# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Multiple vulnerabilities in Ocsreports for OCS Inventory NG](https://agentprime.io/advisories/CVE-2026-76178.md)
  `CVE-2026-76178` · CVE record: OCS Inventory NG Ocsreports · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Multiple vulnerabilities in Ocsreports for OCS Inventory NG](https://agentprime.io/advisories/CVE-2026-76174.md)
  `CVE-2026-76174` · CVE record: OCS Inventory NG Ocsreports · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Unrestricted file upload
- [TOTOLINK CP450 cstecgi.cgi buffer overflow](https://agentprime.io/advisories/CVE-2026-85031.md)
  `CVE-2026-85031` · CVE record: TOTOLINK CP450 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Memory corruption
- [OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs](https://agentprime.io/advisories/GHSA-qh9r-j7rp-4x2m.md)
  `GHSA-qh9r-j7rp-4x2m`, `CVE-2026-73843`, `GO-2026-6362` · Go `github.com/openchoreo/openchoreo`: affected `<1.0.2 || >=1.1.0, <1.1.2`, fixed in `1.0.2`, `1.1.2` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass, Information disclosure, Broken access control
- [Centrifugo: Client-forgeable headers emulation lets any client spoof headers forwarded to proxy backends](https://agentprime.io/advisories/GHSA-9468-v6mj-fppw.md)
  `GHSA-9468-v6mj-fppw`, `CVE-2026-71485`, `GO-2026-6490` · Go `github.com/centrifugal/centrifugo`: affected `<6.9.0`, fixed in `6.9.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge](https://agentprime.io/advisories/GHSA-7mgc-c7pq-3rr3.md)
  `GHSA-7mgc-c7pq-3rr3`, `CVE-2026-62232`, `CVE-2026-62669`, `PKSA-p6yn-thc9-dbs3` · Packagist `getgrav/grav`: affected `<2.0.4`, fixed in `2.0.4` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass, Broken access control
- [Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE](https://agentprime.io/advisories/GHSA-jrrm-9hc7-2v3h.md)
  `GHSA-jrrm-9hc7-2v3h`, `CVE-2026-62674`, `PYSEC-2026-3874` · PyPI `omnigent`: affected `<0.3.0`, fixed in `0.3.0` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Code injection
- [Delinea Secret Server FIDO2 credential registration authentication bypass vulnerability](https://agentprime.io/advisories/CVE-2026-19117.md)
  `CVE-2026-19117` · CVE record: Delinea Secret Server (On-Prem) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets](https://agentprime.io/advisories/CVE-2026-66786.md)
  `CVE-2026-66786` · CVE record: Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.16 and 2 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Code injection
- [PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification](https://agentprime.io/advisories/CVE-2026-53670.md)
  `CVE-2026-53670` · CVE record: vbpf prevail · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-682
- [PREVAIL: Context-write no-op in do_mem_store allows unsafe eBPF programs to pass verification](https://agentprime.io/advisories/CVE-2026-53671.md)
  `CVE-2026-53671` · CVE record: vbpf prevail · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-682
- [Cisco IOS XR Software Security Hardening Release: September 2026](https://agentprime.io/advisories/CVE-2026-20279.md)
  `CVE-2026-20279` · CVE record: Cisco Cisco IOS XR Software · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Broken access control
- [Cisco IOS XR Software Security Hardening Release: September 2026](https://agentprime.io/advisories/CVE-2026-20274.md)
  `CVE-2026-20274` · CVE record: Cisco Cisco IOS XR Software · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-664
- [Cisco Nexus 3000 and 9000 Series Switches Silicon One Hardware Abstraction Layer Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-20212.md)
  `CVE-2026-20212` · CVE record: Cisco Cisco NX-OS Software · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-1327
- [Looking Glass: Remote Code Execution via Unanchored Regular Expression in BGPASPath Input Validation](https://agentprime.io/advisories/CVE-2026-53611.md)
  `CVE-2026-53611` · CVE record: AS203038 looking-glass · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Command injection
- [NGINX ngx_http_js_module vulnerablility](https://agentprime.io/advisories/CVE-2026-78689.md)
  `CVE-2026-78689` · CVE record: F5 NGINX JavaScript · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Memory corruption
- [Orval: Import-time RCE via query-parameter default -> zod module-level template literal](https://agentprime.io/advisories/GHSA-p4cg-3328-rvfg.md)
  `GHSA-p4cg-3328-rvfg`, `CVE-2026-72716` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Code injection
- [Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client](https://agentprime.io/advisories/GHSA-6mr6-jvcr-2f25.md)
  `GHSA-6mr6-jvcr-2f25`, `CVE-2026-71866` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: SQL injection, Code injection
- [SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control](https://agentprime.io/advisories/GHSA-2v6v-25fm-p4fg.md)
  `GHSA-2v6v-25fm-p4fg`, `BIT-seaweedfs-2026-72920`, `CVE-2026-72920`, `GO-2026-6351` · Go `github.com/seaweedfs/seaweedfs`: affected `<0.0.0-20260512171108-5e8f99f40a8a`, fixed in `0.0.0-20260512171108-5e8f99f40a8a` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [Improper certificate validation in Eclipse Foundation Eclipse aeriOS](https://agentprime.io/advisories/CVE-2026-82955.md)
  `CVE-2026-82955` · CVE record: Eclipse Foundation Eclipse aeriOS · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Weak cryptography or TLS
- [Developer Tools <= 1.1.3 – Unauthenticated Arbitrary File Upload](https://agentprime.io/advisories/CVE-2025-9314.md)
  `CVE-2025-9314` · CVE record: Unknown Developer Tools · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Unrestricted file upload
- [WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console](https://agentprime.io/advisories/CVE-2026-77009.md)
  `CVE-2026-77009` · CVE record: Unknown WatchMan-Site7 · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Code injection
- [Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload](https://agentprime.io/advisories/CVE-2026-4357.md)
  `CVE-2026-4357` · CVE record: Unknown Embed HTML5 Game · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Unrestricted file upload
- [Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095](https://agentprime.io/advisories/CVE-2026-73475.md)
  `CVE-2026-73475` · CVE record: Drupal Commerce PayPal · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Broken access control
- [WordPress Authorizer plugin <= 3.15.1 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-81294.md)
  `CVE-2026-81294` · CVE record: Paul Ryan Authorizer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Privilege escalation
- [WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-81286.md)
  `CVE-2026-81286` · CVE record: WC Lovers WCFM Marketplace · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: SQL injection
- [Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance](https://agentprime.io/advisories/CVE-2026-84795.md)
  `CVE-2026-84795` · CVE record: craftcms cms · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Privilege escalation
- [SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field](https://agentprime.io/advisories/CVE-2026-78657.md)
  `CVE-2026-78657` · CVE record: bdthemes SigmaForms Pro – AI Generated Forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Path traversal
- [Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'](https://agentprime.io/advisories/CVE-2026-9055.md)
  `CVE-2026-9055` · CVE record: melograno Booking for Appointments and Events Calendar – Amelia · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Privilege escalation
- [Team Password Manager before 14.184.308 Authentication Bypass in Password Reset](https://agentprime.io/advisories/CVE-2026-84699.md)
  `CVE-2026-84699` · CVE record: Team Password Manager Team Password Manager · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-640
- [Phison PS3111-S11 Controller Firmware Missing Authentication on Vendor Unique Commands](https://agentprime.io/advisories/CVE-2026-84696.md)
  `CVE-2026-84696` · CVE record: Phison Electronics Corporation PS3111-S11 Controller Firmware · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Authentication bypass
- [BookStack before 26.05.4 Stored XSS via Drawing Upload](https://agentprime.io/advisories/CVE-2026-84695.md)
  `CVE-2026-84695` · CVE record: bookstackapp bookstack · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Improper input validation in Google Chrome](https://agentprime.io/advisories/CVE-2026-84325.md)
  `CVE-2026-84325` · CVE record: Google Chrome · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-20
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-84333.md)
  `CVE-2026-84333` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-84324.md)
  `CVE-2026-84324` · CVE record: Google Chrome · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-84354.md)
  `CVE-2026-84354` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-84352.md)
  `CVE-2026-84352` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-84353.md)
  `CVE-2026-84353` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [WWBN AVideo Password Recovery Token Expiration Bypass](https://agentprime.io/advisories/CVE-2026-84480.md)
  `CVE-2026-84480` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [WWBN AVideo Authentication Bypass via User-Agent Header](https://agentprime.io/advisories/CVE-2026-84479.md)
  `CVE-2026-84479` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter](https://agentprime.io/advisories/CVE-2023-54391.md)
  `CVE-2023-54391` · CVE record: Proxmox Server Solutions GmbH Proxmox Virtual Environment (VE) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Uninitialized memory in MIME parsing](https://agentprime.io/advisories/CVE-2026-84639.md)
  `CVE-2026-84639` · CVE record: Mozilla Thunderbird · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [OS command injection in SonicWall SMA1000](https://agentprime.io/advisories/CVE-2026-83549.md)
  `CVE-2026-83549` · CVE record: SonicWall SMA1000 · CVSS 7.8 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 1 Sept 2026 · Tags: Command injection
- [Server-side request forgery in SonicWall SMA1000](https://agentprime.io/advisories/CVE-2026-83548.md)
  `CVE-2026-83548` · CVE record: SonicWall SMA1000 · CVSS 10.0 Critical · Critical (KEV, CVSS 9+) · In CISA KEV · Not analysed yet · Published 1 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-441
- [Calendar invitation attachments could launch local executables](https://agentprime.io/advisories/CVE-2026-84637.md)
  `CVE-2026-84637` · CVE record: Mozilla Thunderbird · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Unrestricted file upload
- [NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)](https://agentprime.io/advisories/GHSA-m4rf-3fr8-xwx3.md)
  `GHSA-m4rf-3fr8-xwx3`, `CVE-2026-79675`, `PYSEC-2026-3749` · PyPI `nltk`: affected `<3.10.3`, fixed in `3.10.3` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Command injection
- [Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX](https://agentprime.io/advisories/CVE-2026-73749.md)
  `CVE-2026-73749` · CVE record: Hewlett Packard Enterprise (HPE) AOS-CX · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Broken access control
- [Unauthenticated Remote Code Execution in HPE Networking Fabric Composer SSH Daemon](https://agentprime.io/advisories/CVE-2026-76658.md)
  `CVE-2026-76658` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Authentication Bypass in HPE Networking Fabric Composer API allows Administrative Access](https://agentprime.io/advisories/CVE-2026-76657.md)
  `CVE-2026-76657` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Unauthenticated Remote Code Execution in HPE Networking Fabric Composer](https://agentprime.io/advisories/CVE-2026-73701.md)
  `CVE-2026-73701` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Code injection
- [Authenticated Stored Cross-Site Scripting Vulnerability (XSS) in HPE Networking Fabric Composer Web-Based Management Interface](https://agentprime.io/advisories/CVE-2026-73700.md)
  `CVE-2026-73700` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Authentication Bypass leads to Administrative control of adjacent network hosts in HPE Networking Fabric Composer](https://agentprime.io/advisories/CVE-2026-19766.md)
  `CVE-2026-19766` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [OpenAI Codex Desktop: OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and…](https://agentprime.io/advisories/CVE-2026-19593.md)
  `CVE-2026-19593` · CVE record: OpenAI Codex Desktop and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-15
- [Missing authentication in Dell PowerStore 500T and others](https://agentprime.io/advisories/CVE-2026-79687.md)
  `CVE-2026-79687` · CVE record: Dell PowerStore 500T and 4 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Authentication bypass
- [Hardcoded Credentials in TMT Machine's Talassoft Industrial Management Software](https://agentprime.io/advisories/CVE-2026-18931.md)
  `CVE-2026-18931` · CVE record: TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Hard-coded credentials
- [Stack-based Buffer Overflow in Pyramid Solutions NetStaX EtherNet/IP Stack](https://agentprime.io/advisories/CVE-2026-78012.md)
  `CVE-2026-78012` · CVE record: Pyramid Solutions EtherNet/IP Adapter DLL Kit (EIPA) and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [SQL Injection in TRtek Technological Products's Store](https://agentprime.io/advisories/CVE-2026-18210.md)
  `CVE-2026-18210` · CVE record: TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Products's Store · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: SQL injection
- [RSLinx Classic® - Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-9621.md)
  `CVE-2026-9621` · CVE record: Rockwell Automation RSLinx Classic® · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Memory corruption
- [Unauthenticated Remote Code Execution via Code Injection in Klemsan's KIO](https://agentprime.io/advisories/CVE-2026-18808.md)
  `CVE-2026-18808` · CVE record: Klemsan Electrical Electronics Inc. KIO (Klemsan Internet Objects) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: Code injection
- [Information Disclosure Vulnerability in Manacle Technologies ERP System](https://agentprime.io/advisories/CVE-2026-84149.md)
  `CVE-2026-84149` · CVE record: Manacle Technologies Multi-tenant ERP System · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2026 · Tags: CWE-527

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA5LTAxVDEyOjQ0OjE3Ljg1NTAwMFoiLCJDVkUtMjAyNi04NDE0OSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA5LTAzVDExOjIyOjA4LjQ1NTAwMFoiLCJDVkUtMjAyNi04NTE1NCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA5LTAzVDExOjIyOjA4LjQ1NTAwMFoiLCJDVkUtMjAyNi04NTE1NCJd>. Everything for agents: <https://agentprime.io/llms.txt>.