# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [SQL Injection in Teracity Sotware's Teracity E-OSB Platform](https://agentprime.io/advisories/CVE-2026-18765.md)
  `CVE-2026-18765` · CVE record: Teracity Software Technologies Inc. E-OSB · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: SQL injection
- [Insecure Direct Object Reference Vulnerability in Manacle Technologies ERP System](https://agentprime.io/advisories/CVE-2026-84148.md)
  `CVE-2026-84148` · CVE record: Manacle Technologies Multi-tenant ERP System · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Remote Code Execution Vulnerability in Manacle Technologies ERP System](https://agentprime.io/advisories/CVE-2026-84147.md)
  `CVE-2026-84147` · CVE record: Manacle Technologies Multi-tenant ERP System · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Unrestricted file upload
- [Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15](https://agentprime.io/advisories/CVE-2026-84143.md)
  `CVE-2026-84143` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure
- [Internally found bugs fixed in Thunderbird 155](https://agentprime.io/advisories/CVE-2026-84142.md)
  `CVE-2026-84142` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure
- [Integer overflow in the Graphics: ImageLib component](https://agentprime.io/advisories/CVE-2026-84141.md)
  `CVE-2026-84141` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Site isolation issue in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-84140.md)
  `CVE-2026-84140` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-346
- [Clickjacking issue in the DOM: Events component](https://agentprime.io/advisories/CVE-2026-84139.md)
  `CVE-2026-84139` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-1021
- [Spoofing issue in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-84137.md)
  `CVE-2026-84137` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-451
- [Other issue in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-84136.md)
  `CVE-2026-84136` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure
- [Other issue in Firefox Focus for Android](https://agentprime.io/advisories/CVE-2026-84135.md)
  `CVE-2026-84135` · CVE record: Mozilla Firefox · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure
- [Other issue in the Profile Backup component](https://agentprime.io/advisories/CVE-2026-84134.md)
  `CVE-2026-84134` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Information disclosure
- [Site isolation issue in the DOM: Push Subscriptions component](https://agentprime.io/advisories/CVE-2026-84133.md)
  `CVE-2026-84133` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-346
- [Site isolation issue in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-84129.md)
  `CVE-2026-84129` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-346
- [Sandbox escape due to use-after-free in the DOM: Security component](https://agentprime.io/advisories/CVE-2026-84121.md)
  `CVE-2026-84121` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Sandbox escape due to use-after-free in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-84119.md)
  `CVE-2026-84119` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter](https://agentprime.io/advisories/CVE-2026-18550.md)
  `CVE-2026-18550` · CVE record: scriptsbundle Nokri – Job Board WordPress Theme · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Privilege escalation
- [Code injection in the Lutece Core](https://agentprime.io/advisories/CVE-2026-4813.md)
  `CVE-2026-4813` · CVE record: Lutece Lutece Core · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Code injection
- [TOCTOU Vulnerability in file exchange](https://agentprime.io/advisories/CVE-2026-78319.md)
  `CVE-2026-78319` · CVE record: Sauter modu680-AS and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Race condition
- [Cobham SATCOM VSAT7090 Maritime Satellite Router JSON Parsing mail-report.sh c_set_reports_decode command injection](https://agentprime.io/advisories/CVE-2026-83772.md)
  `CVE-2026-83772` · CVE record: Cobham SATCOM VSAT7090 Maritime Satellite Router · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Other injection, Command injection
- [WPLP Cookie Consent <= 4.4.1 - Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint](https://agentprime.io/advisories/CVE-2026-75865.md)
  `CVE-2026-75865` · CVE record: wplegalpages WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Unrestricted file upload
- [OS command injection in WebPros Plesk](https://agentprime.io/advisories/CVE-2026-67394.md)
  `CVE-2026-67394` · CVE record: WebPros Plesk · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Command injection
- [An issue in fast-note-sync-service <=2.13.7 allows a remote attacker to escalate privileges via the admin configuration endpoint exposes authTokenKey](https://agentprime.io/advisories/CVE-2026-52111.md)
  `CVE-2026-52111` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Buffer Overflow vulnerability in Shenzhen Jixiang Tengda Technology Co., Ltd.](https://agentprime.io/advisories/CVE-2026-51934.md)
  `CVE-2026-51934` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forward attacker-controlled QoS settings to the master via send…](https://agentprime.io/advisories/CVE-2026-51770.md)
  `CVE-2026-51770` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted…](https://agentprime.io/advisories/CVE-2026-51769.md)
  `CVE-2026-51769` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Incorrect access control in the recvClearPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset pairing state and reboot the device via sending a crafted MQTT…](https://agentprime.io/advisories/CVE-2026-51767.md)
  `CVE-2026-51767` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to insert or replace mesh neighbor records via sending a crafted MQ…](https://agentprime.io/advisories/CVE-2026-51765.md)
  `CVE-2026-51765` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite cloud-result tracking files via sending a crafted…](https://agentprime.io/advisories/CVE-2026-51764.md)
  `CVE-2026-51764` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message…](https://agentprime.io/advisories/CVE-2026-51763.md)
  `CVE-2026-51763` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state and trigger regeneration of m…](https://agentprime.io/advisories/CVE-2026-51762.md)
  `CVE-2026-51762` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending…](https://agentprime.io/advisories/CVE-2026-51760.md)
  `CVE-2026-51760` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start a firmware download or flash workflow on the slave device via s…](https://agentprime.io/advisories/CVE-2026-51757.md)
  `CVE-2026-51757` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT m…](https://agentprime.io/advisories/CVE-2026-51754.md)
  `CVE-2026-51754` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove a specified slave device from local mesh management data and re…](https://agentprime.io/advisories/CVE-2026-51751.md)
  `CVE-2026-51751` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rescan and switch the primary mesh channel via sending a crafted MQT…](https://agentprime.io/advisories/CVE-2026-51750.md)
  `CVE-2026-51750` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to emit indirect mesh heartbeat information toward the master via sending a cr…](https://agentprime.io/advisories/CVE-2026-51747.md)
  `CVE-2026-51747` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to force mesh configuration synchronization from an attacker-control…](https://agentprime.io/advisories/CVE-2026-51744.md)
  `CVE-2026-51744` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Incorrect access control in the guest_wifi_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to disable guest virtual AP interfaces via sending a crafted MQTT messag…](https://agentprime.io/advisories/CVE-2026-51743.md)
  `CVE-2026-51743` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase diagnosis logs via sending a crafted POST request to /cgi-bin…](https://agentprime.io/advisories/CVE-2026-51741.md)
  `CVE-2026-51741` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [RedPort Optimizer wXa-223 System Clock datetime.php exec command injection](https://agentprime.io/advisories/CVE-2026-83524.md)
  `CVE-2026-83524` · CVE record: RedPort Optimizer wXa-203 and 2 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, Command injection
- [QVidium Opera11 CGI Script net_tr.cgi command injection](https://agentprime.io/advisories/CVE-2026-82971.md)
  `CVE-2026-82971` · CVE record: QVidium Opera11 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Other injection, Command injection
- [Dokploy Settings application.ts writeTraefikConfigInPath path traversal](https://agentprime.io/advisories/CVE-2026-82954.md)
  `CVE-2026-82954` · CVE record: Dokploy · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Path traversal
- [WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability](https://agentprime.io/advisories/CVE-2026-81779.md)
  `CVE-2026-81779` · CVE record: Silk Themes Newspapers X · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: CWE-1284
- [WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-82226.md)
  `CVE-2026-82226` · CVE record: Tickera Tickera · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Insecure deserialization
- [WordPress Hash Form plugin <= 1.4.2 - Arbitrary File Upload vulnerability](https://agentprime.io/advisories/CVE-2026-81780.md)
  `CVE-2026-81780` · CVE record: hashthemes Hash Form · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Unrestricted file upload
- [WordPress Throws SPAM Away plugin <= 3.8.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-81763.md)
  `CVE-2026-81763` · CVE record: ウェブ屋のさとーさん Throws SPAM Away · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: SQL injection
- [WordPress Smart Marketing SMS and Newsletters Forms plugin <= 5.1.24 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-81756.md)
  `CVE-2026-81756` · CVE record: Autorius E-goi Smart Marketing SMS and Newsletters Forms · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: SQL injection
- [WordPress WP Data Access plugin <= 5.5.81 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-81293.md)
  `CVE-2026-81293` · CVE record: Passionate Programmer Peter WP Data Access · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: SQL injection
- [MSI Dragon Center MMIO Write Path NTIOLib_X64.sys MmioWritePath integer overflow](https://agentprime.io/advisories/CVE-2026-82908.md)
  `CVE-2026-82908` · CVE record: MSI Dragon Center · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Memory corruption, CWE-189
- [MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)](https://agentprime.io/advisories/CVE-2026-79748.md)
  `CVE-2026-79748` · CVE record: samanhappy mcphub · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Broken access control
- [ieungSoft Ultra RAMDisk Pro Kernel Driver URDSCSI.sys privileges management](https://agentprime.io/advisories/CVE-2026-82807.md)
  `CVE-2026-82807` · CVE record: ieungSoft Ultra RAMDisk Pro · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Privilege escalation
- [Ebyte NA111-M Use of a Broken or Risky Cryptographic Algorithm](https://agentprime.io/advisories/CVE-2026-76133.md)
  `CVE-2026-76133` · CVE record: Ebyte Ebyte NA111-M Firmware · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Weak cryptography or TLS
- [Ebyte NA111-M Weak Authentication](https://agentprime.io/advisories/CVE-2026-73819.md)
  `CVE-2026-73819` · CVE record: Ebyte Ebyte NA111-M Firmware · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Authentication bypass
- [ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE](https://agentprime.io/advisories/CVE-2026-66047.md)
  `CVE-2026-66047` · CVE record: Proper Fraction ProfilePress · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerability](https://agentprime.io/advisories/CVE-2026-82970.md)
  `CVE-2026-82970` · CVE record: WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Unrestricted file upload
- [Command Injection vulnerability in eObčanka-Identifikace](https://agentprime.io/advisories/CVE-2026-59111.md)
  `CVE-2026-59111` · CVE record: Ministry of the Interior (MVČR) eObčanka-Identifikace · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Command injection
- [Tenda AC18 Telnet telnet missing authentication](https://agentprime.io/advisories/CVE-2026-82695.md)
  `CVE-2026-82695` · CVE record: Tenda AC18 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Authentication bypass
- [Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authentication](https://agentprime.io/advisories/CVE-2026-82694.md)
  `CVE-2026-82694` · CVE record: Tenda AC1206 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Authentication bypass
- [Tenda AC1206 Web UI telnet TendaTelnet missing authentication](https://agentprime.io/advisories/CVE-2026-82693.md)
  `CVE-2026-82693` · CVE record: Tenda AC1206 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Aug 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA4LTMxVDEyOjE1OjEyLjE5MzAwMFoiLCJDVkUtMjAyNi04MjY5MyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA5LTAxVDEyOjQ0OjE3Ljg1NTAwMFoiLCJDVkUtMjAyNi04NDE0OSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA5LTAxVDEyOjQ0OjE3Ljg1NTAwMFoiLCJDVkUtMjAyNi04NDE0OSJd>. Everything for agents: <https://agentprime.io/llms.txt>.