# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Neutralization of Special Elements used in a Command](https://agentprime.io/advisories/CVE-2026-20325.md)
  `CVE-2026-20325` · CVE record: Cisco Cisco Nexus Dashboard · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Server-Side Request Forgery in Altium Enterprise Server UnifiedLogin Service Allows Unauthenticated System Compromise](https://agentprime.io/advisories/CVE-2026-92808.md)
  `CVE-2026-92808` · CVE record: Altium Altium Enterprise Server · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass, Server-side request forgery (SSRF)
- [Cisco Identity Services Engine Hardening Release - Incorrect Resource Transfer Vulnerabilities](https://agentprime.io/advisories/CVE-2026-20194.md)
  `CVE-2026-20194` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-669
- [Cisco Identity Services Engine Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-20211.md)
  `CVE-2026-20211` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Insecure deserialization
- [Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Improper Neutralization Vulnerabilities](https://agentprime.io/advisories/CVE-2026-20330.md)
  `CVE-2026-20330` · CVE record: Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and 2 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-707
- [Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Access Control](https://agentprime.io/advisories/CVE-2026-20322.md)
  `CVE-2026-20322` · CVE record: Cisco Cisco Nexus Dashboard · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control
- [Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Exceptional Conditions Handling Vulnerabi…](https://agentprime.io/advisories/CVE-2026-20329.md)
  `CVE-2026-20329` · CVE record: Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and 2 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-703
- [Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Missing Authentication for Critical Function](https://agentprime.io/advisories/CVE-2026-20326.md)
  `CVE-2026-20326` · CVE record: Cisco Cisco Nexus Dashboard · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write](https://agentprime.io/advisories/CVE-2026-89083.md)
  `CVE-2026-89083` · CVE record: HP Inc HP AC Print & Scan and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Code injection
- [HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write](https://agentprime.io/advisories/CVE-2026-89082.md)
  `CVE-2026-89082` · CVE record: HP Inc HP AC Print & Scan and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Code injection
- [HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-91106.md)
  `CVE-2026-91106` · CVE record: HP Inc. HP Linux Imaging and Printing Software (HPLIP) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Memory corruption
- [Under certain circumstances, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised swi…](https://agentprime.io/advisories/CVE-2026-73456.md)
  `CVE-2026-73456` · CVE record: Arista Networks EOS · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Code injection
- [HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-91104.md)
  `CVE-2026-91104` · CVE record: HP Inc. HP Linux Imaging and Printing Software (HPLIP) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Memory corruption
- [Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability](https://agentprime.io/advisories/CVE-2026-68536.md)
  `CVE-2026-68536` · CVE record: Apache Software Foundation Apache MyFaces · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Kubero through 3.1.1 Unauthenticated Notifications API Access](https://agentprime.io/advisories/CVE-2026-92720.md)
  `CVE-2026-92720` · CVE record: kubero-dev kubero · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [Covenant through 0.6 Missing Authentication on the CovenantHub SignalR Hub](https://agentprime.io/advisories/CVE-2026-92717.md)
  `CVE-2026-92717` · CVE record: cobbr Covenant · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [Cisco Identity Services Engine Hardening Release - Insuffiencently Protected Credential Vulnerabilities](https://agentprime.io/advisories/CVE-2026-20234.md)
  `CVE-2026-20234` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Hard-coded credentials
- [Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Protection Mechanism Failure Vulnerabilit…](https://agentprime.io/advisories/CVE-2026-20331.md)
  `CVE-2026-20331` · CVE record: Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and 2 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-693
- [Cisco Secure Firewall Management Center Software Impersonated sftunnel Connection Vulnerability](https://agentprime.io/advisories/CVE-2026-76420.md)
  `CVE-2026-76420` · CVE record: Cisco Cisco Secure Firewall Management Center (FMC) · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Broken access control
- [Cisco Identity Services Engine Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-20307.md)
  `CVE-2026-20307` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Insecure deserialization
- [Cisco Identity Services Engine Command Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-20305.md)
  `CVE-2026-20305` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Cisco Identity Services Engine Command Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-20306.md)
  `CVE-2026-20306` · CVE record: Cisco Cisco Identity Services Engine Software and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Ruijie RG-EW3000GX user_list_note admin os command injection](https://agentprime.io/advisories/CVE-2026-92398.md)
  `CVE-2026-92398` · CVE record: Ruijie RG-EW3000GX · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment](https://agentprime.io/advisories/CVE-2026-90999.md)
  `CVE-2026-90999` · CVE record: Functional Software, Inc. Sentry Seer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Other injection, Code injection, CWE-20, CWE-116
- [Ruijie RG-EW3000GX configChange unifyframe-sgi.elf cc_set os command injection](https://agentprime.io/advisories/CVE-2026-92397.md)
  `CVE-2026-92397` · CVE record: Ruijie RG-EW3000GX · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy](https://agentprime.io/advisories/GHSA-5h8j-6crg-7rmw.md)
  `GHSA-5h8j-6crg-7rmw`, `CVE-2025-59953`, `PYSEC-2026-4079` · PyPI `lmdeploy`: affected `>=0.9.1, <0.10.2`, fixed in `0.10.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Insecure deserialization
- [Deserialization of untrusted data in Dell ObjectScale](https://agentprime.io/advisories/CVE-2026-70416.md)
  `CVE-2026-70416` · CVE record: Dell ObjectScale · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Insecure deserialization
- [@fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet](https://agentprime.io/advisories/CVE-2026-92395.md)
  `CVE-2026-92395` · CVE record: @fastify/proxy-addr @fastify/proxy-addr · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass, CWE-348, CWE-697
- [@zereight/mcp-gitlab: Unauthenticated arbitrary file read via \`upload_markdown\` enables PAT exfiltration and full account takeover](https://agentprime.io/advisories/GHSA-cv3r-c5h8-f4g5.md)
  `GHSA-cv3r-c5h8-f4g5`, `CVE-2026-61560` · npm `@zereight/mcp-gitlab`: affected `<2.1.27`, fixed in `2.1.27` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Path traversal
- [Stack overflow in login process to the Security Management and Log Servers](https://agentprime.io/advisories/CVE-2026-91843.md)
  `CVE-2026-91843` · CVE record: checkpoint Quantum Security Management · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Memory corruption
- [OS command injection in Advantech EKI-1242IEIMS and others](https://agentprime.io/advisories/CVE-2026-73172.md)
  `CVE-2026-73172` · CVE record: Advantech EKI-1242IEIMS and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers](https://agentprime.io/advisories/CVE-2026-58147.md)
  `CVE-2026-58147` · CVE record: WNC T-Mobile 5G Box IDU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Unauthorized remote code execution in T-Mobile 5G Box IDU routers](https://agentprime.io/advisories/CVE-2026-58146.md)
  `CVE-2026-58146` · CVE record: WNC T-Mobile 5G Box IDU · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [Command Injection in T-Mobile 5G Box IDU router via ping functionality](https://agentprime.io/advisories/CVE-2026-40855.md)
  `CVE-2026-40855` · CVE record: WNC T-Mobile 5G Box IDU · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Command injection
- [net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()](https://agentprime.io/advisories/CVE-2026-90049.md)
  `CVE-2026-90049` · CVE record: Linux Linux · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()](https://agentprime.io/advisories/CVE-2026-90048.md)
  `CVE-2026-90048` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [ceph: properly decrypt filenames in vmalloc() buffers](https://agentprime.io/advisories/CVE-2026-90042.md)
  `CVE-2026-90042` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [NFSD: Prevent client use-after-free during export state revocation](https://agentprime.io/advisories/CVE-2026-90038.md)
  `CVE-2026-90038` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [NFSD: Prevent client use-after-free during close_lru reaping](https://agentprime.io/advisories/CVE-2026-90037.md)
  `CVE-2026-90037` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [NFSD: Prevent client use-after-free during blocked-lock reaping](https://agentprime.io/advisories/CVE-2026-90036.md)
  `CVE-2026-90036` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [spi: Fix DMA mapping ownership on partial map failure](https://agentprime.io/advisories/CVE-2026-90012.md)
  `CVE-2026-90012` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [scsi: target: iscsi: Reserve a terminator byte for the login payload](https://agentprime.io/advisories/CVE-2026-90011.md)
  `CVE-2026-90011` · CVE record: Linux Linux · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [ceph: lock mutex in ceph_mds_check_access()](https://agentprime.io/advisories/CVE-2026-89990.md)
  `CVE-2026-89990` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [nvme: add missing SRCU grace period in error path](https://agentprime.io/advisories/CVE-2026-89972.md)
  `CVE-2026-89972` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [nvmet-auth: Synchronize timeout work during SQ teardown](https://agentprime.io/advisories/CVE-2026-89970.md)
  `CVE-2026-89970` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU](https://agentprime.io/advisories/CVE-2026-89969.md)
  `CVE-2026-89969` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [KVM: nVMX: Service local TLB flushes on failed nested VM-Enter](https://agentprime.io/advisories/CVE-2026-89930.md)
  `CVE-2026-89930` · CVE record: Linux Linux · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [KVM: arm64: Correctly handle end of VA space TLBI invalidation](https://agentprime.io/advisories/CVE-2026-89918.md)
  `CVE-2026-89918` · CVE record: Linux Linux · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry](https://agentprime.io/advisories/CVE-2026-89916.md)
  `CVE-2026-89916` · CVE record: Linux Linux · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [KVM: arm64: Remove VM-wide VNCR mapping counter](https://agentprime.io/advisories/CVE-2026-89915.md)
  `CVE-2026-89915` · CVE record: Linux Linux · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [KVM: arm64: Sign-extend VA for range-based TLBI invalidation](https://agentprime.io/advisories/CVE-2026-89914.md)
  `CVE-2026-89914` · CVE record: Linux Linux · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject](https://agentprime.io/advisories/CVE-2026-89857.md)
  `CVE-2026-89857` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [scsi: qla2xxx: Avoid double completion in async IOCB timeout](https://agentprime.io/advisories/CVE-2026-89847.md)
  `CVE-2026-89847` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read](https://agentprime.io/advisories/CVE-2026-89846.md)
  `CVE-2026-89846` · CVE record: Linux Linux · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026
- [Security Advisory 0174](https://agentprime.io/advisories/CVE-2026-73453.md)
  `CVE-2026-73453` · CVE record: Arista Networks EOS · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Code injection
- [Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT](https://agentprime.io/advisories/CVE-2026-76187.md)
  `CVE-2026-76187` · CVE record: Apache Software Foundation Apache Airflow Keycloak provider · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity](https://agentprime.io/advisories/CVE-2026-76186.md)
  `CVE-2026-76186` · CVE record: Apache Software Foundation Apache Airflow Keycloak provider · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-565
- [Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions](https://agentprime.io/advisories/CVE-2026-86462.md)
  `CVE-2026-86462` · CVE record: Apache Software Foundation Apache Airflow FAB provider · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int \_user_id comparison is always false](https://agentprime.io/advisories/CVE-2026-82311.md)
  `CVE-2026-82311` · CVE record: Apache Software Foundation Apache Airflow FAB provider · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [ksmbd: fix tree connection use-after-free in smb2_tree_connect()](https://agentprime.io/advisories/CVE-2026-89788.md)
  `CVE-2026-89788` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Sept 2026

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA5LTE2VDA4OjQ4OjI1LjA0OTAwMFoiLCJDVkUtMjAyNi04OTc4OCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA5LTE2VDIwOjA2OjUyLjY4MzAwMFoiLCJDVkUtMjAyNi0yMDMyNCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA5LTE2VDIwOjA2OjUyLjY4MzAwMFoiLCJDVkUtMjAyNi0yMDMyNCJd>. Everything for agents: <https://agentprime.io/llms.txt>.