# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection](https://agentprime.io/advisories/CVE-2026-90699.md)
  `CVE-2026-90699` · CVE record: D-Link DWR-M920 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Command injection
- [D-Link DIR-878 WAN Settings SetWan3Settings stack-based overflow](https://agentprime.io/advisories/CVE-2026-90693.md)
  `CVE-2026-90693` · CVE record: D-Link DIR-878 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [D-Link DIR-878 Dynamic DNS IPv6 Settings SetDynamicDNSIPv6Settings stack-based overflow](https://agentprime.io/advisories/CVE-2026-90692.md)
  `CVE-2026-90692` · CVE record: D-Link DIR-878 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [Joomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.0](https://agentprime.io/advisories/CVE-2026-85192.md)
  `CVE-2026-85192` · CVE record: regularlabs.com Conditional Content Pro extension for Joomla · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Code injection
- [D-Link DIR-823G HNAP1 SetStaticRouteSettings strcpy stack-based overflow](https://agentprime.io/advisories/CVE-2026-90680.md)
  `CVE-2026-90680` · CVE record: D-Link DIR-823G · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [Totolink A3002MU boa formPortFw buffer overflow](https://agentprime.io/advisories/CVE-2026-90608.md)
  `CVE-2026-90608` · CVE record: Totolink A3002MU · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [Totolink A3002MU boa formNewSchedule buffer overflow](https://agentprime.io/advisories/CVE-2026-90607.md)
  `CVE-2026-90607` · CVE record: Totolink A3002MU · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [Totolink A3002MU boa formIpv6Setup buffer overflow](https://agentprime.io/advisories/CVE-2026-90606.md)
  `CVE-2026-90606` · CVE record: Totolink A3002MU · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Sept 2026 · Tags: Memory corruption
- [Totolink A3002MU boa formFilter buffer overflow](https://agentprime.io/advisories/CVE-2026-90605.md)
  `CVE-2026-90605` · CVE record: Totolink A3002MU · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Sept 2026 · Tags: Memory corruption
- [CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router](https://agentprime.io/advisories/CVE-2026-81648.md)
  `CVE-2026-81648` · CVE record: Unknown CryptoPayment Gateway · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Sept 2026 · Tags: Broken access control
- [LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key](https://agentprime.io/advisories/CVE-2026-90562.md)
  `CVE-2026-90562` · CVE record: langbot-app LangBot · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Sept 2026 · Tags: CWE-331
- [Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG](https://agentprime.io/advisories/CVE-2026-90561.md)
  `CVE-2026-90561` · CVE record: strapi strapi · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Tonec Internet Download Manager Kernel Driver idmwfp.sys access control](https://agentprime.io/advisories/CVE-2026-90493.md)
  `CVE-2026-90493` · CVE record: Tonec Internet Download Manager · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Sept 2026 · Tags: Privilege escalation, Broken access control
- [Improper certificate validation in Kalkitech ASE2000 V2 Communication Test Set](https://agentprime.io/advisories/CVE-2026-90647.md)
  `CVE-2026-90647` · CVE record: Kalkitech ASE2000 V2 Communication Test Set · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Sept 2026 · Tags: Weak cryptography or TLS
- [sngrep through 1.8.4 Stack Buffer Overflow via SIP Headers](https://agentprime.io/advisories/CVE-2026-90558.md)
  `CVE-2026-90558` · CVE record: irontec sngrep · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Sept 2026 · Tags: Memory corruption
- [The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation](https://agentprime.io/advisories/CVE-2026-78159.md)
  `CVE-2026-78159` · CVE record: stellarwp The Events Calendar · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Sept 2026 · Tags: Code injection
- [The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-78006.md)
  `CVE-2026-78006` · CVE record: stellarwp The Events Calendar · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Sept 2026 · Tags: Insecure deserialization
- [WP Component <= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Blog Option Update](https://agentprime.io/advisories/CVE-2026-85681.md)
  `CVE-2026-85681` · CVE record: Unknown WP Component · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Sept 2026 · Tags: Privilege escalation
- [WP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File Upload](https://agentprime.io/advisories/CVE-2026-84171.md)
  `CVE-2026-84171` · CVE record: Unknown WP images upload on piclect · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Sept 2026 · Tags: Unrestricted file upload
- [Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection](https://agentprime.io/advisories/CVE-2026-82845.md)
  `CVE-2026-82845` · CVE record: Unknown Masteriyo LMS · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Sept 2026 · Tags: Insecure deserialization
- [DS Ad Rotator <= 0.8 - Unauthenticated Arbitrary File Upload](https://agentprime.io/advisories/CVE-2026-81402.md)
  `CVE-2026-81402` · CVE record: Unknown DS Ad Rotator · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Sept 2026 · Tags: Unrestricted file upload
- [WebTotem Backups < 1.1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal](https://agentprime.io/advisories/CVE-2026-77006.md)
  `CVE-2026-77006` · CVE record: Unknown WebTotem Backups · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Sept 2026 · Tags: Path traversal
- [Code Monkeys Proposals <= 1.0.1 - Subscriber+ Arbitrary File Deletion via Path Traversal](https://agentprime.io/advisories/CVE-2026-77005.md)
  `CVE-2026-77005` · CVE record: Unknown CODE MONKEYS PROPOSALS · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Sept 2026 · Tags: Path traversal
- [Frontegg SAML SSO <= 1.0.1 - Unauthenticated Account Takeover via Unverified SAMLResponse](https://agentprime.io/advisories/CVE-2026-75800.md)
  `CVE-2026-75800` · CVE record: Unknown Frontegg SAML SSO · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Sept 2026 · Tags: Authentication bypass
- [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab](https://agentprime.io/advisories/CVE-2026-85706.md)
  `CVE-2026-85706` · CVE record: GitLab GitLab · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.97 · Not analysed yet · Published 12 Sept 2026 · Tags: Path traversal
- [Deserialization of Untrusted Data in GitLab](https://agentprime.io/advisories/CVE-2026-87719.md)
  `CVE-2026-87719` · CVE record: GitLab GitLab · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Sept 2026 · Tags: Insecure deserialization
- [yayson: Prototype pollution in Store/LegacyStore deserialization](https://agentprime.io/advisories/GHSA-325j-mg25-8q58.md)
  `GHSA-325j-mg25-8q58`, `CVE-2026-61534` · npm `yayson`: affected `<4.3.0`, fixed in `4.3.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Prototype pollution
- [Use of default credentials in Malcolm](https://agentprime.io/advisories/CVE-2026-90456.md)
  `CVE-2026-90456` · CVE record: CISA Malcolm · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-1392
- [Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover](https://agentprime.io/advisories/GHSA-2j95-gqxf-v3vg.md)
  `GHSA-2j95-gqxf-v3vg`, `CVE-2026-11746` · Maven `com.linecorp.centraldogma:centraldogma-server`: affected `<0.84.0`, fixed in `0.84.0` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Hard-coded credentials
- [MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)](https://agentprime.io/advisories/GHSA-rqfv-2mw9-78g2.md)
  `GHSA-rqfv-2mw9-78g2`, `CVE-2026-59971`, `PYSEC-2026-4109` · PyPI `mysql-mcp-server`: affected `<0.4.2`, fixed in `0.4.2` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass, CWE-346
- [NFSD: check truncate permission under inode lock](https://agentprime.io/advisories/CVE-2026-89713.md)
  `CVE-2026-89713` · CVE record: Linux Linux · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock](https://agentprime.io/advisories/CVE-2026-89712.md)
  `CVE-2026-89712` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown](https://agentprime.io/advisories/CVE-2026-89708.md)
  `CVE-2026-89708` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations](https://agentprime.io/advisories/CVE-2026-89703.md)
  `CVE-2026-89703` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [nfsd: size fh_verify server sockaddr slot by xpt_locallen](https://agentprime.io/advisories/CVE-2026-89702.md)
  `CVE-2026-89702` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()](https://agentprime.io/advisories/CVE-2026-89697.md)
  `CVE-2026-89697` · CVE record: Linux Linux · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [nfsd: don't free session slots that are still in use](https://agentprime.io/advisories/CVE-2026-89689.md)
  `CVE-2026-89689` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [nfsd: drop the stateid, not the stateowner, on seqid_op replay retry](https://agentprime.io/advisories/CVE-2026-89688.md)
  `CVE-2026-89688` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke](https://agentprime.io/advisories/CVE-2026-89686.md)
  `CVE-2026-89686` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [nfsd: fix layout fence worker double-reference race](https://agentprime.io/advisories/CVE-2026-89681.md)
  `CVE-2026-89681` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()](https://agentprime.io/advisories/CVE-2026-89677.md)
  `CVE-2026-89677` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [nfsd: fix stale s2s_cp_stateids IDR entry for async COPY](https://agentprime.io/advisories/CVE-2026-89676.md)
  `CVE-2026-89676` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [nfsd: fix UAF in async copy cancel and shutdown](https://agentprime.io/advisories/CVE-2026-89675.md)
  `CVE-2026-89675` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget](https://agentprime.io/advisories/CVE-2026-89674.md)
  `CVE-2026-89674` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [nfsd: gate nfs2 setacl by argp->mask](https://agentprime.io/advisories/CVE-2026-89672.md)
  `CVE-2026-89672` · CVE record: Linux Linux · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [nfsd: gate nfs3 setacl by argp->mask](https://agentprime.io/advisories/CVE-2026-89671.md)
  `CVE-2026-89671` · CVE record: Linux Linux · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [nfsd: initialize copy-notify stateid before publishing it](https://agentprime.io/advisories/CVE-2026-89669.md)
  `CVE-2026-89669` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [NFSD: Prevent lock owner use-after-free during client teardown](https://agentprime.io/advisories/CVE-2026-89662.md)
  `CVE-2026-89662` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [NFSD: Prevent client use-after-free during admin state revocation](https://agentprime.io/advisories/CVE-2026-89660.md)
  `CVE-2026-89660` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [NFSD: Prevent client use-after-free during delegation revoke](https://agentprime.io/advisories/CVE-2026-89659.md)
  `CVE-2026-89659` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup](https://agentprime.io/advisories/CVE-2026-89658.md)
  `CVE-2026-89658` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [libceph: reject buckets with mismatched CRUSH ids](https://agentprime.io/advisories/CVE-2026-89656.md)
  `CVE-2026-89656` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [ceph: fix UAF in \_\_kick_flushing_caps() on cf entry freed during unlock](https://agentprime.io/advisories/CVE-2026-89655.md)
  `CVE-2026-89655` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [ceph: fix UAF in check_new_map() on session freed during unlock](https://agentprime.io/advisories/CVE-2026-89654.md)
  `CVE-2026-89654` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode](https://agentprime.io/advisories/CVE-2026-89653.md)
  `CVE-2026-89653` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [ceph: bound copied dentry name length in NFS export get_name](https://agentprime.io/advisories/CVE-2026-89652.md)
  `CVE-2026-89652` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [ceph: bound MDSCapAuth path and fs_name decode in handle_session()](https://agentprime.io/advisories/CVE-2026-89651.md)
  `CVE-2026-89651` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [ceph: bound num_export_targets array for mds info v2/v3](https://agentprime.io/advisories/CVE-2026-89650.md)
  `CVE-2026-89650` · CVE record: Linux Linux · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [ceph: bound xattr value length in \_\_build_xattrs()](https://agentprime.io/advisories/CVE-2026-89649.md)
  `CVE-2026-89649` · CVE record: Linux Linux · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [audit: avoid dropping live tree ref on fsnotify rule autoremove](https://agentprime.io/advisories/CVE-2026-89643.md)
  `CVE-2026-89643` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA5LTExVDE5OjQ1OjM1LjUyMzAwMFoiLCJDVkUtMjAyNi04OTY0MyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA5LTE0VDA5OjMwOjExLjU3NDAwMFoiLCJDVkUtMjAyNi05MDcwMiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA5LTE0VDA5OjMwOjExLjU3NDAwMFoiLCJDVkUtMjAyNi05MDcwMiJd>. Everything for agents: <https://agentprime.io/llms.txt>.