# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [ext4: fix out-of-bounds read in ext4_read_inline_dir()](https://agentprime.io/advisories/CVE-2026-89786.md)
  `CVE-2026-89786` · CVE record: Linux Linux · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full](https://agentprime.io/advisories/CVE-2026-89783.md)
  `CVE-2026-89783` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [fs/ntfs3: validate ef->size covers the record's name and value](https://agentprime.io/advisories/CVE-2026-89779.md)
  `CVE-2026-89779` · CVE record: Linux Linux · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [isofs: fix out-of-bounds page array access on empty zisofs block](https://agentprime.io/advisories/CVE-2026-89778.md)
  `CVE-2026-89778` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation](https://agentprime.io/advisories/CVE-2026-89775.md)
  `CVE-2026-89775` · CVE record: Linux Linux · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY](https://agentprime.io/advisories/CVE-2026-81642.md)
  `CVE-2026-81642` · CVE record: NLnet Labs Unbound · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Memory corruption
- [Security Advisory 0163](https://agentprime.io/advisories/CVE-2026-73461.md)
  `CVE-2026-73461` · CVE record: Arista Networks EOS · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Privilege escalation
- [Remote code execution via uploading a malicious IODD file](https://agentprime.io/advisories/CVE-2026-27565.md)
  `CVE-2026-27565` · CVE record: Pepperl+Fuchs ICE2-8IOL1-G65L-V1D and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Authentication Bypass in \_account_log](https://agentprime.io/advisories/CVE-2026-27546.md)
  `CVE-2026-27546` · CVE record: Pepperl+Fuchs ICE2-8IOL1-G65L-V1D and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request](https://agentprime.io/advisories/CVE-2026-73447.md)
  `CVE-2026-73447` · CVE record: Arista Networks EOS · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '\_jet_engine_booking_form_id' Parameter](https://agentprime.io/advisories/CVE-2026-12793.md)
  `CVE-2026-12793` · CVE record: jetmonsters JetFormBuilder — Dynamic Blocks Form Builder · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Privilege escalation
- [TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action](https://agentprime.io/advisories/CVE-2026-14349.md)
  `CVE-2026-14349` · CVE record: themetechmount TrueBooker – Appointment Booking and Scheduler System · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control
- [kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF).](https://agentprime.io/advisories/CVE-2026-88592.md)
  `CVE-2026-88592` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-345
- [An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_helper.exe component](https://agentprime.io/advisories/CVE-2026-51990.md)
  `CVE-2026-51990` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Code injection
- [A Server-Side Request Forgery vulnerability exists in sat_proxy.php in Zenith Satellite Tracker 1.0.](https://agentprime.io/advisories/CVE-2025-56563.md)
  `CVE-2025-56563` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Authentication Bypass via SAML Response Manipulation](https://agentprime.io/advisories/CVE-2026-15640.md)
  `CVE-2026-15640` · CVE record: Delinea Secret Server (On-Prem) · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Reflected Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-15639.md)
  `CVE-2026-15639` · CVE record: Delinea Secret Server (On-Prem) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Cryptographic Padding Oracle](https://agentprime.io/advisories/CVE-2026-15638.md)
  `CVE-2026-15638` · CVE record: Delinea Secret Server (On-Prem) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Weak cryptography or TLS
- [mySCADA myPRO Manager Missing Authorization](https://agentprime.io/advisories/CVE-2026-73807.md)
  `CVE-2026-73807` · CVE record: mySCADA Technologies mySCADA myPRO · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key](https://agentprime.io/advisories/CVE-2026-81855.md)
  `CVE-2026-81855` · CVE record: Wärtsilä FOS-Onboard · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Hard-coded credentials
- [Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key](https://agentprime.io/advisories/CVE-2026-78225.md)
  `CVE-2026-78225` · CVE record: Wärtsilä FOS-Onboard · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Hard-coded credentials
- [Symlink following in Webpros SolusVM](https://agentprime.io/advisories/CVE-2026-68491.md)
  `CVE-2026-68491` · CVE record: Webpros SolusVM · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal
- [@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery](https://agentprime.io/advisories/GHSA-2h44-8472-frjj.md)
  `GHSA-2h44-8472-frjj`, `CVE-2026-61559` · npm `@zereight/mcp-gitlab`: affected `>=0.0.1, <2.1.27`, fixed in `2.1.27` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter](https://agentprime.io/advisories/CVE-2026-91939.md)
  `CVE-2026-91939` · CVE record: Cotonti Cotonti · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Insecure deserialization
- [@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport](https://agentprime.io/advisories/GHSA-vmp7-252j-cwp7.md)
  `GHSA-vmp7-252j-cwp7`, `CVE-2026-61568` · npm `@zereight/mcp-gitlab`: affected `<2.1.30`, fixed in `2.1.30` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-350
- [Improper input validation in Google Chrome](https://agentprime.io/advisories/CVE-2026-91738.md)
  `CVE-2026-91738` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: CWE-20
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-91729.md)
  `CVE-2026-91729` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-91716.md)
  `CVE-2026-91716` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-91718.md)
  `CVE-2026-91718` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-91710.md)
  `CVE-2026-91710` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [Integer overflow in Google Chrome](https://agentprime.io/advisories/CVE-2026-91728.md)
  `CVE-2026-91728` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-91749.md)
  `CVE-2026-91749` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [Missing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups](https://agentprime.io/advisories/CVE-2026-66887.md)
  `CVE-2026-66887` · CVE record: Digital Watchdog VMAX A1 G4 DVR and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups](https://agentprime.io/advisories/CVE-2026-66890.md)
  `CVE-2026-66890` · CVE record: Digital Watchdog VMAX A1 G4 DVR and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Hard-coded credentials
- [Fireshare has Unauthenticated Argument Injection to Arbitrary File Write/Overwrite](https://agentprime.io/advisories/CVE-2026-54337.md)
  `CVE-2026-54337` · CVE record: ShaneIsrael fireshare · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Command injection
- [Improper access control in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87230.md)
  `CVE-2026-87230` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87223.md)
  `CVE-2026-87223` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87217.md)
  `CVE-2026-87217` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Improper privilege management in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87214.md)
  `CVE-2026-87214` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation
- [Improper privilege management in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87189.md)
  `CVE-2026-87189` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation
- [Missing authentication in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87188.md)
  `CVE-2026-87188` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Improper privilege management in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87186.md)
  `CVE-2026-87186` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation
- [SQL injection in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87184.md)
  `CVE-2026-87184` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: SQL injection
- [Missing authentication in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87176.md)
  `CVE-2026-87176` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87175.md)
  `CVE-2026-87175` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87173.md)
  `CVE-2026-87173` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Improper privilege management in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87172.md)
  `CVE-2026-87172` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation
- [Missing authentication in Oracle Corporation Oracle Hyperion Financial Management](https://agentprime.io/advisories/CVE-2026-87170.md)
  `CVE-2026-87170` · CVE record: Oracle Corporation Oracle Hyperion Financial Management · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Hyperion Data Relationship Management](https://agentprime.io/advisories/CVE-2026-87129.md)
  `CVE-2026-87129` · CVE record: Oracle Corporation Oracle Hyperion Data Relationship Management · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Hyperion Data Relationship Management](https://agentprime.io/advisories/CVE-2026-87128.md)
  `CVE-2026-87128` · CVE record: Oracle Corporation Oracle Hyperion Data Relationship Management · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Mobile Application Server](https://agentprime.io/advisories/CVE-2026-83462.md)
  `CVE-2026-83462` · CVE record: Oracle Corporation Oracle Mobile Application Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Document Management and Collaboration](https://agentprime.io/advisories/CVE-2026-83452.md)
  `CVE-2026-83452` · CVE record: Oracle Corporation Oracle Document Management and Collaboration · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Enterprise Manager for Fusion Middleware](https://agentprime.io/advisories/CVE-2026-83355.md)
  `CVE-2026-83355` · CVE record: Oracle Corporation Oracle Enterprise Manager for Fusion Middleware · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle WebCenter Enterprise Capture](https://agentprime.io/advisories/CVE-2026-83339.md)
  `CVE-2026-83339` · CVE record: Oracle Corporation Oracle WebCenter Enterprise Capture · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Applications Framework](https://agentprime.io/advisories/CVE-2026-83327.md)
  `CVE-2026-83327` · CVE record: Oracle Corporation Oracle Applications Framework · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Tencent Mass Service Engine in Cluster (MSEC) path traversal](https://agentprime.io/advisories/CVE-2026-89040.md)
  `CVE-2026-89040` · CVE record: Tencent Mass Service Engine in Cluster (MSEC) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Path traversal
- [Missing authentication in Oracle Corporation Oracle Business Intelligence Enterprise Edition](https://agentprime.io/advisories/CVE-2026-83283.md)
  `CVE-2026-83283` · CVE record: Oracle Corporation Oracle Business Intelligence Enterprise Edition · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Improper privilege management in Oracle Corporation Oracle Business Intelligence Enterprise Edition](https://agentprime.io/advisories/CVE-2026-83282.md)
  `CVE-2026-83282` · CVE record: Oracle Corporation Oracle Business Intelligence Enterprise Edition · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation
- [Missing authentication in Oracle Corporation Oracle BI Publisher](https://agentprime.io/advisories/CVE-2026-83269.md)
  `CVE-2026-83269` · CVE record: Oracle Corporation Oracle BI Publisher · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Authentication bypass
- [Improper privilege management in Oracle Corporation Oracle BI Publisher](https://agentprime.io/advisories/CVE-2026-83268.md)
  `CVE-2026-83268` · CVE record: Oracle Corporation Oracle BI Publisher · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: Privilege escalation

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA5LTE1VDIwOjA0OjQwLjkzODAwMFoiLCJDVkUtMjAyNi04MzI2OCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA5LTE2VDA4OjQ4OjI1LjA0OTAwMFoiLCJDVkUtMjAyNi04OTc4OCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA5LTE2VDA4OjQ4OjI1LjA0OTAwMFoiLCJDVkUtMjAyNi04OTc4OCJd>. Everything for agents: <https://agentprime.io/llms.txt>.