# Critical Advisories: what needs attention now.
A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.
- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.
Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at , or with the MCP tools `check_lockfile` and `check_packages`. RSS:
## Records, newest first (an older page)
- [CVE-2026-86793](https://agentprime.io/advisories/CVE-2026-86793.md)
`CVE-2026-86793` · CVE record: SGLang SGLang · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Code injection
- [Hugo before v0.165.0 Insufficient Permission Restriction via TailwindCSS](https://agentprime.io/advisories/CVE-2026-89259.md)
`CVE-2026-89259` · CVE record: gohugoio hugo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Privilege escalation
- [Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get](https://agentprime.io/advisories/CVE-2026-89258.md)
`CVE-2026-89258` · CVE record: gohugoio hugo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Path traversal
- [AVideo Bookmark Plugin Stored XSS via Chapter Names](https://agentprime.io/advisories/CVE-2026-89256.md)
`CVE-2026-89256` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [AVideo LoginControl Stored XSS via PGP Public Key](https://agentprime.io/advisories/CVE-2026-89255.md)
`CVE-2026-89255` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [AVideo CustomizeUser Stored XSS via field_name Parameter](https://agentprime.io/advisories/CVE-2026-89254.md)
`CVE-2026-89254` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [AVideo Stored XSS via donationLink in watch page button](https://agentprime.io/advisories/CVE-2026-89253.md)
`CVE-2026-89253` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [AVideo YPTWallet Stored XSS via CryptoWallet Configuration](https://agentprime.io/advisories/CVE-2026-89249.md)
`CVE-2026-89249` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WWBN AVideo Stored XSS via UserGroups setGroup_name](https://agentprime.io/advisories/CVE-2026-89243.md)
`CVE-2026-89243` · CVE record: WWBN AVideo · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin](https://agentprime.io/advisories/CVE-2026-47839.md)
`CVE-2026-47839` · CVE record: Cloud Foundry Foundation UAA and 1 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Broken access control
- [Advanced Customized Prompts <= 1.0.1 - Unauthenticated Account Takeover](https://agentprime.io/advisories/CVE-2026-14563.md)
`CVE-2026-14563` · CVE record: Unknown advanced-customized-prompts · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass
- [Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload](https://agentprime.io/advisories/CVE-2026-14560.md)
`CVE-2026-14560` · CVE record: Unknown teddy-bear-customize-addon · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Code injection
- [Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover](https://agentprime.io/advisories/CVE-2026-14559.md)
`CVE-2026-14559` · CVE record: Unknown teddy-bear-customize-addon · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass
- [MIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Upload](https://agentprime.io/advisories/CVE-2026-8778.md)
`CVE-2026-8778` · CVE record: mulika MIPL Grouped Checkout Fields for WooCommerce. Customize & Organize Checkout Fields. · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Unrestricted file upload
- [Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and comp…](https://agentprime.io/advisories/CVE-2026-79396.md)
`CVE-2026-79396` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Hard-coded credentials
- [An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earl…](https://agentprime.io/advisories/CVE-2026-79395.md)
`CVE-2026-79395` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Authentication bypass
- [An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause unsafe trajectory planning and potential UAV collisions via a missin…](https://agentprime.io/advisories/CVE-2026-71644.md)
`CVE-2026-71644` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: Memory corruption
- [SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php](https://agentprime.io/advisories/CVE-2026-52630.md)
`CVE-2026-52630` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2026 · Tags: SQL injection
- [OS Command Injection Vulnerability in Deco Devices](https://agentprime.io/advisories/CVE-2026-17176.md)
`CVE-2026-17176` · CVE record: TP-Link Systems Inc. Deco BE11000 V2 and 1 more · CVSS 7.7 High · Critical (CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 10 Sept 2026 · Tags: Command injection
- [Traefik HTTP/3 Backend NTLM Connection Reuse](https://agentprime.io/advisories/GHSA-qqjf-53cj-pwvv.md)
`GHSA-qqjf-53cj-pwvv`, `CVE-2026-88007`, `GO-2026-6466` · Go `github.com/traefik/traefik/v2` and 1 more: affected `>=2.11.0, <2.11.57`, fixed in `2.11.57` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Authentication bypass, Broken access control
- [rclone serve s3: --auth-proxy without --auth-key authenticates nobody - full SigV4 signature bypass](https://agentprime.io/advisories/GHSA-xwwr-4h3p-r22c.md)
`GHSA-xwwr-4h3p-r22c`, `BIT-rclone-2026-88018`, `CVE-2026-88018`, `GO-2026-6462` · Go `github.com/rclone/rclone`: affected `<1.75.1`, fixed in `1.75.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Authentication bypass
- [rclone: RC per-server auth-proxy bypass](https://agentprime.io/advisories/GHSA-p569-5gjg-9cmj.md)
`GHSA-p569-5gjg-9cmj`, `BIT-rclone-2026-88044`, `CVE-2026-88044`, `GO-2026-6460` · Go `github.com/rclone/rclone`: affected `>=1.70.0, <1.75.1`, fixed in `1.75.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Broken access control
- [Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent](https://agentprime.io/advisories/CVE-2026-19646.md)
`CVE-2026-19646` · CVE record: IBM Common Licensing · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: CWE-1149
- [IBM ContextForge MCP Gateway is affected by use of default credentials](https://agentprime.io/advisories/CVE-2026-78573.md)
`CVE-2026-78573` · CVE record: IBM ContextForge MCP Gateway · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: CWE-1392
- [Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards](https://agentprime.io/advisories/CVE-2026-79724.md)
`CVE-2026-79724` · CVE record: IBM Langflow OSS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Command injection
- [DataStage on Cloud Pak for Data has several vulnerabilities due to open source software](https://agentprime.io/advisories/CVE-2026-80424.md)
`CVE-2026-80424` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards](https://agentprime.io/advisories/CVE-2026-81204.md)
`CVE-2026-81204` · CVE record: IBM Langflow OSS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Code injection
- [DataStage on Cloud Pak for Data has several vulnerabilities due to open source software](https://agentprime.io/advisories/CVE-2026-82100.md)
`CVE-2026-82100` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [DataStage on Cloud Pak for Data has several vulnerabilities due to open source software](https://agentprime.io/advisories/CVE-2026-82107.md)
`CVE-2026-82107` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Authentication bypass
- [OmniRoute ACP Custom-Agent Remote Code Execution (RCE)](https://agentprime.io/advisories/GHSA-hf57-cqmx-p4gr.md)
`GHSA-hf57-cqmx-p4gr`, `CVE-2026-88062` · npm `omniroute`: affected `<=3.8.50`, no fixed version yet · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Code injection, Authentication bypass
- [Suricata http2: protocol-change type confusion can lead to denial of service](https://agentprime.io/advisories/CVE-2026-45764.md)
`CVE-2026-45764` · CVE record: OISF suricata · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Memory corruption
- [Hard-coded credentials in Lenovo Health Application](https://agentprime.io/advisories/CVE-2026-75940.md)
`CVE-2026-75940` · CVE record: Lenovo Health Application · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Hard-coded credentials
- [Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards](https://agentprime.io/advisories/CVE-2026-85025.md)
`CVE-2026-85025` · CVE record: IBM Langflow OSS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Broken access control
- [Template injection in Forgejo](https://agentprime.io/advisories/CVE-2026-89094.md)
`CVE-2026-89094` · CVE record: Forgejo Forgejo · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Code injection
- [Improper signature verification in OCaml jose](https://agentprime.io/advisories/CVE-2026-89086.md)
`CVE-2026-89086` · CVE record: OCaml jose · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Weak cryptography or TLS
- [passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending](https://agentprime.io/advisories/CVE-2026-89043.md)
`CVE-2026-89043` · CVE record: krakenjs passport-saml-encrypted · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Weak cryptography or TLS
- [passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification](https://agentprime.io/advisories/CVE-2026-89042.md)
`CVE-2026-89042` · CVE record: krakenjs passport-saml-encrypted · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Weak cryptography or TLS
- [OS command injection in WebPros ConfigServer Security & Firewall and others](https://agentprime.io/advisories/CVE-2026-65639.md)
`CVE-2026-65639` · CVE record: WebPros ConfigServer Security & Firewall and 1 more · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Command injection
- [Path traversal in WebPros Plesk](https://agentprime.io/advisories/CVE-2026-68487.md)
`CVE-2026-68487` · CVE record: WebPros Plesk · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [OS command injection in WebPros ConfigServer Security & Firewall and others](https://agentprime.io/advisories/CVE-2026-65638.md)
`CVE-2026-65638` · CVE record: WebPros ConfigServer Security & Firewall and 1 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Command injection
- [Time-of-check time-of-use race condition in WebPros Plesk](https://agentprime.io/advisories/CVE-2026-68488.md)
`CVE-2026-68488` · CVE record: WebPros Plesk · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Race condition
- [Improper access control in Dell ThinOS 10](https://agentprime.io/advisories/CVE-2026-81046.md)
`CVE-2026-81046` · CVE record: Dell ThinOS 10 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Broken access control
- [OS command injection in Dell ThinOS 10](https://agentprime.io/advisories/CVE-2026-81468.md)
`CVE-2026-81468` · CVE record: Dell ThinOS 10 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Command injection
- [OS command injection in Dell ThinOS 10](https://agentprime.io/advisories/CVE-2026-81467.md)
`CVE-2026-81467` · CVE record: Dell ThinOS 10 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Command injection
- [Command injection in Dell ThinOS 10](https://agentprime.io/advisories/CVE-2026-81048.md)
`CVE-2026-81048` · CVE record: Dell ThinOS 10 · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Command injection
- [knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header](https://agentprime.io/advisories/CVE-2026-88899.md)
`CVE-2026-88899` · CVE record: knowns-dev knowns · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Path traversal
- [WordPress Verified Reviews (Avis Vérifiés) plugin <= 2.4.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-81800.md)
`CVE-2026-81800` · CVE record: Par avisverifies Verified Reviews (Avis Vérifiés) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: SQL injection
- [Renovate before 44.11.2 Credential Exfiltration via Link Header](https://agentprime.io/advisories/CVE-2026-88887.md)
`CVE-2026-88887` · CVE record: renovatebot renovate and 4 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Open redirect
- [Renovate before 44.11.2 Credential Exfiltration via Link Header](https://agentprime.io/advisories/CVE-2026-88882.md)
`CVE-2026-88882` · CVE record: renovatebot renovate and 4 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Open redirect
- [Renovate before 44.11.3 Credential Exfiltration via Link Header](https://agentprime.io/advisories/CVE-2026-88881.md)
`CVE-2026-88881` · CVE record: renovatebot renovate and 4 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Open redirect
- [Renovate before 44.11.3 Credential Exfiltration via Link Header](https://agentprime.io/advisories/CVE-2026-88880.md)
`CVE-2026-88880` · CVE record: renovatebot renovate and 4 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Open redirect
- [Traefik v3.7.0 Authentication Bypass via from-to-www-redirect](https://agentprime.io/advisories/CVE-2026-88877.md)
`CVE-2026-88877` · CVE record: traefik traefik · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Broken access control
- [AVideo AD_Server Stored XSS via log.php label parameter](https://agentprime.io/advisories/CVE-2026-88869.md)
`CVE-2026-88869` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [AVideo LiveLinks Stored XSS via title and description fields](https://agentprime.io/advisories/CVE-2026-88868.md)
`CVE-2026-88868` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WWBN AVideo Stored XSS via Category Name and Icon Class](https://agentprime.io/advisories/CVE-2026-88867.md)
`CVE-2026-88867` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [WWBN AVideo LoginControl Stored XSS via User-Agent Header](https://agentprime.io/advisories/CVE-2026-88866.md)
`CVE-2026-88866` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Capgo SSO Provider Authentication Bypass via PostgREST Direct Write](https://agentprime.io/advisories/CVE-2026-88864.md)
`CVE-2026-88864` · CVE record: Cap-go capgo.app · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Broken access control
- [Capgo Authorization Bypass via Stale Channel Permission Overrides](https://agentprime.io/advisories/CVE-2026-88860.md)
`CVE-2026-88860` · CVE record: Cap-go capgo.app · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: Broken access control
- [SQLi in GIS Informatics' GisLab Laboratory Management System](https://agentprime.io/advisories/CVE-2026-9163.md)
`CVE-2026-9163` · CVE record: GIS Informatics GisLab Laboratory Management System · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: SQL injection
- [Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property < 4.1.4](https://agentprime.io/advisories/CVE-2026-78082.md)
`CVE-2026-78082` · CVE record: joomshaper.com SP Property extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: SQL injection
Newest:
Older:
## Filters and formats
Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.
- The same list as JSON:
- Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`)
---
The web page: . Everything for agents: .