# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-87504.md)
  `CVE-2026-87504` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-87474.md)
  `CVE-2026-87474` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-87581.md)
  `CVE-2026-87581` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-87558.md)
  `CVE-2026-87558` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-87607.md)
  `CVE-2026-87607` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Memory corruption
- [Improper array index validation in Google Chrome](https://agentprime.io/advisories/CVE-2026-87500.md)
  `CVE-2026-87500` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: CWE-129
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-87646.md)
  `CVE-2026-87646` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds write in Google Chrome](https://agentprime.io/advisories/CVE-2026-87621.md)
  `CVE-2026-87621` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Memory corruption
- [Heap-based buffer overflow in Google Chrome](https://agentprime.io/advisories/CVE-2026-87654.md)
  `CVE-2026-87654` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds read in Google Chrome](https://agentprime.io/advisories/CVE-2026-87650.md)
  `CVE-2026-87650` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-87520.md)
  `CVE-2026-87520` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Memory corruption
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-87492.md)
  `CVE-2026-87492` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Broken access control
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-87512.md)
  `CVE-2026-87512` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Memory corruption
- [Heap-based buffer overflow in Google Chrome](https://agentprime.io/advisories/CVE-2026-87527.md)
  `CVE-2026-87527` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds write in Google Chrome](https://agentprime.io/advisories/CVE-2026-87438.md)
  `CVE-2026-87438` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-87488.md)
  `CVE-2026-87488` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-87464.md)
  `CVE-2026-87464` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Memory corruption
- [An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0.](https://agentprime.io/advisories/CVE-2026-71805.md)
  `CVE-2026-71805` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Unrestricted file upload
- [An issue was discovered in s-pms SPMS-Server through v1.0.](https://agentprime.io/advisories/CVE-2026-71801.md)
  `CVE-2026-71801` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Hard-coded credentials
- [An issue in Actions Semiconductor Co.](https://agentprime.io/advisories/CVE-2026-36433.md)
  `CVE-2026-36433` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Sept 2026 · Tags: Code injection
- [OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption](https://agentprime.io/advisories/CVE-2026-53939.md)
  `CVE-2026-53939` · CVE record: OpenIDC cjose · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Hard-coded credentials, Weak cryptography or TLS
- [ntp: write path traversal](https://agentprime.io/advisories/CVE-2026-53581.md)
  `CVE-2026-53581` · CVE record: opnsense core · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal
- [Astro: Remote code execution through AVIF image optimization](https://agentprime.io/advisories/GHSA-26w7-cxv4-gfx2.md)
  `GHSA-26w7-cxv4-gfx2` · npm `astro`: affected `<7.2.8`, fixed in `7.2.8` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption
- [Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections](https://agentprime.io/advisories/GHSA-w6f5-v2h6-g786.md)
  `GHSA-w6f5-v2h6-g786`, `CVE-2026-84372`, `PKSA-z888-whwt-brbj` · Packagist `predis/predis`: affected `>=3.0.0-RC1, <3.3.0`, fixed in `3.3.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Other injection
- [CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver](https://agentprime.io/advisories/GHSA-fxf7-vhh8-7vpq.md)
  `GHSA-fxf7-vhh8-7vpq`, `CVE-2026-77635`, `PKSA-d2h7-11vv-v66p`, `PKSA-xyyq-wf7k-89mv` · Packagist `cakephp/cakephp` and 1 more: affected `>=5.1.0, <5.1.10 || >=5.2.0, <5.2.15 || >=5.3.0, <5.3.7`, fixed in `5.1.10`, `5.2.15`, `5.3.7` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: SQL injection
- [Next.js: Unauthenticated Remote Code Execution on windows-hosted servers](https://agentprime.io/advisories/GHSA-p293-qw3h-jr36.md)
  `GHSA-p293-qw3h-jr36`, `CVE-2026-75604` · npm `next`: affected `>=13.4.0, <15.5.24 || >=16.0.0, <16.3.3`, fixed in `15.5.24`, `16.3.3` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal
- [MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip](https://agentprime.io/advisories/GHSA-jrc7-96c5-q579.md)
  `GHSA-jrc7-96c5-q579`, `CVE-2026-85061` · npm `maplibre-gl`: affected `<6.4.1`, fixed in `6.4.1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Microsoft QUIC: Remote Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-92f5-vc22-8j33.md)
  `GHSA-92f5-vc22-8j33`, `CVE-2026-62815` · NuGet `Microsoft.Native.Quic.MsQuic.OpenSSL` and 1 more: affected `<2.4.19 || >=2.5.3, <2.5.10`, fixed in `2.4.19`, `2.5.10` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption
- [Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector](https://agentprime.io/advisories/CVE-2026-85982.md)
  `CVE-2026-85982` · CVE record: Auth0 Auth0 AD/LDAP Connector · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Improper certificate validation in Eclipse Foundation Eclipse Ditto](https://agentprime.io/advisories/CVE-2026-84197.md)
  `CVE-2026-84197` · CVE record: Eclipse Foundation Eclipse Ditto · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Weak cryptography or TLS, CWE-300
- [Adobe Experience Manager | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-19232.md)
  `CVE-2026-19232` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Broken access control
- [Information disclosure in Eclipse Foundation Eclipse aeriOS](https://agentprime.io/advisories/CVE-2026-86464.md)
  `CVE-2026-86464` · CVE record: Eclipse Foundation Eclipse aeriOS · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Information disclosure, Authentication bypass, Hard-coded credentials, CWE-1188
- [ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-75746.md)
  `CVE-2026-75746` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: SQL injection
- [ColdFusion | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)](https://agentprime.io/advisories/CVE-2026-48273.md)
  `CVE-2026-48273` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions](https://agentprime.io/advisories/CVE-2026-84869.md)
  `CVE-2026-84869` · CVE record: ConnectWise ScreenConnect · CVSS 9.9 Critical · Critical (KEV, CVSS 9+) · In CISA KEV · Not analysed yet · Published 8 Sept 2026 · Tags: Privilege escalation, Broken access control
- [Improper privilege management in Google Android XR](https://agentprime.io/advisories/CVE-2026-28659.md)
  `CVE-2026-28659` · CVE record: Google Android XR · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Privilege escalation
- [Improper privilege management in Google Android Wear](https://agentprime.io/advisories/CVE-2026-49883.md)
  `CVE-2026-49883` · CVE record: Google Android Wear · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Privilege escalation
- [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)](https://agentprime.io/advisories/CVE-2026-82004.md)
  `CVE-2026-82004` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Command injection
- [GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE](https://agentprime.io/advisories/GHSA-284h-m62q-gf8w.md)
  `GHSA-284h-m62q-gf8w`, `CVE-2026-78676`, `PYSEC-2026-3786` · PyPI `gitpython`: affected `<3.1.59`, fixed in `3.1.59` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Command injection, Code injection
- [DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API](https://agentprime.io/advisories/GHSA-8m2g-8cgm-3vcp.md)
  `GHSA-8m2g-8cgm-3vcp`, `CVE-2026-82533` · npm `@deepseek-ai/dsh-client-connection`: affected `<0.1.2-alpha.1`, fixed in `0.1.2-alpha.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-807
- [Skype for Business Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-66302.md)
  `CVE-2026-66302` · CVE record: Microsoft Skype for Business Server 2015 CU13 and 2 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal
- [Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext](https://agentprime.io/advisories/GHSA-c4c3-7fpv-j4q5.md)
  `GHSA-c4c3-7fpv-j4q5`, `CVE-2026-75595` · Maven `io.netty:netty-handler`: affected `>=4.2.0.Final, <4.2.17.Final || <4.1.137.Final`, fixed in `4.2.17.Final`, `4.1.137.Final` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-475, CWE-754
- [Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-76200.md)
  `CVE-2026-76200` · CVE record: Adobe Adobe Commerce and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-76201.md)
  `CVE-2026-76201` · CVE record: Adobe Adobe Commerce and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Incorrect type conversion in Google Android](https://agentprime.io/advisories/CVE-2026-58822.md)
  `CVE-2026-58822` · CVE record: Google Android · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-704
- [Heap-based buffer overflow in Google Android](https://agentprime.io/advisories/CVE-2026-49921.md)
  `CVE-2026-49921` · CVE record: Google Android · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption
- [Improper authentication in Google Android](https://agentprime.io/advisories/CVE-2026-28606.md)
  `CVE-2026-28606` · CVE record: Google Android · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Semaphore U: OS Command Injection](https://agentprime.io/advisories/GHSA-xp7j-h7jc-4w8p.md)
  `GHSA-xp7j-h7jc-4w8p`, `CVE-2026-73294`, `CVE-2026-73682`, `GO-2026-6435` · Go `github.com/semaphoreui/semaphore`: affected `<0.0.0-20260704181911-7e8a9434bd81`, fixed in `0.0.0-20260704181911-7e8a9434bd81` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Command injection
- [Gitea: Remote Code Execution via diffpatch Git Hook Installation](https://agentprime.io/advisories/GHSA-rcr6-4jqh-j84m.md)
  `GHSA-rcr6-4jqh-j84m`, `BIT-gitea-2026-60004`, `CVE-2026-60004`, `GO-2026-6433` · Go `gitea.dev`: affected `>=1.17.0, <1.27.1`, fixed in `1.27.1` · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.24 · Not analysed yet · Published 8 Sept 2026 · Tags: Code injection
- [SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked](https://agentprime.io/advisories/GHSA-v684-q882-jgmq.md)
  `GHSA-v684-q882-jgmq`, `CVE-2026-72789`, `GO-2026-6434` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260726020813-a25c2dd06aae`, fixed in `0.0.0-20260726020813-a25c2dd06aae` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Broken access control
- [Windows Update Stack Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-81963.md)
  `CVE-2026-81963` · CVE record: Microsoft Windows 11 version 23H2 and 4 more · CVSS 7.8 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 8 Sept 2026 · Tags: Path traversal, Broken access control
- [Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-69595.md)
  `CVE-2026-69595` · CVE record: Microsoft Windows Server 2012 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption
- [Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-78445.md)
  `CVE-2026-78445` · CVE record: Microsoft Windows Server 2012 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption
- [Spring Cloud Azure Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69854.md)
  `CVE-2026-69854` · CVE record: Microsoft Spring Cloud Azure · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Windows iSCSI Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-73025.md)
  `CVE-2026-73025` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Authentication bypass
- [Microsoft Failover Cluster Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-73010.md)
  `CVE-2026-73010` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption
- [Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-73009.md)
  `CVE-2026-73009` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption
- [Windows Imaging Component Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-70296.md)
  `CVE-2026-70296` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption
- [Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-69590.md)
  `CVE-2026-69590` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption
- [Windows Hyper-V Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-69910.md)
  `CVE-2026-69910` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2026 · Tags: Memory corruption

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA5LTA4VDE3OjE3OjE4Ljg0NzAwMFoiLCJDVkUtMjAyNi02OTkxMCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA5LTA5VDAwOjA5OjM4LjQxOTAwMFoiLCJDVkUtMjAyNi04NzQ5MSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA5LTA5VDAwOjA5OjM4LjQxOTAwMFoiLCJDVkUtMjAyNi04NzQ5MSJd>. Everything for agents: <https://agentprime.io/llms.txt>.