# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [@sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)](https://agentprime.io/advisories/GHSA-955m-rr6m-2f9v.md)
  `GHSA-955m-rr6m-2f9v`, `CVE-2026-76969` · npm `@sap/cds-mtxs`: affected `<1.18.4 || >=2.0.2, <2.7.7 || >=3.0.1, <3.9.7 || >=4.0.1, <4.0.3`, fixed in `1.18.4`, `2.7.7`, `3.9.7`, `4.0.3` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Hard-coded credentials
- [D-Link DIR-822A L2TP Control Message tunnel_set_params out-of-bounds write](https://agentprime.io/advisories/CVE-2026-86510.md)
  `CVE-2026-86510` · CVE record: D-Link DIR-822A · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption
- [D-Link DIR-895L udhcpcd serverpacket.c sendACK stack-based overflow](https://agentprime.io/advisories/CVE-2026-86509.md)
  `CVE-2026-86509` · CVE record: D-Link DIR-895L · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption
- [Improper Access Control in SAP NetWeaver (SAP GUI for Java)](https://agentprime.io/advisories/CVE-2026-66768.md)
  `CVE-2026-66768` · CVE record: SAP_SE SAP NetWeaver (SAP GUI for Java) · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-807
- [Missing Authentication check in SAP NetWeaver (Message Server)](https://agentprime.io/advisories/CVE-2026-58240.md)
  `CVE-2026-58240` · CVE record: SAP_SE SAP NetWeaver (Message Server) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-308
- [Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing](https://agentprime.io/advisories/CVE-2026-44756.md)
  `CVE-2026-44756` · CVE record: SAP_SE SAP Extended Passport (EPP) Processing · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption
- [An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request.](https://agentprime.io/advisories/CVE-2026-79577.md)
  `CVE-2026-79577` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Broken access control
- [An issue in the Single-Sign On (SSO) component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the Admin, without a password.](https://agentprime.io/advisories/CVE-2026-79576.md)
  `CVE-2026-79576` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [An issue in the gateway server of mpush v0.8.1 allows attackers to execute arbitrary code via sending a crafted broadcast message.](https://agentprime.io/advisories/CVE-2026-79574.md)
  `CVE-2026-79574` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [Incorrect access control in the SellerAuthorizeAspect component of springboot-project v1.0.0 allows unauthenticated attackers to access all seller management interfaces and list all products/orders,…](https://agentprime.io/advisories/CVE-2026-79571.md)
  `CVE-2026-79571` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Broken access control
- [mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data.](https://agentprime.io/advisories/CVE-2026-79570.md)
  `CVE-2026-79570` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: SQL injection
- [Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore.](https://agentprime.io/advisories/CVE-2026-79569.md)
  `CVE-2026-79569` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: SQL injection
- [UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context…](https://agentprime.io/advisories/CVE-2026-78997.md)
  `CVE-2026-78997` · CVE record · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [knowns before 0.30.0 Unauthenticated Management API Exposure](https://agentprime.io/advisories/CVE-2026-86543.md)
  `CVE-2026-86543` · CVE record: knowns-dev knowns · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)](https://agentprime.io/advisories/CVE-2026-75650.md)
  `CVE-2026-75650` · CVE record: Adobe Adobe Commerce and 2 more · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.99 · Not analysed yet · Published 7 Sept 2026 · Tags: Code injection
- [Missing authentication in JetBrains Hub](https://agentprime.io/advisories/CVE-2026-86480.md)
  `CVE-2026-86480` · CVE record: JetBrains Hub · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Authentication bypass by spoofing in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-86478.md)
  `CVE-2026-86478` · CVE record: JetBrains YouTrack · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Code Injection in Next4Biz's CSM (Customer Service Management)](https://agentprime.io/advisories/CVE-2026-7861.md)
  `CVE-2026-7861` · CVE record: Next4Biz Information Technologies Inc. CSM (Customer Service Management) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Insecure deserialization
- [389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property](https://agentprime.io/advisories/CVE-2026-18922.md)
  `CVE-2026-18922` · CVE record: Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Execution with unnecessary privileges in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-80238.md)
  `CVE-2026-80238` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Privilege escalation
- [LibreNMS before 26.8.0 Authentication Bypass via API Token Type Confusion](https://agentprime.io/advisories/CVE-2026-86426.md)
  `CVE-2026-86426` · CVE record: librenms librenms · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [OTP Bypass in Bahçelievler Muncipality's BiHayat App](https://agentprime.io/advisories/CVE-2026-6223.md)
  `CVE-2026-6223` · CVE record: Bahçelievler Muncipality BiHayat App · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Missing authorization in Dell Secure Connect Gateway 5.0 - Application and others](https://agentprime.io/advisories/CVE-2026-61410.md)
  `CVE-2026-61410` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Broken access control
- [Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci](https://agentprime.io/advisories/CVE-2026-76578.md)
  `CVE-2026-76578` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection](https://agentprime.io/advisories/CVE-2026-86299.md)
  `CVE-2026-86299` · CVE record: Linksys RE7000 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Command injection
- [D-Link DIR-605 L2TP Control Message tunnel.c tunnel_set_params off-by-one](https://agentprime.io/advisories/CVE-2026-86297.md)
  `CVE-2026-86297` · CVE record: D-Link DIR-605 · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: CWE-189, CWE-193
- [D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflow](https://agentprime.io/advisories/CVE-2026-86296.md)
  `CVE-2026-86296` · CVE record: D-Link DIR-822A · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Memory corruption
- [Advantech WISE-6610-NB Node-RED nodered_lib_apply command injection](https://agentprime.io/advisories/CVE-2026-79698.md)
  `CVE-2026-79698` · CVE record: Advantech WISE-6610-NB and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Other injection, Command injection
- [Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injection](https://agentprime.io/advisories/CVE-2026-79697.md)
  `CVE-2026-79697` · CVE record: Advantech WISE-6610-NB and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Other injection, Command injection
- [Missing authentication in NEC Corporation UNIVERGE IX-R/IX-V](https://agentprime.io/advisories/CVE-2026-16876.md)
  `CVE-2026-16876` · CVE record: NEC Corporation UNIVERGE IX-R/IX-V · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Sept 2026 · Tags: Authentication bypass
- [MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor](https://agentprime.io/advisories/CVE-2026-86304.md)
  `CVE-2026-86304` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Sept 2026 · Tags: Weak cryptography or TLS
- [Negotiate ambient user conn reuse](https://agentprime.io/advisories/CVE-2026-19931.md)
  `CVE-2026-19931` · CVE record: curl curl · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Sept 2026 · Tags: CWE-488
- [HTTP/2 server push UAF](https://agentprime.io/advisories/CVE-2026-18924.md)
  `CVE-2026-18924` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Sept 2026 · Tags: Memory corruption
- [Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step](https://agentprime.io/advisories/CVE-2026-86219.md)
  `CVE-2026-86219` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Sept 2026 · Tags: Authentication bypass
- [OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation](https://agentprime.io/advisories/CVE-2026-86259.md)
  `CVE-2026-86259` · CVE record: THU-MAIC OpenMAIC · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Sept 2026 · Tags: Authentication bypass, Server-side request forgery (SSRF)
- [Tenda HG10 Boa formgponConf os command injection](https://agentprime.io/advisories/CVE-2026-86167.md)
  `CVE-2026-86167` · CVE record: Tenda HG10 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Sept 2026 · Tags: Command injection
- [Tenda HG10 formURL buffer overflow](https://agentprime.io/advisories/CVE-2026-86165.md)
  `CVE-2026-86165` · CVE record: Tenda HG10 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Sept 2026 · Tags: Memory corruption
- [Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '\_acf_objects' Object Identifier](https://agentprime.io/advisories/CVE-2026-75816.md)
  `CVE-2026-75816` · CVE record: shabti Frontend Admin by DynamiApps · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Sept 2026 · Tags: Authentication bypass
- [MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter](https://agentprime.io/advisories/CVE-2026-16310.md)
  `CVE-2026-16310` · CVE record: LearnDash MemberDash · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Sept 2026 · Tags: Broken access control
- [pre-authentication remote code execution](https://agentprime.io/advisories/CVE-2026-86218.md)
  `CVE-2026-86218` · CVE record: N-able N-central · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.15 · Not analysed yet · Published 6 Sept 2026 · Tags: Code injection
- [Tenda CP3 Redirect.cpp SetRedirectEnable privileges management](https://agentprime.io/advisories/CVE-2026-86153.md)
  `CVE-2026-86153` · CVE record: Tenda CP3 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Sept 2026 · Tags: Privilege escalation
- [Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injection](https://agentprime.io/advisories/CVE-2026-86152.md)
  `CVE-2026-86152` · CVE record: Tenda CP3 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Sept 2026 · Tags: Command injection
- [Tenda CP3 Network Configuration Management system.c sub_2F77E8 os command injection](https://agentprime.io/advisories/CVE-2026-86151.md)
  `CVE-2026-86151` · CVE record: Tenda CP3 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Command injection
- [Tenda CP3 NetCheckPing.cpp os command injection](https://agentprime.io/advisories/CVE-2026-86149.md)
  `CVE-2026-86149` · CVE record: Tenda CP3 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Command injection
- [Tenda CP3 Kylin system.c SystemAsh os command injection](https://agentprime.io/advisories/CVE-2026-86148.md)
  `CVE-2026-86148` · CVE record: Tenda CP3 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Command injection
- [SSH session privilege manipulation via a crafted username in Mikrotik RouterOS](https://agentprime.io/advisories/CVE-2026-86060.md)
  `CVE-2026-86060` · CVE record: Mikrotik RouterOS · CVSS 9.2 Critical · Critical (KEV, CVSS 9+) · In CISA KEV · Not analysed yet · Published 5 Sept 2026 · Tags: Command injection
- [SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS](https://agentprime.io/advisories/CVE-2026-67279.md)
  `CVE-2026-67279` · CVE record: Mikrotik RouterOS · CVSS 6.9 Medium · Critical (KEV) · In CISA KEV · Not analysed yet · Published 5 Sept 2026 · Tags: CWE-841
- [Kernel memory disclosure and denial of service in MikroTik RouterOS btest service](https://agentprime.io/advisories/CVE-2026-67277.md)
  `CVE-2026-67277` · CVE record: Mikrotik RouterOS · CVSS 8.8 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 5 Sept 2026 · Tags: Authentication bypass
- [SSH user impersonation possible in Mikrotik RouterOS](https://agentprime.io/advisories/CVE-2026-67276.md)
  `CVE-2026-67276` · CVE record: Mikrotik RouterOS · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Weak cryptography or TLS
- [WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter](https://agentprime.io/advisories/CVE-2026-86190.md)
  `CVE-2026-86190` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Information disclosure
- [WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php](https://agentprime.io/advisories/CVE-2026-86189.md)
  `CVE-2026-86189` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Path traversal
- [Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route](https://agentprime.io/advisories/CVE-2026-86184.md)
  `CVE-2026-86184` · CVE record: laradashboard laradashboard · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Authentication bypass
- [Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields](https://agentprime.io/advisories/CVE-2026-10196.md)
  `CVE-2026-10196` · CVE record: getwpfunnels Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Insecure deserialization
- [AutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command Server](https://agentprime.io/advisories/CVE-2026-86124.md)
  `CVE-2026-86124` · CVE record: HKUDS AutoAgent · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Authentication bypass
- [SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpoints](https://agentprime.io/advisories/CVE-2026-86123.md)
  `CVE-2026-86123` · CVE record: sqlchat sqlchat · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control](https://agentprime.io/advisories/CVE-2026-86121.md)
  `CVE-2026-86121` · CVE record: trycua cua-computer-server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Authentication bypass
- [Webstudio through 0.296.0 SSRF via /cgi proxy routes](https://agentprime.io/advisories/CVE-2026-86119.md)
  `CVE-2026-86119` · CVE record: webstudio-is webstudio · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching](https://agentprime.io/advisories/CVE-2026-86117.md)
  `CVE-2026-86117` · CVE record: coollabsio coolify · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Authentication bypass
- [Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection](https://agentprime.io/advisories/CVE-2024-11080.md)
  `CVE-2024-11080` · CVE record: pickplugins Post Grid · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Code injection
- [Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator](https://agentprime.io/advisories/GHSA-22mg-8gw7-636x.md)
  `GHSA-22mg-8gw7-636x`, `PYSEC-2026-4009` · PyPI `local-operator`: affected `<0.47.5`, fixed in `0.47.5` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2026 · Tags: Path traversal

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA5LTA1VDA3OjQzOjU5LjAwMDAwMFoiLCJHSFNBLTIybWctOGd3Ny02MzZ4Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA5LTA4VDA3OjQ3OjI4LjY0ODAwMFoiLCJDVkUtMjAyNi03MTM3NCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA5LTA4VDA3OjQ3OjI4LjY0ODAwMFoiLCJDVkUtMjAyNi03MTM3NCJd>. Everything for agents: <https://agentprime.io/llms.txt>.