# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL](https://agentprime.io/advisories/CVE-2026-97230.md)
  `CVE-2026-97230` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-506
- [Botslab G980H Dashcams Insufficient Verification of Data Authenticity](https://agentprime.io/advisories/CVE-2026-81630.md)
  `CVE-2026-81630` · CVE record: Botslab G980H · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-345
- [DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution](https://agentprime.io/advisories/GHSA-fm8p-53ww-hf6w.md)
  `GHSA-fm8p-53ww-hf6w`, `CVE-2026-61742` · npm `@bytebase/dbhub`: affected `<0.22.5`, fixed in `0.22.5` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Authentication bypass, CWE-346
- [http4s-scala-xml has an XML External Entity (XXE) processing issue](https://agentprime.io/advisories/GHSA-cjx3-73hr-rpw7.md)
  `GHSA-cjx3-73hr-rpw7`, `CVE-2026-61741` · Maven `org.http4s:http4s-scala-xml_2.12` and 2 more: affected `<0.24.1`, fixed in `0.24.1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: XML external entities (XXE)
- [Improper certificate validation in Eufy Omni C20](https://agentprime.io/advisories/CVE-2026-93291.md)
  `CVE-2026-93291` · CVE record: Eufy Omni C20 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Weak cryptography or TLS
- [OS command injection in Eufy Omni C20, Omni X10 Pro](https://agentprime.io/advisories/CVE-2026-93289.md)
  `CVE-2026-93289` · CVE record: Eufy Omni C20 and 1 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection
- [ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass](https://agentprime.io/advisories/GHSA-w3rp-4cm2-4wgc.md)
  `GHSA-w3rp-4cm2-4wgc`, `CVE-2026-61604`, `GO-2026-6595` · Go `github.com/ixofoundation/ixo-blockchain` and 6 more: affected `<=1.6.0`, no fixed version yet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Broken access control
- [Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context](https://agentprime.io/advisories/GHSA-g5f9-3xfg-p9mf.md)
  `GHSA-g5f9-3xfg-p9mf`, `CVE-2026-61732`, `PYSEC-2026-4032`, `PYSEC-2026-4033`, `PYSEC-2026-4034` · PyPI `decepticon` and 2 more: affected `<1.1.17`, fixed in `1.1.17` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Other injection
- [Unauthenticated Sensitive Data Disclosure in ServiceNow AI Platform](https://agentprime.io/advisories/CVE-2026-86860.md)
  `CVE-2026-86860` · CVE record: ServiceNow ServiceNow AI Platform · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Broken access control
- [Unauthenticated SQL Injection in ServiceNow AI Platform](https://agentprime.io/advisories/CVE-2026-13016.md)
  `CVE-2026-13016` · CVE record: ServiceNow ServiceNow AI Platform · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: SQL injection
- [Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040](https://agentprime.io/advisories/CVE-2026-13249.md)
  `CVE-2026-13249` · CVE record: Honeywell PD45 Industrial Printer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection, Authentication bypass, Unrestricted file upload
- [RDMA/rtrs-srv: Fix integer underflow in process_read and process_write](https://agentprime.io/advisories/CVE-2026-97413.md)
  `CVE-2026-97413` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026
- [Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email](https://agentprime.io/advisories/CVE-2026-79766.md)
  `CVE-2026-79766` · CVE record: Termix-SSH Termix · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection
- [Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root](https://agentprime.io/advisories/CVE-2026-93425.md)
  `CVE-2026-93425` · CVE record: Dokploy dokploy · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Command injection
- [svcrdma: Reject Write/Reply chunks with segcount 0](https://agentprime.io/advisories/CVE-2026-93228.md)
  `CVE-2026-93228` · CVE record: Linux Linux · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026
- [SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry](https://agentprime.io/advisories/CVE-2026-93207.md)
  `CVE-2026-93207` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026
- [SunEditor: Critical XSS vulnerability - sanitizer bypass](https://agentprime.io/advisories/GHSA-6rf4-v2fh-m6p4.md)
  `GHSA-6rf4-v2fh-m6p4`, `CVE-2026-59167` · npm `suneditor`: affected `<2.47.11`, fixed in `2.47.11` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Cross-site scripting (XSS)
- [In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header.](https://agentprime.io/advisories/CVE-2026-97404.md)
  `CVE-2026-97404` · CVE record: OpenStack Zaqar · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-348
- [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-81549.md)
  `CVE-2026-81549` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Authentication bypass in PortSwigger Burp Suite DAST](https://agentprime.io/advisories/CVE-2026-90481.md)
  `CVE-2026-90481` · CVE record: PortSwigger Burp Suite DAST · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Authentication bypass
- [HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine](https://agentprime.io/advisories/CVE-2026-97360.md)
  `CVE-2026-97360` · CVE record: rejetto hfs2 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Broken access control
- [HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection](https://agentprime.io/advisories/CVE-2026-97359.md)
  `CVE-2026-97359` · CVE record: rejetto hfs2 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Code injection
- [Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy](https://agentprime.io/advisories/GHSA-rj24-g8cc-g7g2.md)
  `GHSA-rj24-g8cc-g7g2`, `CVE-2026-91187`, `EEF-CVE-2026-91187` · Hex `nimble_zta`: affected `>=0.1.2, <0.1.3`, fixed in `0.1.3` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Weak cryptography or TLS
- [Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal](https://agentprime.io/advisories/CVE-2026-19072.md)
  `CVE-2026-19072` · CVE record: Rapid7 Velociraptor · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-164, CWE-1269
- [Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter](https://agentprime.io/advisories/CVE-2026-12227.md)
  `CVE-2026-12227` · CVE record: visualcomposer Visual Composer Website Builder · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: File inclusion
- [Path Traversal in DIAEnergie](https://agentprime.io/advisories/CVE-2026-78312.md)
  `CVE-2026-78312` · CVE record: Deltaww DIAEnergie · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Path traversal
- [Authentication Bypass in DIAEnergie](https://agentprime.io/advisories/CVE-2026-78308.md)
  `CVE-2026-78308` · CVE record: Deltaww DIAEnergie · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Authentication bypass
- [D-Link DIR-825 rp-l2tp tunnel.c tunnel_set_params out-of-bounds write](https://agentprime.io/advisories/CVE-2026-96891.md)
  `CVE-2026-96891` · CVE record: D-Link DIR-825 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Memory corruption
- [SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret](https://agentprime.io/advisories/CVE-2026-97055.md)
  `CVE-2026-97055` · CVE record: SigNoz signoz · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: CWE-1188
- [Paytium: Mollie payment forms & donations <= 5.0.3 - Unauthenticated Privilege Escalation via 'pt_form_field\[pt-user-role\]' Parameter](https://agentprime.io/advisories/CVE-2026-18467.md)
  `CVE-2026-18467` · CVE record: paytiumsupport Paytium: Mollie payment forms & donations · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Privilege escalation
- [QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag().](https://agentprime.io/advisories/CVE-2026-88378.md)
  `CVE-2026-88378` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Memory corruption
- [minimp3 commit ea99364f contains an integer overflow vulnerability in mp3dec_skip_id3v1() when parsing the APEv2 tag-size field.](https://agentprime.io/advisories/CVE-2026-88365.md)
  `CVE-2026-88365` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Memory corruption
- [An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms.](https://agentprime.io/advisories/CVE-2026-88351.md)
  `CVE-2026-88351` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Memory corruption
- [An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function](https://agentprime.io/advisories/CVE-2026-51996.md)
  `CVE-2026-51996` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Weak cryptography or TLS
- [mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server's WWW-Authenticate header](https://agentprime.io/advisories/CVE-2026-51994.md)
  `CVE-2026-51994` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Double Free in GitLab](https://agentprime.io/advisories/CVE-2026-89078.md)
  `CVE-2026-89078` · CVE record: GitLab GitLab · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Memory corruption
- [Integer Overflow or Wraparound in GitLab](https://agentprime.io/advisories/CVE-2026-93577.md)
  `CVE-2026-93577` · CVE record: GitLab GitLab · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Memory corruption
- [Laravel-Mediable 7.0.0 < 7.0.2 RCE via .pht File Upload](https://agentprime.io/advisories/CVE-2026-93352.md)
  `CVE-2026-93352` · CVE record: plank laravel-mediable · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Unrestricted file upload
- [Multiple Vulnerabilities in IBM Concert Software](https://agentprime.io/advisories/CVE-2026-6928.md)
  `CVE-2026-6928` · CVE record: IBM Concert · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Memory corruption
- [RabbitMQ: Trust-store whitelist by Issuer+Serial only](https://agentprime.io/advisories/CVE-2026-67231.md)
  `CVE-2026-67231` · CVE record: rabbitmq rabbitmq-server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Weak cryptography or TLS
- [Multiple Vulnerabilities in IBM Concert Software](https://agentprime.io/advisories/CVE-2026-6730.md)
  `CVE-2026-6730` · CVE record: IBM Concert · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Memory corruption
- [Multiple Vulnerabilities in IBM Concert Software](https://agentprime.io/advisories/CVE-2026-6721.md)
  `CVE-2026-6721` · CVE record: IBM Concert · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection
- [RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch](https://agentprime.io/advisories/CVE-2026-67404.md)
  `CVE-2026-67404` · CVE record: rabbitmq rabbitmq-server · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Weak cryptography or TLS
- [Execution with unnecessary privileges in WebPros cPanel](https://agentprime.io/advisories/CVE-2026-87899.md)
  `CVE-2026-87899` · CVE record: WebPros cPanel · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Privilege escalation
- [Argument injection in WebPros WP Toolkit for cPanel](https://agentprime.io/advisories/CVE-2026-87900.md)
  `CVE-2026-87900` · CVE record: WebPros WP Toolkit for cPanel · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection
- [OS command injection in WebPros Plesk extension "Site Import"](https://agentprime.io/advisories/CVE-2026-87898.md)
  `CVE-2026-87898` · CVE record: WebPros Plesk extension "Site Import" · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection
- [Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)](https://agentprime.io/advisories/CVE-2026-84719.md)
  `CVE-2026-84719` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 and 4 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control
- [Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups](https://agentprime.io/advisories/CVE-2026-75884.md)
  `CVE-2026-75884` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 and 4 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-184
- [s2s-proxy accepts untrusted client certificates](https://agentprime.io/advisories/CVE-2026-96770.md)
  `CVE-2026-96770` · CVE record: Temporal Technologies, Inc. s2s-proxy · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-296
- [OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)](https://agentprime.io/advisories/GHSA-jjq7-m736-w977.md)
  `GHSA-jjq7-m736-w977`, `CVE-2026-77602` · RubyGems `openc3`: affected `>=5.1.0, <7.3.0`, fixed in `7.3.0` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Code injection
- [Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into \`git ls-remote --upload-pack\` yields rce on the controller-task control-plane pod](https://agentprime.io/advisories/CVE-2026-84502.md)
  `CVE-2026-84502` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 and 4 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection
- [Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioni…](https://agentprime.io/advisories/CVE-2026-84474.md)
  `CVE-2026-84474` · CVE record: Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 and 4 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-807
- [WordPress Product Filter by WBW plugin <= 3.1.7 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-95601.md)
  `CVE-2026-95601` · CVE record: WBW Plugins Product Filter by WBW · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [Insecure direct object reference in Claris FileMaker Server](https://agentprime.io/advisories/CVE-2026-86934.md)
  `CVE-2026-86934` · CVE record: Claris FileMaker Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Broken access control
- [Out-of-bounds read in Claris FileMaker Server](https://agentprime.io/advisories/CVE-2026-86930.md)
  `CVE-2026-86930` · CVE record: Claris FileMaker Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Memory corruption
- [orval before 8.29.0 Code Injection via operationId](https://agentprime.io/advisories/CVE-2026-96759.md)
  `CVE-2026-96759` · CVE record: orval-labs orval · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Code injection
- [orval @orval/core before 8.28.0 Code Injection via Form-Data](https://agentprime.io/advisories/CVE-2026-96758.md)
  `CVE-2026-96758` · CVE record: orval-labs orval · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Code injection
- [orval before 8.29.0 Code Injection via unescaped OpenAPI media-type](https://agentprime.io/advisories/CVE-2026-96757.md)
  `CVE-2026-96757` · CVE record: orval-labs orval · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Code injection
- [orval before 8.30.0 Code Injection via Factory Generation](https://agentprime.io/advisories/CVE-2026-96756.md)
  `CVE-2026-96756` · CVE record: orval-labs orval · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Code injection
- [orval @orval/effect 8.14.0 through 8.28.1 Code Injection](https://agentprime.io/advisories/CVE-2026-96755.md)
  `CVE-2026-96755` · CVE record: orval-labs orval · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Code injection

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA5LTIzVDE2OjIzOjUyLjAxMTAwMFoiLCJDVkUtMjAyNi05Njc1NSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA5LTI1VDAwOjEwOjI0LjUwMDAwMFoiLCJDVkUtMjAyNi05MjI4OCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA5LTI1VDAwOjEwOjI0LjUwMDAwMFoiLCJDVkUtMjAyNi05MjI4OCJd>. Everything for agents: <https://agentprime.io/llms.txt>.