CVE record: FreeIPMI FreeIPMI · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Memory corruption
- [Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-85148.md)
  `CVE-2026-85148` · CVE record: Lightstar SmartIT Desktop Manager · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Hard-coded credentials
- [Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-85146.md)
  `CVE-2026-85146` · CVE record: Lightstar SmartIT Desktop Manager · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Hard-coded credentials
- [Missing authentication in ASUS Control Center Enterprise (ACC)](https://agentprime.io/advisories/CVE-2026-75754.md)
  `CVE-2026-75754` · CVE record: ASUS Control Center Enterprise (ACC) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass, Hard-coded credentials, Server-side request forgery (SSRF)
- [No authentication exists in the MQTT service of Trueview 6.0.23.4.](https://agentprime.io/advisories/CVE-2026-79391.md)
  `CVE-2026-79391` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO allows a remote attacker to execute arbitrary code via the Android Debug Bridge (ADB) daemon (adbd)](https://agentprime.io/advisories/CVE-2026-78745.md)
  `CVE-2026-78745` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Broken access control
- [PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication.](https://agentprime.io/advisories/CVE-2026-75431.md)
  `CVE-2026-75431` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Hard-coded credentials
- [PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port.](https://agentprime.io/advisories/CVE-2026-75430.md)
  `CVE-2026-75430` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer](https://agentprime.io/advisories/CVE-2026-75429.md)
  `CVE-2026-75429` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component.](https://agentprime.io/advisories/CVE-2026-75171.md)
  `CVE-2026-75171` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Authentication bypass
- [An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi.](https://agentprime.io/advisories/CVE-2026-75160.md)
  `CVE-2026-75160` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Privilege escalation
- [An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php component](https://agentprime.io/advisories/CVE-2026-71625.md)
  `CVE-2026-71625` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Privilege escalation, CWE-640
- [An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class.php, core/controllers/ETMemberController.class.php, and core/lib/ET.class.php…](https://agentprime.io/advisories/CVE-2026-71624.md)
  `CVE-2026-71624` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Code injection
- [easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and ga…](https://agentprime.io/advisories/CVE-2026-50894.md)
  `CVE-2026-50894` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Unrestricted file upload
- [In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions.](https://agentprime.io/advisories/CVE-2026-31020.md)
  `CVE-2026-31020` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: Code injection
- [SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path](https://agentprime.io/advisories/CVE-2025-67066.md)
  `CVE-2025-67066` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: SQL injection
- [Files accessible to external parties in WebPros ConfigServer Security & Firewall and others](https://agentprime.io/advisories/CVE-2026-67402.md)
  `CVE-2026-67402` · CVE record: WebPros ConfigServer Security & Firewall and 1 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Information disclosure

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA5LTAzVDIzOjU3OjE1Ljg3ODAwMFoiLCJDVkUtMjAyNi02NzQwMiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA5LTA1VDA3OjQzOjU5LjAwMDAwMFoiLCJHSFNBLTIybWctOGd3Ny02MzZ4Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA5LTA1VDA3OjQzOjU5LjAwMDAwMFoiLCJHSFNBLTIybWctOGd3Ny02MzZ4Il0>. Everything for agents: <https://agentprime.io/llms.txt>.