# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2](https://agentprime.io/advisories/CVE-2026-89637.md)
  `CVE-2026-89637` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [smb: client: clear ce->tgthint in free_tgts()](https://agentprime.io/advisories/CVE-2026-89636.md)
  `CVE-2026-89636` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [ksmbd: only rebind the reopened file's own oplock on durable reconnect](https://agentprime.io/advisories/CVE-2026-89635.md)
  `CVE-2026-89635` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [smb: client: fix ALIGN() overflow in symlink_data() error context loop](https://agentprime.io/advisories/CVE-2026-89634.md)
  `CVE-2026-89634` · CVE record: Linux Linux · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()](https://agentprime.io/advisories/CVE-2026-89633.md)
  `CVE-2026-89633` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [smb: client: reject a tree connect response whose byte count is too small](https://agentprime.io/advisories/CVE-2026-89631.md)
  `CVE-2026-89631` · CVE record: Linux Linux · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [smb: client: restore the data_offset bound in is_valid_oplock_break()](https://agentprime.io/advisories/CVE-2026-89630.md)
  `CVE-2026-89630` · CVE record: Linux Linux · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [ntfs: bound the free-cluster bitmap scan to the volume](https://agentprime.io/advisories/CVE-2026-89614.md)
  `CVE-2026-89614` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [ntfs: reject invalid empty mapping pairs](https://agentprime.io/advisories/CVE-2026-89613.md)
  `CVE-2026-89613` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [ntfs: reject invalid MFT LCNs from boot sector](https://agentprime.io/advisories/CVE-2026-89612.md)
  `CVE-2026-89612` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [ntfs: validate non-resident attribute offsets](https://agentprime.io/advisories/CVE-2026-89611.md)
  `CVE-2026-89611` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [ntfs: verify run length exceeding volume boundary](https://agentprime.io/advisories/CVE-2026-89610.md)
  `CVE-2026-89610` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [md/raid10: fix still_degraded being inverted in raid10_sync_request()](https://agentprime.io/advisories/CVE-2026-89558.md)
  `CVE-2026-89558` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [mpls: reload header after pskb_may_pull()](https://agentprime.io/advisories/CVE-2026-89555.md)
  `CVE-2026-89555` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow](https://agentprime.io/advisories/CVE-2026-89551.md)
  `CVE-2026-89551` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [SUNRPC: svcauth_gss: enforce krb5 token minimum length](https://agentprime.io/advisories/CVE-2026-89550.md)
  `CVE-2026-89550` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [SUNRPC: close backchannel before destroying callback service](https://agentprime.io/advisories/CVE-2026-89546.md)
  `CVE-2026-89546` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [SUNRPC: harden gss_krb5_unwrap_v2 against short tokens](https://agentprime.io/advisories/CVE-2026-89542.md)
  `CVE-2026-89542` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [SUNRPC: harden gss_unwrap_resp_priv length checks](https://agentprime.io/advisories/CVE-2026-89541.md)
  `CVE-2026-89541` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field](https://agentprime.io/advisories/CVE-2026-89538.md)
  `CVE-2026-89538` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2](https://agentprime.io/advisories/CVE-2026-89537.md)
  `CVE-2026-89537` · CVE record: Linux Linux · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [SUNRPC: wait for in-flight client TLS handshake callback](https://agentprime.io/advisories/CVE-2026-89536.md)
  `CVE-2026-89536` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [svcrdma: Fix offset arithmetic in read_chunk_range](https://agentprime.io/advisories/CVE-2026-89533.md)
  `CVE-2026-89533` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [svcrdma: Fix pcl_for_each_segment for empty chunks](https://agentprime.io/advisories/CVE-2026-89532.md)
  `CVE-2026-89532` · CVE record: Linux Linux · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [svcrdma: Reject inline replies that overflow the pull-up buffer](https://agentprime.io/advisories/CVE-2026-89530.md)
  `CVE-2026-89530` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [svcrdma: Validate Read chunk positions before reconstruction](https://agentprime.io/advisories/CVE-2026-89526.md)
  `CVE-2026-89526` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [ocfs2: bound namelen in dlm_migrate_request_handler](https://agentprime.io/advisories/CVE-2026-89495.md)
  `CVE-2026-89495` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [ocfs2: validate lengths in dlm_mig_lockres_handler](https://agentprime.io/advisories/CVE-2026-89494.md)
  `CVE-2026-89494` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [ocfs2: validate directory-index entry counts when reading metadata](https://agentprime.io/advisories/CVE-2026-89492.md)
  `CVE-2026-89492` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [lockd: pin next file across nlm_inspect_file lock-drop](https://agentprime.io/advisories/CVE-2026-89485.md)
  `CVE-2026-89485` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone](https://agentprime.io/advisories/CVE-2026-89482.md)
  `CVE-2026-89482` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [sctp: stop processing a packet once its association is deleted](https://agentprime.io/advisories/CVE-2026-89479.md)
  `CVE-2026-89479` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [sctp: drop a chunk if its transport was removed](https://agentprime.io/advisories/CVE-2026-89478.md)
  `CVE-2026-89478` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [iommu/vt-d: Force requesting ACS when tboot is enabled](https://agentprime.io/advisories/CVE-2026-89448.md)
  `CVE-2026-89448` · CVE record: Linux Linux · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [xdp: fix zero-copy frame layout](https://agentprime.io/advisories/CVE-2026-81002.md)
  `CVE-2026-81002` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages](https://agentprime.io/advisories/CVE-2026-80986.md)
  `CVE-2026-80986` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()](https://agentprime.io/advisories/CVE-2026-80981.md)
  `CVE-2026-80981` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [net/smc: stop killed, freed and out_of_sync sharing a byte](https://agentprime.io/advisories/CVE-2026-80980.md)
  `CVE-2026-80980` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [seg6: reset IP6CB after IPv6 decapsulation](https://agentprime.io/advisories/CVE-2026-80976.md)
  `CVE-2026-80976` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [crypto: iaa - unmap dst before software fallback on decompress](https://agentprime.io/advisories/CVE-2026-80945.md)
  `CVE-2026-80945` · CVE record: Linux Linux · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [ksmbd: fix use-after-free in oplock break notification](https://agentprime.io/advisories/CVE-2026-80926.md)
  `CVE-2026-80926` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026
- [GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw](https://agentprime.io/advisories/CVE-2026-53952.md)
  `CVE-2026-53952` · CVE record: GetSimpleCMS-CE GetSimpleCMS-CE and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Broken access control, Authentication bypass, CWE-489
- [WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62105.md)
  `CVE-2026-62105` · CVE record: ThemeRex ThemeREX Addons · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Insecure deserialization
- [WordPress Everest Forms plugin <= 3.6.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62103.md)
  `CVE-2026-62103` · CVE record: wpeverest Everest Forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Insecure deserialization
- [Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns](https://agentprime.io/advisories/CVE-2026-82617.md)
  `CVE-2026-82617` · CVE record: Apache Software Foundation Apache OpenNLP · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Denial of service
- [SPIP < 4.4.18 RCE via editer_objet.php Job Queue Injection](https://agentprime.io/advisories/CVE-2026-72710.md)
  `CVE-2026-72710` · CVE record: SPIP SPIP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Broken access control
- [SPIP < 4.4.18 Missing Authorization via ecrire/action/](https://agentprime.io/advisories/CVE-2026-72709.md)
  `CVE-2026-72709` · CVE record: SPIP SPIP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Broken access control
- [Laci Synchroni Backend Vulnerable to Account Takeover / User Impersonation via Client-Side Configuration Manipulation](https://agentprime.io/advisories/CVE-2026-54047.md)
  `CVE-2026-54047` · CVE record: LaciSynchroni server · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass, CWE-349, CWE-602
- [CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and availability of the PLC provided an application project wit…](https://agentprime.io/advisories/CVE-2026-3869.md)
  `CVE-2026-3869` · CVE record: Schneider Electric Modicon M580 and 1 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass
- [WAVLINK WN535M1/WN535M3 Unauthenticated OS Command Injection via sync_server](https://agentprime.io/advisories/CVE-2026-89010.md)
  `CVE-2026-89010` · CVE record: WAVLINK Technology WN535M1 and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Command injection
- [ST Engineering iDirect iQ-Series Terminals Missing Authorization](https://agentprime.io/advisories/CVE-2026-38056.md)
  `CVE-2026-38056` · CVE record: ST Engineering iDirect Evolution iQ‑Series terminals and 2 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Broken access control
- [Incorrect permission assignment in mistralai mistral-vibe](https://agentprime.io/advisories/CVE-2026-87988.md)
  `CVE-2026-87988` · CVE record: mistralai mistral-vibe · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Broken access control
- [An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands.](https://agentprime.io/advisories/CVE-2026-87987.md)
  `CVE-2026-87987` · CVE record: mistralai mistral-vibe · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-15
- [An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret.](https://agentprime.io/advisories/CVE-2026-87986.md)
  `CVE-2026-87986` · CVE record: mistralai mistral-vibe · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-228
- [An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments.](https://agentprime.io/advisories/CVE-2026-87985.md)
  `CVE-2026-87985` · CVE record: mistralai mistral-vibe · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-184
- [Path traversal in mistralai mistral-vibe](https://agentprime.io/advisories/CVE-2026-87984.md)
  `CVE-2026-87984` · CVE record: mistralai mistral-vibe · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Path traversal
- [Path traversal in mistralai mistral-vibe](https://agentprime.io/advisories/CVE-2026-87983.md)
  `CVE-2026-87983` · CVE record: mistralai mistral-vibe · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Path traversal
- [XML External Entity in Akana API Platform](https://agentprime.io/advisories/CVE-2026-89212.md)
  `CVE-2026-89212` · CVE record: Perforce Akana · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: XML external entities (XXE)
- [Privilege Escalation in Progress Chef Automate](https://agentprime.io/advisories/CVE-2026-80462.md)
  `CVE-2026-80462` · CVE record: Progress Software Chef Automate · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass
- [Fortinet FortiMonitorOnSight: A inclusion of sensitive information in source code vulnerability in Fortinet…](https://agentprime.io/advisories/CVE-2026-84390.md)
  `CVE-2026-84390` · CVE record: Fortinet FortiMonitorOnSight · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: CWE-540

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA5LTExVDEyOjEzOjE1LjI2MjAwMFoiLCJDVkUtMjAyNi04NDM5MCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA5LTExVDE5OjQ1OjM1LjUyMzAwMFoiLCJDVkUtMjAyNi04OTY0MyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA5LTExVDE5OjQ1OjM1LjUyMzAwMFoiLCJDVkUtMjAyNi04OTY0MyJd>. Everything for agents: <https://agentprime.io/llms.txt>.