# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Icinga 2: Improper access control for JSON-RPC update certificate messages](https://agentprime.io/advisories/CVE-2026-61550.md)
  `CVE-2026-61550` · CVE record: Icinga icinga2 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Broken access control
- [AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing](https://agentprime.io/advisories/GHSA-82r6-8w77-94w6.md)
  `GHSA-82r6-8w77-94w6`, `CVE-2026-63374`, `PYSEC-2026-4025` · PyPI `anyio`: affected `<4.14.2`, fixed in `4.14.2` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Weak cryptography or TLS
- [kcp front-proxy does not strip inbound X-Remote-\* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters in any workspace](https://agentprime.io/advisories/GHSA-c8w2-fgvx-vhv4.md)
  `GHSA-c8w2-fgvx-vhv4`, `CVE-2026-61682`, `GO-2026-6517` · Go `github.com/kcp-dev/kcp`: affected `<0.31.4 || >=0.32.0, <0.32.2`, fixed in `0.31.4`, `0.32.2` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Authentication bypass, CWE-302, CWE-348
- [Data deletion and attribute disclosure via field-name method injection in in-memory queries](https://agentprime.io/advisories/CVE-2026-93762.md)
  `CVE-2026-93762` · CVE record: MongoDB Inc. Mongoid · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Code injection
- [Cocos AI: Intra-handshake attested TLS implementation is vulnerable to session-misbinding attacks for Intel TDX verifier path](https://agentprime.io/advisories/CVE-2026-92701.md)
  `CVE-2026-92701` · CVE record: ultravioletrs cocos · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-346, CWE-354
- [LMDeploy has Remote Code Execution by Pickle Deserialization via handle_zmq_recv in lmdeploy/lmdeploy/pytorch/disagg/conn/engine_conn.py](https://agentprime.io/advisories/GHSA-2vh9-42vm-xmv2.md)
  `GHSA-2vh9-42vm-xmv2`, `CVE-2025-66455`, `PYSEC-2026-4077` · PyPI `lmdeploy`: affected `>=0.9.2, <0.16.0`, fixed in `0.16.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Insecure deserialization
- [Cocos AI: Intra-handshake attested TLS implementation can accept Evidence with nil, empty, or omitted reportData in the AMD SEV-SNP path](https://agentprime.io/advisories/CVE-2026-92702.md)
  `CVE-2026-92702` · CVE record: ultravioletrs cocos · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-346
- [WACRM: Database-layer authorization bypasses](https://agentprime.io/advisories/CVE-2026-77240.md)
  `CVE-2026-77240` · CVE record: ArnasDon wacrm · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Broken access control
- [CareCam CM2507 Cleartext Storage of Sensitive Information](https://agentprime.io/advisories/CVE-2026-81321.md)
  `CVE-2026-81321` · CVE record: CareCam HMT.CM2507 Firmware · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Information disclosure
- [CareCam CM2507 Use of Password Hash With Insufficient Computational Effort](https://agentprime.io/advisories/CVE-2026-85497.md)
  `CVE-2026-85497` · CVE record: CareCam HMT.CM2507 Firmware · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Weak cryptography or TLS
- [IBM MQ for HPE NonStop is vulnerable to a denial of service attack](https://agentprime.io/advisories/CVE-2026-10858.md)
  `CVE-2026-10858` · CVE record: IBM MQ for HPE NonStop · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Memory corruption
- [libheif: Heap buffer overflow in \`scale_nearest_neighbor()\` via duplicate Alpha planes from nested \`iden\`/\`auxl\` items](https://agentprime.io/advisories/CVE-2026-84383.md)
  `CVE-2026-84383` · CVE record: strukturag libheif · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Memory corruption
- [IBM MQ Appliance is affected by a heap buffer overflow vulnerability in protocol message processing](https://agentprime.io/advisories/CVE-2026-10747.md)
  `CVE-2026-10747` · CVE record: IBM MQ Appliance · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Memory corruption
- [Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent](https://agentprime.io/advisories/CVE-2025-15399.md)
  `CVE-2025-15399` · CVE record: IBM Common Licensing · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Cross-site request forgery (CSRF)
- [Code injection in Interchange](https://agentprime.io/advisories/CVE-2026-75031.md)
  `CVE-2026-75031` · CVE record: Interchange Interchange · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Code injection
- [org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue](https://agentprime.io/advisories/GHSA-26vp-8gxg-v4pg.md)
  `GHSA-26vp-8gxg-v4pg`, `CVE-2025-53837` · Maven `org.xwiki.rendering:xwiki-rendering-xml`: affected `<14.10.2`, fixed in `14.10.2` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Code injection
- [Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read](https://agentprime.io/advisories/CVE-2026-93019.md)
  `CVE-2026-93019` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Denial of service, CWE-196
- [vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species](https://agentprime.io/advisories/CVE-2026-93606.md)
  `CVE-2026-93606` · CVE record: patriksimek vm2 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-693
- [vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function](https://agentprime.io/advisories/CVE-2026-93603.md)
  `CVE-2026-93603` · CVE record: patriksimek vm2 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Code injection
- [Missing Length Check](https://agentprime.io/advisories/CVE-2023-5778.md)
  `CVE-2023-5778` · CVE record: ABB Freelance Controller DCP and 3 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-130
- [Privilege Escalation via Cryptographic Signature Verification Bypass in NetBackup Flex OS Shell](https://agentprime.io/advisories/CVE-2026-28198.md)
  `CVE-2026-28198` · CVE record: Cohesity NetBackup Flex OS · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Weak cryptography or TLS
- [Privilege Escalation via Argument Injection in NetBackup Flex OS Shell](https://agentprime.io/advisories/CVE-2026-28197.md)
  `CVE-2026-28197` · CVE record: Cohesity NetBackup Flex OS · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Command injection
- [Synology DiskStation Manager (DSM): An insufficient entropy vulnerability in login logic in Synology DiskStation Manager…](https://agentprime.io/advisories/CVE-2026-13639.md)
  `CVE-2026-13639` · CVE record: Synology DiskStation Manager (DSM) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-331
- [Improper output encoding in Synology DiskStation Manager (DSM)](https://agentprime.io/advisories/CVE-2026-13684.md)
  `CVE-2026-13684` · CVE record: Synology DiskStation Manager (DSM) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-116
- [HCL BigFix Service Management is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-67100.md)
  `CVE-2026-67100` · CVE record: HCL Software HCL BigFix Service Management · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: SQL injection, Information disclosure
- [HCL BigFix Service Management is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-67101.md)
  `CVE-2026-67101` · CVE record: HCL Software HCL BigFix Service Management · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [AF Companion < 2.2.0 - Shop Manager+ Arbitrary File Upload to RCE](https://agentprime.io/advisories/CVE-2026-84738.md)
  `CVE-2026-84738` · CVE record: Unknown AF Companion · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Code injection
- [HGiga｜OAKlouds - Insecure Deserialization](https://agentprime.io/advisories/CVE-2026-93467.md)
  `CVE-2026-93467` · CVE record: HGiga OAKlouds-custom_page-2.0 and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2026 · Tags: Insecure deserialization
- [Microsoft Fabric Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69843.md)
  `CVE-2026-69843` · CVE record: Microsoft Microsoft Fabric · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Azure Database for PostgreSQL Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-85878.md)
  `CVE-2026-85878` · CVE record: Microsoft Azure HorizonDB · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Broken access control
- [Azure Billing Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-62874.md)
  `CVE-2026-62874` · CVE record: Microsoft Azure Billing · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-345
- [Incorrect default permissions in Acronis Backup plugin for cPanel & WHM and others](https://agentprime.io/advisories/CVE-2026-87886.md)
  `CVE-2026-87886` · CVE record: Acronis Acronis Backup plugin for cPanel & WHM and 2 more · CVSS 7.8 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 17 Sept 2026 · Tags: Broken access control
- [Azure AI Foundry Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-85889.md)
  `CVE-2026-85889` · CVE record: Microsoft Azure AI Foundry · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Azure Logic Apps Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-70200.md)
  `CVE-2026-70200` · CVE record: Microsoft Azure Logic Apps · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal, Broken access control
- [Azure Cosmos DB Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-87701.md)
  `CVE-2026-87701` · CVE record: Microsoft Azure Cosmos DB · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Other injection
- [Azure Logic Apps Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83944.md)
  `CVE-2026-83944` · CVE record: Microsoft Azure Logic Apps · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Broken access control
- [Microsoft 365 Copilot Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-85885.md)
  `CVE-2026-85885` · CVE record: Microsoft Microsoft 365 Copilot · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Command injection
- [Azure Arc Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69399.md)
  `CVE-2026-69399` · CVE record: Microsoft Azure ARC · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-441
- [Microsoft Dataverse Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-77903.md)
  `CVE-2026-77903` · CVE record: Microsoft Microsoft Dataverse · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [Microsoft Container Registry Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69865.md)
  `CVE-2026-69865` · CVE record: Microsoft Azure Container Registry · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Broken access control
- [Azure Arc Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-70009.md)
  `CVE-2026-70009` · CVE record: Microsoft Azure ARC · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal
- [Prebid Server Java: Vulnerability to request forgery allows for possible host environment data extraction](https://agentprime.io/advisories/CVE-2026-54734.md)
  `CVE-2026-54734` · CVE record: prebid prebid-server-java · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement](https://agentprime.io/advisories/GHSA-hh34-374j-pfr5.md)
  `GHSA-hh34-374j-pfr5`, `CVE-2026-76949`, `EEF-CVE-2026-76949` · Hex `ash_authentication`: affected `>=4.10.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14`, fixed in `4.15.0`, `5.0.0-rc.14` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass
- [WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php](https://agentprime.io/advisories/CVE-2026-54767.md)
  `CVE-2026-54767` · CVE record: LabRedesCefetRJ WeGIA · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass, Hard-coded credentials
- [WeGIA: Unauthenticated Auth Bypass + Local File Inclusion](https://agentprime.io/advisories/CVE-2026-54670.md)
  `CVE-2026-54670` · CVE record: LabRedesCefetRJ WeGIA · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal, Authentication bypass
- [Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8](https://agentprime.io/advisories/CVE-2026-73639.md)
  `CVE-2026-73639` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-93373.md)
  `CVE-2026-93373` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in Google Chrome](https://agentprime.io/advisories/CVE-2026-93372.md)
  `CVE-2026-93372` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-93374.md)
  `CVE-2026-93374` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Memory corruption
- [Grav: Missing admin.super guard on core group blueprint access field allows admin.users operator to escalate to super-admin](https://agentprime.io/advisories/GHSA-xhfv-7758-r9hx.md)
  `GHSA-xhfv-7758-r9hx`, `CVE-2026-75837`, `PKSA-dzhx-7r7k-p6cx` · Packagist `getgrav/grav`: affected `<2.0.14`, fixed in `2.0.14` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Privilege escalation, Broken access control
- [Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write](https://agentprime.io/advisories/GHSA-f8wv-xp27-6gq7.md)
  `GHSA-f8wv-xp27-6gq7`, `CVE-2026-75827`, `PKSA-nc3c-xf26-g5gp` · Packagist `getgrav/grav`: affected `<2.0.15`, fixed in `2.0.15` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Code injection
- [Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS](https://agentprime.io/advisories/GHSA-vfmf-q6x9-cw96.md)
  `GHSA-vfmf-q6x9-cw96`, `CVE-2026-75828`, `PKSA-tr1n-vmpf-rmt6` · Packagist `getgrav/grav`: affected `<2.0.15`, fixed in `2.0.15` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS)
- [CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection](https://agentprime.io/advisories/GHSA-vjqc-q4mp-2rvf.md)
  `GHSA-vjqc-q4mp-2rvf`, `CVE-2026-79752`, `PKSA-ny8z-1rqf-8z42`, `PKSA-vxgj-bmcq-9b6x` · Packagist `cakephp/cakephp` and 1 more: affected `<4.5.12 || >=4.6.0, <4.6.5 || >=5.0.0, <5.1.9 || >=5.2.0, <5.2.14 || >=5.3.0, <5.3.7`, fixed in `4.5.12`, `4.6.5`, `5.1.9`, `5.2.14`, `5.3.7` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: SQL injection
- [Heap overflow via oversized decrypted TLS record sequence in Windows Secure Channel stream](https://agentprime.io/advisories/CVE-2026-93393.md)
  `CVE-2026-93393` · CVE record: MongoDB Inc. C Driver · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Memory corruption
- [Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match](https://agentprime.io/advisories/GHSA-9ccq-2jfg-qw33.md)
  `GHSA-9ccq-2jfg-qw33`, `CVE-2026-72702`, `PKSA-ms14-tz6x-6sqm` · Packagist `getgrav/grav`: affected `<2.0.16`, fixed in `2.0.16` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: CWE-346
- [Chamilo LMS CStudio upload flow allows unauthenticated remote code execution](https://agentprime.io/advisories/GHSA-g4c3-4g96-6g4m.md)
  `GHSA-g4c3-4g96-6g4m`, `CVE-2026-45140`, `PKSA-m8ms-hgzz-8ddw` · Packagist `chamilo/chamilo-lms`: affected `<2.0.1`, fixed in `2.0.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal, Code injection, Unrestricted file upload, CWE-219
- [Browsertrix: Arbitrary Command Injection due to Improper Command Sanitization in Git URLs specified as Custom Behaviors](https://agentprime.io/advisories/CVE-2026-54501.md)
  `CVE-2026-54501` · CVE record: webrecorder browsertrix · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Command injection, Privilege escalation, CWE-20
- [Wavelog: Unauthenticated Remote Code Execution](https://agentprime.io/advisories/CVE-2026-54237.md)
  `CVE-2026-54237` · CVE record: wavelog wavelog · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Code injection, Broken access control
- [Chamilo LMS: Student-to-admin stored XSS in private messages via v-html](https://agentprime.io/advisories/CVE-2026-45143.md)
  `CVE-2026-45143` · CVE record: chamilo chamilo-lms · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS)
- [OpenReception: Unauthenticated WebAuthn passkey injection via \`POST /api/auth/passkeys\` leads to account takeover](https://agentprime.io/advisories/CVE-2026-54460.md)
  `CVE-2026-54460` · CVE record: open-reception appointment-booking-software · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA5LTE3VDIwOjA3OjI0LjYzMTAwMFoiLCJDVkUtMjAyNi01NDQ2MCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA5LTE4VDE3OjU0OjI2LjAwMDAwMFoiLCJHSFNBLXhjdzQtNTNjYy1odjMyIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA5LTE4VDE3OjU0OjI2LjAwMDAwMFoiLCJHSFNBLXhjdzQtNTNjYy1odjMyIl0>. Everything for agents: <https://agentprime.io/llms.txt>.