# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Incorrect boundary conditions in the Networking: HTTP component](https://agentprime.io/advisories/CVE-2026-92036.md)
  `CVE-2026-92036` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [Sandbox escape due to incorrect boundary conditions in the Graphics component](https://agentprime.io/advisories/CVE-2026-92035.md)
  `CVE-2026-92035` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [Site isolation issue in the Graphics component](https://agentprime.io/advisories/CVE-2026-92034.md)
  `CVE-2026-92034` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-346
- [Sandbox escape due to invalid pointer in the Graphics component](https://agentprime.io/advisories/CVE-2026-92032.md)
  `CVE-2026-92032` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [Sandbox escape in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-92018.md)
  `CVE-2026-92018` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-693
- [Arbitrary command execution in TrxTimeATTENDANCE](https://agentprime.io/advisories/CVE-2026-89308.md)
  `CVE-2026-89308` · CVE record: TREXOM TrxTimeATTENDANCE · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [Casdoor through 4.4.0 Cross-Organization User Administration via /api/mcp](https://agentprime.io/advisories/CVE-2026-91998.md)
  `CVE-2026-91998` · CVE record: casdoor casdoor · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [pig before 4.1.0 Unverified Password Change via /register/password](https://agentprime.io/advisories/CVE-2026-91995.md)
  `CVE-2026-91995` · CVE record: pig-mesh pig · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-620
- [D-Link DI-8300 CGI Service rzgl.asp rzgl_asp stack-based overflow](https://agentprime.io/advisories/CVE-2026-91003.md)
  `CVE-2026-91003` · CVE record: D-Link DI-8300 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [D-Link DI-8400 DDNS Configuration ddns.asp ddns_asp stack-based overflow](https://agentprime.io/advisories/CVE-2026-91001.md)
  `CVE-2026-91001` · CVE record: D-Link DI-8400 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [EFM ipTIME C200E System Setup iux_set.cgi os command injection](https://agentprime.io/advisories/CVE-2026-90847.md)
  `CVE-2026-90847` · CVE record: EFM ipTIME C200E · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint.](https://agentprime.io/advisories/CVE-2026-88617.md)
  `CVE-2026-88617` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection.](https://agentprime.io/advisories/CVE-2026-79303.md)
  `CVE-2026-79303` · CVE record · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: SQL injection
- [TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access.](https://agentprime.io/advisories/CVE-2026-37152.md)
  `CVE-2026-37152` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Hard-coded credentials
- [Incomplete Security Scanner Blocklist Enables Network-Based Code Execution](https://agentprime.io/advisories/CVE-2026-12944.md)
  `CVE-2026-12944` · CVE record: IBM Langflow OSS · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Deserialization of untrusted data in WebPros WHMCS](https://agentprime.io/advisories/CVE-2026-67399.md)
  `CVE-2026-67399` · CVE record: WebPros WHMCS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Insecure deserialization
- [Out-of-bounds write in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-65414.md)
  `CVE-2026-65414` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds write in Apple macOS](https://agentprime.io/advisories/CVE-2026-43790.md)
  `CVE-2026-43790` · CVE record: Apple macOS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [Buffer overflow in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-84609.md)
  `CVE-2026-84609` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [Buffer overflow in Apple macOS](https://agentprime.io/advisories/CVE-2026-84520.md)
  `CVE-2026-84520` · CVE record: Apple macOS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [Double free in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-84561.md)
  `CVE-2026-84561` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [Information disclosure in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-84625.md)
  `CVE-2026-84625` · CVE record: Apple iOS and iPadOS and 3 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Information disclosure
- [Improper certificate validation in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-86881.md)
  `CVE-2026-86881` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Weak cryptography or TLS
- [DataStage on Cloud Pak for Data has several vulnerabilities due to open source software](https://agentprime.io/advisories/CVE-2026-16338.md)
  `CVE-2026-16338` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade](https://agentprime.io/advisories/GHSA-rrxg-g2pf-6hh4.md)
  `GHSA-rrxg-g2pf-6hh4`, `CVE-2026-59178`, `PYSEC-2026-4049` · PyPI `esphome-device-builder`: affected `<1.0.12`, fixed in `1.0.12` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret](https://agentprime.io/advisories/CVE-2026-90945.md)
  `CVE-2026-90945` · CVE record: crawlab-team crawlab · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Hard-coded credentials
- [Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints](https://agentprime.io/advisories/CVE-2026-90942.md)
  `CVE-2026-90942` · CVE record: casdoor casdoor · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control
- [DotVVM: Missing authorization in AuthorizeActionFilter](https://agentprime.io/advisories/CVE-2026-57578.md)
  `CVE-2026-57578` · CVE record: riganti dotvvm · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control
- [Cisco Secure Email Gateway SQL Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-76461.md)
  `CVE-2026-76461` · CVE record: Cisco Cisco Secure Email · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.40 · Not analysed yet · Published 14 Sept 2026 · Tags: SQL injection
- [Cisco Secure Email Gateway Security Hardening Release](https://agentprime.io/advisories/CVE-2026-76443.md)
  `CVE-2026-76443` · CVE record: Cisco Cisco Secure Email and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-707
- [Cisco Secure Email Gateway Security Hardening Release](https://agentprime.io/advisories/CVE-2026-76440.md)
  `CVE-2026-76440` · CVE record: Cisco Cisco Secure Email and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Cisco Secure Email Gateway Security Hardening Release](https://agentprime.io/advisories/CVE-2026-20353.md)
  `CVE-2026-20353` · CVE record: Cisco Cisco Secure Email · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-664
- [Cisco Secure Email Gateway Security Hardening Release](https://agentprime.io/advisories/CVE-2026-76441.md)
  `CVE-2026-76441` · CVE record: Cisco Cisco Secure Email and Web Manager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control
- [parallax filament-comments through 3.0.0 Stored XSS via Comment Body](https://agentprime.io/advisories/CVE-2026-90943.md)
  `CVE-2026-90943` · CVE record: parallax filament-comments · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users](https://agentprime.io/advisories/CVE-2026-82431.md)
  `CVE-2026-82431` · CVE record: Apache Software Foundation Apache Storm Client · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control
- [Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs](https://agentprime.io/advisories/CVE-2026-82434.md)
  `CVE-2026-82434` · CVE record: Apache Software Foundation Apache Storm Nimbus and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Hard-coded credentials, Information disclosure
- [Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder](https://agentprime.io/advisories/CVE-2026-82435.md)
  `CVE-2026-82435` · CVE record: Apache Software Foundation Apache Storm Worker · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service
- [Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC](https://agentprime.io/advisories/CVE-2026-82439.md)
  `CVE-2026-82439` · CVE record: Apache Software Foundation Apache Storm DRPC · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service
- [Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys](https://agentprime.io/advisories/CVE-2026-82441.md)
  `CVE-2026-82441` · CVE record: Apache Software Foundation Apache Storm Nimbus · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control, CWE-20
- [MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials](https://agentprime.io/advisories/CVE-2026-90961.md)
  `CVE-2026-90961` · CVE record: MISP MISP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass, CWE-20
- [Apache Syncope: Cross-Realm boundaries reconciliation bypass](https://agentprime.io/advisories/CVE-2026-73370.md)
  `CVE-2026-73370` · CVE record: Apache Software Foundation Apache Syncope · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control
- [Path traversal in Eclipse Foundation Eclipse Embedded CDT (C/C++ Development Tools)](https://agentprime.io/advisories/CVE-2026-78299.md)
  `CVE-2026-78299` · CVE record: Eclipse Foundation Eclipse Embedded CDT (C/C++ Development Tools) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [Apache Syncope: Delegating users can grant unowned Roles](https://agentprime.io/advisories/CVE-2026-73470.md)
  `CVE-2026-73470` · CVE record: Apache Software Foundation Apache Syncope · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Privilege escalation
- [Apache Syncope: Non-recursive Any search could skip Realms restrictions](https://agentprime.io/advisories/CVE-2026-73579.md)
  `CVE-2026-73579` · CVE record: Apache Software Foundation Apache Syncope · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control
- [Apache Syncope: Incomplete authorization checks for Group members deprovisioning](https://agentprime.io/advisories/CVE-2026-75030.md)
  `CVE-2026-75030` · CVE record: Apache Software Foundation Apache Syncope · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control
- [Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search](https://agentprime.io/advisories/CVE-2026-77051.md)
  `CVE-2026-77051` · CVE record: Apache Software Foundation Apache Syncope · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: SQL injection
- [Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values](https://agentprime.io/advisories/CVE-2026-73668.md)
  `CVE-2026-73668` · CVE record: Apache Software Foundation Apache Syncope · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control
- [froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL](https://agentprime.io/advisories/CVE-2026-90937.md)
  `CVE-2026-90937` · CVE record: froxlor froxlor · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Other injection
- [Apache Syncope: ClientApp update entitlement not effective](https://agentprime.io/advisories/CVE-2026-77181.md)
  `CVE-2026-77181` · CVE record: Apache Software Foundation Apache Syncope · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control
- [Apache Syncope: Privilege escalation for admin user via JWT authentication](https://agentprime.io/advisories/CVE-2026-78330.md)
  `CVE-2026-78330` · CVE record: Apache Software Foundation Apache Syncope · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Privilege escalation
- [Inadequate access control in the Hiperdino REST API](https://agentprime.io/advisories/CVE-2026-12258.md)
  `CVE-2026-12258` · CVE record: Hiperdino REST API · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control
- [LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization](https://agentprime.io/advisories/CVE-2026-90919.md)
  `CVE-2026-90919` · CVE record: ModelTC LightLLM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Insecure deserialization
- [Improper Claim Validation in PingAM OIDC Provider](https://agentprime.io/advisories/CVE-2026-21391.md)
  `CVE-2026-21391` · CVE record: Ping Identity PingAM · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [Apache Syncope: SQL injection via sort parameter in Task search](https://agentprime.io/advisories/CVE-2026-82232.md)
  `CVE-2026-82232` · CVE record: Apache Software Foundation Apache Syncope · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: SQL injection
- [Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence](https://agentprime.io/advisories/CVE-2026-86460.md)
  `CVE-2026-86460` · CVE record: Apache Software Foundation Apache Syncope · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: SQL injection
- [Apache Syncope: JWT subject spoofing](https://agentprime.io/advisories/CVE-2026-87785.md)
  `CVE-2026-87785` · CVE record: Apache Software Foundation Apache Syncope · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Authentication bypass
- [Apache Syncope: SRA OAuth2 JWT signature verification bypass](https://agentprime.io/advisories/CVE-2026-87802.md)
  `CVE-2026-87802` · CVE record: Apache Software Foundation Apache Syncope · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Weak cryptography or TLS
- [Bifrost unauthenticated remote code execution via MCP stdio client registration](https://agentprime.io/advisories/CVE-2026-90898.md)
  `CVE-2026-90898` · CVE record: maximhq Bifrost · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control, Authentication bypass
- [D-Link DWR-M921 formDiskCreateShare system os command injection](https://agentprime.io/advisories/CVE-2026-90703.md)
  `CVE-2026-90703` · CVE record: D-Link DWR-M921 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Command injection
- [D-Link DWR-M921 formDiskFormat system os command injection](https://agentprime.io/advisories/CVE-2026-90702.md)
  `CVE-2026-90702` · CVE record: D-Link DWR-M921 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Sept 2026 · Tags: Command injection

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA5LTE0VDA5OjMwOjExLjU3NDAwMFoiLCJDVkUtMjAyNi05MDcwMiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA5LTE1VDEyOjMzOjU4LjA4NzAwMFoiLCJDVkUtMjAyNi05MjAzNyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA5LTE1VDEyOjMzOjU4LjA4NzAwMFoiLCJDVkUtMjAyNi05MjAzNyJd>. Everything for agents: <https://agentprime.io/llms.txt>.