# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Microsoft Entra ID Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-62916.md)
  `CVE-2026-62916` · CVE record: Microsoft Microsoft Entra · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83711.md)
  `CVE-2026-83711` · CVE record: Microsoft Entra · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Broken access control
- [Copilot Studio Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-80098.md)
  `CVE-2026-80098` · CVE record: Microsoft Microsoft Copilot Studio · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Weak cryptography or TLS
- [Azure AI Language Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-70352.md)
  `CVE-2026-70352` · CVE record: Microsoft Azure AI Language Authoring · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents](https://agentprime.io/advisories/GHSA-vpjw-wf5h-cgpq.md)
  `GHSA-vpjw-wf5h-cgpq`, `CVE-2026-72804`, `GO-2026-6407` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260724091654-82e9ded423e4`, fixed in `0.0.0-20260724091654-82e9ded423e4` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Information disclosure, Broken access control
- [MOOS core-moos through 10.4.0 MOOSDB Pre-Authentication Heap Overflow via Negative Packet Length](https://agentprime.io/advisories/CVE-2026-85440.md)
  `CVE-2026-85440` · CVE record: themoos core-moos · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Memory corruption
- [MOOS-IvP through 24.8.1 Out-of-Bounds Write via Unvalidated IvP Payload Counts](https://agentprime.io/advisories/CVE-2026-85438.md)
  `CVE-2026-85438` · CVE record: moos-ivp moos-ivp · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Memory corruption
- [MOOS-IvP through 24.8.1 Buffer Overflow in IvP Function String Decoders](https://agentprime.io/advisories/CVE-2026-85437.md)
  `CVE-2026-85437` · CVE record: moos-ivp moos-ivp · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Memory corruption
- [MOOS-IvP through 24.8.1 uFldNodeBroker Unauthenticated Shore Route Enrollment](https://agentprime.io/advisories/CVE-2026-85435.md)
  `CVE-2026-85435` · CVE record: moos-ivp moos-ivp · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-345
- [MOOS-IvP through 24.8.1 uFldShoreBroker Bridge Route Injection via Unverified Node Ping](https://agentprime.io/advisories/CVE-2026-85434.md)
  `CVE-2026-85434` · CVE record: moos-ivp moos-ivp · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-345
- [MOOS essential-moos through 10.0.1 pShare Unauthorized Runtime Route Reconfiguration](https://agentprime.io/advisories/CVE-2026-85433.md)
  `CVE-2026-85433` · CVE record: themoos essential-moos · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Broken access control
- [MOOS core-moos through 10.4.0 MOOSDB HTTP Server Unauthenticated Variable Write](https://agentprime.io/advisories/CVE-2026-85428.md)
  `CVE-2026-85428` · CVE record: themoos core-moos · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [MOOS essential-moos through 10.0.1 pAntler Remote Code Execution via Unauthenticated MISSION_FILE](https://agentprime.io/advisories/CVE-2026-85427.md)
  `CVE-2026-85427` · CVE record: themoos essential-moos · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-494
- [MOOS-IvP through 24.8.1 uMemWatch Command Injection via MOOS Client Names](https://agentprime.io/advisories/CVE-2026-85426.md)
  `CVE-2026-85426` · CVE record: moos-ivp moos-ivp · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Command injection
- [MOOS-IvP through 24.8.1 iSay Command Injection via SAY_MOOS](https://agentprime.io/advisories/CVE-2026-85425.md)
  `CVE-2026-85425` · CVE record: moos-ivp moos-ivp · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Command injection
- [MOOS core-moos through 10.4.0 Missing Authentication for MOOSDB Publish, Subscribe and DB_CLEAR](https://agentprime.io/advisories/CVE-2026-85424.md)
  `CVE-2026-85424` · CVE record: themoos core-moos · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)](https://agentprime.io/advisories/GHSA-mw8r-mw84-88v2.md)
  `GHSA-mw8r-mw84-88v2`, `CVE-2026-72810`, `GO-2026-6400` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260723013612-ba948639d7f6`, fixed in `0.0.0-20260723013612-ba948639d7f6` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Broken access control
- [SiYuan: SQL injection in backlink/mention search via unescaped stored and client input (publish mode): first-order (client keyword) and second-order (stored document title) breakout on read-write handle](https://agentprime.io/advisories/GHSA-q2vg-7qgx-x5fc.md)
  `GHSA-q2vg-7qgx-x5fc`, `CVE-2026-72811`, `GO-2026-6402` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260723004839-1a5b3431d5ab`, fixed in `0.0.0-20260723004839-1a5b3431d5ab` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: SQL injection
- [D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection](https://agentprime.io/advisories/CVE-2026-85224.md)
  `CVE-2026-85224` · CVE record: D-Link DNS-320 ShareCenter · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Command injection
- [python-jose algorithm confusion guard bypassed by DER-encoded public keys](https://agentprime.io/advisories/GHSA-3qf3-8w2g-rqmx.md)
  `GHSA-3qf3-8w2g-rqmx`, `CVE-2024-33663`, `CVE-2026-85394`, `GHSA-6c5p-j8vq-pqhj`, `PYSEC-2024-232`, `PYSEC-2026-4298` · PyPI `python-jose`: affected `<=3.5.0`, no fixed version yet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Weak cryptography or TLS
- [SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading\*Transaction / getBacklinkDoc (publish mode)](https://agentprime.io/advisories/GHSA-7j72-f6wg-cxw6.md)
  `GHSA-7j72-f6wg-cxw6`, `CVE-2026-68584`, `GO-2026-6382` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260721020826-2d069dce84a2`, fixed in `0.0.0-20260721020826-2d069dce84a2` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass
- [SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints are filtered](https://agentprime.io/advisories/GHSA-36v8-mpjm-8j5r.md)
  `GHSA-36v8-mpjm-8j5r`, `CVE-2026-68586`, `GO-2026-6379` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260721014413-f45749a7ef6e`, fixed in `0.0.0-20260721014413-f45749a7ef6e` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Broken access control
- [SiYuan: Full-content disclosure of publish-disabled documents via getHeading\*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access check](https://agentprime.io/advisories/GHSA-69mh-gvh4-8gp7.md)
  `GHSA-69mh-gvh4-8gp7`, `CVE-2026-68587`, `GO-2026-6381` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260721013353-69db783b782a`, fixed in `0.0.0-20260721013353-69db783b782a` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Broken access control
- [D-Link DNS-340L CGI dropbox.cgi os command injection](https://agentprime.io/advisories/CVE-2026-85223.md)
  `CVE-2026-85223` · CVE record: D-Link DNS-340L · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Command injection
- [SiYuan: Unauthenticated SQL execution and REGEXP injection via fullTextSearchAssetContent (publish mode): reader-reachable raw SQL (method 2) and unescaped REGEXP (method 3) on read-write asset-content DB](https://agentprime.io/advisories/GHSA-fph3-ghq9-vw66.md)
  `GHSA-fph3-ghq9-vw66`, `CVE-2026-69083`, `GO-2026-6374` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260721004815-cf42dd5680c8`, fixed in `0.0.0-20260721004815-cf42dd5680c8` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: SQL injection
- [D-Link DNS-340L Add-On Center addon_center.cgi os command injection](https://agentprime.io/advisories/CVE-2026-85222.md)
  `CVE-2026-85222` · CVE record: D-Link DNS-340L · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Command injection
- [SiYuan: Unauthenticated arbitrary SQL execution via searchEmbedBlock (publish mode) : reader-reachable raw statement on read-write handle, cross-notebook read/write](https://agentprime.io/advisories/GHSA-vh22-h7hf-www7.md)
  `GHSA-vh22-h7hf-www7`, `CVE-2026-69084`, `GO-2026-6377` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260721002947-23a17d44b5f3`, fixed in `0.0.0-20260721002947-23a17d44b5f3` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: SQL injection
- [Improper input validation in Google Chrome](https://agentprime.io/advisories/CVE-2026-85047.md)
  `CVE-2026-85047` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-20
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-85042.md)
  `CVE-2026-85042` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds write in Google Chrome](https://agentprime.io/advisories/CVE-2026-85050.md)
  `CVE-2026-85050` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Memory corruption
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-85043.md)
  `CVE-2026-85043` · CVE record: Google Chrome · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-459
- [Type confusion in Google Chrome](https://agentprime.io/advisories/CVE-2026-85046.md)
  `CVE-2026-85046` · CVE record: Google Chrome · CVSS 8.8 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 3 Sept 2026 · Tags: Memory corruption
- [Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)](https://agentprime.io/advisories/GHSA-fg9p-mrxr-hvq7.md)
  `GHSA-fg9p-mrxr-hvq7`, `CVE-2026-62681` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection, CWE-116
- [Orval: RCE via servers\[\].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)](https://agentprime.io/advisories/GHSA-88f2-fpv8-89q2.md)
  `GHSA-88f2-fpv8-89q2`, `CVE-2026-62682` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection, CWE-116
- [Orval: Import-time RCE via schema default -> zod module-level template literal](https://agentprime.io/advisories/GHSA-w727-8j6c-2rj4.md)
  `GHSA-w727-8j6c-2rj4`, `CVE-2026-72717` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection, CWE-116
- [Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml](https://agentprime.io/advisories/CVE-2026-85391.md)
  `CVE-2026-85391` · CVE record: Peppermint-Lab peppermint · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Hard-coded credentials
- [Orval: Import-time RCE via array-items default -> zod module-level template literal](https://agentprime.io/advisories/GHSA-2h9g-j24r-h63g.md)
  `GHSA-2h9g-j24r-h63g`, `CVE-2026-71869` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection, CWE-116
- [Orval: Import-time RCE via header-parameter default -> zod module-level template literal](https://agentprime.io/advisories/GHSA-8j6p-r8jg-mxqh.md)
  `GHSA-8j6p-r8jg-mxqh`, `CVE-2026-71871` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection, CWE-116
- [Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator](https://agentprime.io/advisories/GHSA-2w86-xfrc-g85r.md)
  `GHSA-2w86-xfrc-g85r`, `CVE-2026-71867` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: SQL injection, Code injection
- [Orval: Import-time RCE via enum-typed default -> zod module-level template literal](https://agentprime.io/advisories/GHSA-3575-w9fc-c2j6.md)
  `GHSA-3575-w9fc-c2j6`, `CVE-2026-71868` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection
- [Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli](https://agentprime.io/advisories/GHSA-653q-5476-x79g.md)
  `GHSA-653q-5476-x79g`, `CVE-2026-71865` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection, CWE-116
- [R2R 3.6.6 SQL Injection via Vector Index Creation Endpoint](https://agentprime.io/advisories/CVE-2026-82526.md)
  `CVE-2026-82526` · CVE record: SciPhi-AI R2R · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: SQL injection
- [Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client](https://agentprime.io/advisories/GHSA-6437-gxhq-pqv8.md)
  `GHSA-6437-gxhq-pqv8`, `CVE-2026-71864` · npm `orval`: affected `<8.21.0`, fixed in `8.21.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection, CWE-116
- [GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter](https://agentprime.io/advisories/CVE-2026-58400.md)
  `CVE-2026-58400` · CVE record: geonetwork core-geonetwork · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Code injection
- [unstructured: Server-Side Request Forgery in the URL-based partitioning](https://agentprime.io/advisories/GHSA-4mvj-m6j5-pmf7.md)
  `GHSA-4mvj-m6j5-pmf7`, `CVE-2026-71428`, `PYSEC-2026-3930` · PyPI `unstructured`: affected `>=0.4.7, <0.24.0`, fixed in `0.24.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Open redirect, Server-side request forgery (SSRF)
- [WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-84834.md)
  `CVE-2026-84834` · CVE record: eyecix JobSearch · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Insecure deserialization
- [WordPress Bricksforge plugin <= 3.1.8.8 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-84814.md)
  `CVE-2026-84814` · CVE record: Bricksforge. Bricksforge · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Privilege escalation
- [WordPress GeoDirectory plugin <= 2.8.174 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-84813.md)
  `CVE-2026-84813` · CVE record: Paolo GeoDirectory · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: SQL injection
- [WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-84768.md)
  `CVE-2026-84768` · CVE record: e4jvikwp VikAppointments Services Booking Calendar · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: SQL injection
- [WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-84753.md)
  `CVE-2026-84753` · CVE record: WPFunnels Mail Mint · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Insecure deserialization
- [WordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-84238.md)
  `CVE-2026-84238` · CVE record: YITH YITH Request a Quote for WooCommerce Premium · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Broken access control
- [SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass](https://agentprime.io/advisories/GHSA-99rq-75j6-5j9f.md)
  `GHSA-99rq-75j6-5j9f`, `CVE-2026-66394`, `GO-2026-6364` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260714095344-f08dee71ba8e`, fixed in `0.0.0-20260714095344-f08dee71ba8e` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS](https://agentprime.io/advisories/CVE-2026-85183.md)
  `CVE-2026-85183` · CVE record: Avaiga taipy · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-1385
- [CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum](https://agentprime.io/advisories/CVE-2026-85181.md)
  `CVE-2026-85181` · CVE record: dianping cat · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-565
- [MISP LDAP and LinOTP Authentication Bypass via Empty or Invalid Credentials](https://agentprime.io/advisories/CVE-2026-85216.md)
  `CVE-2026-85216` · CVE record: misp misp · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Hard-coded credentials
- [Tenda HG10 Boa Web Server formLogin buffer overflow](https://agentprime.io/advisories/CVE-2026-85109.md)
  `CVE-2026-85109` · CVE record: Tenda HG10 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Memory corruption
- [Improper certificate validation in Eclipse Foundation Eclipse Arrowhead](https://agentprime.io/advisories/CVE-2026-82180.md)
  `CVE-2026-82180` · CVE record: Eclipse Foundation Eclipse Arrowhead · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0](https://agentprime.io/advisories/CVE-2026-78080.md)
  `CVE-2026-78080` · CVE record: joodb.feenders.de JooDatabase Lite extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: SQL injection
- [Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6](https://agentprime.io/advisories/CVE-2026-78069.md)
  `CVE-2026-78069` · CVE record: j2commerce.com J2Store extension for Joomla · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Broken access control
- [WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash](https://agentprime.io/advisories/CVE-2026-85154.md)
  `CVE-2026-85154` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Sept 2026 · Tags: Privilege escalation

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA5LTAzVDExOjIyOjA4LjQ1NTAwMFoiLCJDVkUtMjAyNi04NTE1NCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA5LTAzVDIzOjU3OjE1Ljg3ODAwMFoiLCJDVkUtMjAyNi02NzQwMiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA5LTAzVDIzOjU3OjE1Ljg3ODAwMFoiLCJDVkUtMjAyNi02NzQwMiJd>. Everything for agents: <https://agentprime.io/llms.txt>.