# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution](https://agentprime.io/advisories/CVE-2026-19759.md)
  `CVE-2026-19759` · CVE record: Google Cloud Application Integration · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [FAST FAC1200R MmtAtePrase stack-based overflow](https://agentprime.io/advisories/CVE-2026-101038.md)
  `CVE-2026-101038` · CVE record: FAST FAC1200R · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Memory corruption
- [FAST FAC1200R devdiscover Service parse_advertisement_frame stack-based overflow](https://agentprime.io/advisories/CVE-2026-101037.md)
  `CVE-2026-101037` · CVE record: FAST FAC1200R · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Memory corruption
- [Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint](https://agentprime.io/advisories/CVE-2026-82384.md)
  `CVE-2026-82384` · CVE record: Apache Software Foundation Apache Roller · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Insecure deserialization
- [Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers](https://agentprime.io/advisories/CVE-2026-82377.md)
  `CVE-2026-82377` · CVE record: Apache Software Foundation Apache Roller · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [Apache Roller: OAuth authorization endpoint trusts request-supplied identity](https://agentprime.io/advisories/CVE-2026-82378.md)
  `CVE-2026-82378` · CVE record: Apache Software Foundation Apache Roller · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [aaPanel BaoTa Unzip panelTask.py panelTask.bt_task.\_unzip os command injection](https://agentprime.io/advisories/CVE-2026-101009.md)
  `CVE-2026-101009` · CVE record: aaPanel BaoTa · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Command injection
- [aaPanel BaoTa File Merge files.py merge_split_file command injection](https://agentprime.io/advisories/CVE-2026-101008.md)
  `CVE-2026-101008` · CVE record: aaPanel BaoTa · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Other injection, Command injection
- [aaPanel BaoTa Database Backup database.py InputSql os command injection](https://agentprime.io/advisories/CVE-2026-101007.md)
  `CVE-2026-101007` · CVE record: aaPanel BaoTa · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Command injection
- [Netcore NBR200V2 Tools Ping network_tools system os command injection](https://agentprime.io/advisories/CVE-2026-101002.md)
  `CVE-2026-101002` · CVE record: Netcore NBR200V2 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Command injection
- [Netcore NBR200V2 Web Management network_tools eval os command injection](https://agentprime.io/advisories/CVE-2026-101001.md)
  `CVE-2026-101001` · CVE record: Netcore NBR200V2 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Command injection
- [Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization](https://agentprime.io/advisories/CVE-2026-101000.md)
  `CVE-2026-101000` · CVE record: Netcore NBR100V2 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [TOTOLINK N150RT Web Management formWlSiteSurvey system os command injection](https://agentprime.io/advisories/CVE-2026-100896.md)
  `CVE-2026-100896` · CVE record: TOTOLINK N150RT · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Command injection
- [Seetong T8108/T8108P/T8116/T8232 Debug Service improper authentication](https://agentprime.io/advisories/CVE-2026-100886.md)
  `CVE-2026-100886` · CVE record: Seetong T8108 and 3 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Sept 2026 · Tags: Authentication bypass
- [Obot Quickstart Docker Deployment Unauthenticated Admin Access](https://agentprime.io/advisories/CVE-2026-101065.md)
  `CVE-2026-101065` · CVE record: obot-platform obot · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Sept 2026 · Tags: Authentication bypass
- [HTTP Request Smuggling](https://agentprime.io/advisories/CVE-2026-88773.md)
  `CVE-2026-88773` · CVE record: Citrix NetScaler ADC and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Sept 2026 · Tags: HTTP request smuggling
- [Memory overflow vulnerability leading to Remote Code Execution or Denial of Service](https://agentprime.io/advisories/CVE-2026-88772.md)
  `CVE-2026-88772` · CVE record: Citrix NetScaler ADC and 1 more · CVSS 9.5 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.77 · Not analysed yet · Published 27 Sept 2026 · Tags: Memory corruption
- [A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands](https://agentprime.io/advisories/CVE-2026-88771.md)
  `CVE-2026-88771` · CVE record: Citrix NetScaler ADC and 1 more · CVSS 9.5 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.82 · Not analysed yet · Published 27 Sept 2026 · Tags: CWE-20
- [Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer](https://agentprime.io/advisories/CVE-2026-100741.md)
  `CVE-2026-100741` · CVE record: Progressive Robot Ltd hMailServer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Sept 2026 · Tags: Code injection
- [Contrast before 1.16.0 Remote Attestation Relay Attack](https://agentprime.io/advisories/CVE-2026-100835.md)
  `CVE-2026-100835` · CVE record: edgelesssys contrast · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Sept 2026 · Tags: Weak cryptography or TLS
- [D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write](https://agentprime.io/advisories/CVE-2026-100740.md)
  `CVE-2026-100740` · CVE record: D-Link DIR-895L · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Sept 2026 · Tags: Memory corruption
- [Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field](https://agentprime.io/advisories/CVE-2026-82901.md)
  `CVE-2026-82901` · CVE record: themefic Ultra Addons for Contact Form 7 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Unrestricted file upload
- [miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter](https://agentprime.io/advisories/CVE-2026-85984.md)
  `CVE-2026-85984` · CVE record: cyberlord92 miniOrange OTP Login, Verification and SMS Notifications · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Authentication bypass
- [Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29](https://agentprime.io/advisories/CVE-2026-97161.md)
  `CVE-2026-97161` · CVE record: lomart.fr UP plugin for Joomla · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal, Broken access control
- [Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29](https://agentprime.io/advisories/CVE-2026-97163.md)
  `CVE-2026-97163` · CVE record: lomart.fr UP plugin for Joomla · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal, Broken access control
- [Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29](https://agentprime.io/advisories/CVE-2026-97160.md)
  `CVE-2026-97160` · CVE record: lomart.fr UP plugin for Joomla · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Code injection
- [Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0](https://agentprime.io/advisories/CVE-2026-94132.md)
  `CVE-2026-94132` · CVE record: Datasolution AcyMailing Enterprise extension for Joomla · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Unrestricted file upload
- [Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3](https://agentprime.io/advisories/CVE-2026-94130.md)
  `CVE-2026-94130` · CVE record: joomlaboat.com YouTube Gallery extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: SQL injection
- [Froxlor before 2.3.12 Stored XSS via SSL certificate issuer](https://agentprime.io/advisories/CVE-2026-100720.md)
  `CVE-2026-100720` · CVE record: froxlor froxlor · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Froxlor before 2.3.12 Privilege Escalation via Symlink](https://agentprime.io/advisories/CVE-2026-100716.md)
  `CVE-2026-100716` · CVE record: froxlor froxlor · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal
- [Froxlor before 2.3.12 Command Injection via letsencryptchallengepath](https://agentprime.io/advisories/CVE-2026-100714.md)
  `CVE-2026-100714` · CVE record: froxlor froxlor · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Command injection
- [kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath](https://agentprime.io/advisories/CVE-2026-100706.md)
  `CVE-2026-100706` · CVE record: kyverno kyverno · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: CWE-441
- [Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC](https://agentprime.io/advisories/CVE-2026-100684.md)
  `CVE-2026-100684` · CVE record: budibase server · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Authentication bypass
- [Flowise through 3.1.4 Authentication Bypass via Email-Only SSO](https://agentprime.io/advisories/CVE-2026-100607.md)
  `CVE-2026-100607` · CVE record: FlowiseAI Flowise · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Authentication bypass
- [Flowise through 3.1.4 Authentication Bypass via SSO Email Match](https://agentprime.io/advisories/CVE-2026-100606.md)
  `CVE-2026-100606` · CVE record: FlowiseAI Flowise · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Authentication bypass
- [Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler](https://agentprime.io/advisories/CVE-2026-18143.md)
  `CVE-2026-18143` · CVE record: Addify Request a Quote for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Unrestricted file upload
- [OpenClaw iOS Control UI TLS Pin Enforcement Bypass](https://agentprime.io/advisories/CVE-2026-100551.md)
  `CVE-2026-100551` · CVE record: OpenClaw OpenClaw · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Weak cryptography or TLS
- [Unauthenticated remote code execution through wikitext in ExternalData](https://agentprime.io/advisories/CVE-2026-100382.md)
  `CVE-2026-100382` · CVE record: Wikimedia Foundation Mediawiki - ExternalData Extension · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Command injection
- [Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6](https://agentprime.io/advisories/CVE-2026-100390.md)
  `CVE-2026-100390` · CVE record: tobychui zoraxy · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass
- [GestSup before 3.2.62 Remote Code Execution via IMAP Attachment](https://agentprime.io/advisories/CVE-2026-100389.md)
  `CVE-2026-100389` · CVE record: GestSup GestSup · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Unrestricted file upload
- [GLPI: RCE via Form import](https://agentprime.io/advisories/CVE-2026-48482.md)
  `CVE-2026-48482` · CVE record: glpi-project glpi · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal
- [Zammad: Account takeover via unverified email matching during SSO auto-link](https://agentprime.io/advisories/CVE-2026-84458.md)
  `CVE-2026-84458` · CVE record: zammad zammad · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass
- [X-SpringBoot through 6.0 Authentication Bypass via Static Master Code](https://agentprime.io/advisories/CVE-2026-97064.md)
  `CVE-2026-97064` · CVE record: yzcheng90 X-SpringBoot · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-1392
- [X-SpringBoot through 6.0 Authentication Bypass via Login Code](https://agentprime.io/advisories/CVE-2026-97063.md)
  `CVE-2026-97063` · CVE record: yzcheng90 X-SpringBoot · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass
- [FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider](https://agentprime.io/advisories/GHSA-g7vj-c29h-3h5m.md)
  `GHSA-g7vj-c29h-3h5m`, `CVE-2026-92161`, `PKSA-4zg4-dqk9-5wt7` · Packagist `fof/oauth`: affected `<1.7.4 || >=2.0.0-beta.1, <2.0.0-beta.4`, fixed in `1.7.4`, `2.0.0-beta.4` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-345
- [Piwigo: Authenticated RCE via File Upload in Logo Upload Feature](https://agentprime.io/advisories/CVE-2026-42322.md)
  `CVE-2026-42322` · CVE record: Piwigo Piwigo · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Unrestricted file upload
- [Piwigo: Unauthenticated SQL injection in \`pwg.images.filteredSearch.create\`](https://agentprime.io/advisories/CVE-2026-62262.md)
  `CVE-2026-62262` · CVE record: Piwigo Piwigo · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: SQL injection
- [InvoicePlane: Remote Code Execution via Writable Templates Directory](https://agentprime.io/advisories/CVE-2026-39353.md)
  `CVE-2026-39353` · CVE record: InvoicePlane InvoicePlane · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: File inclusion, Broken access control, CWE-693
- [Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address](https://agentprime.io/advisories/CVE-2026-93647.md)
  `CVE-2026-93647` · CVE record: Zimbra Zimbra Collaboration Suite (ZCS) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request](https://agentprime.io/advisories/CVE-2026-93643.md)
  `CVE-2026-93643` · CVE record: Zimbra Zimbra Collaboration Suite (ZCS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Path traversal, Broken access control
- [Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation](https://agentprime.io/advisories/CVE-2026-93642.md)
  `CVE-2026-93642` · CVE record: Zimbra Zimbra Collaboration Suite (ZCS) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation](https://agentprime.io/advisories/CVE-2026-93641.md)
  `CVE-2026-93641` · CVE record: Zimbra Zimbra Collaboration Suite (ZCS) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Cross-site scripting (XSS)
- [RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters](https://agentprime.io/advisories/CVE-2026-100075.md)
  `CVE-2026-100075` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026
- [Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell](https://agentprime.io/advisories/CVE-2026-95832.md)
  `CVE-2026-95832` · CVE record: Kovid Goyal kitty · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Other injection
- [Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication](https://agentprime.io/advisories/CVE-2026-92609.md)
  `CVE-2026-92609` · CVE record: Apache Software Foundation Apache Qpid Broker-J · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass
- [Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter](https://agentprime.io/advisories/CVE-2026-14281.md)
  `CVE-2026-14281` · CVE record: 101gen Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Privilege escalation
- [Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter](https://agentprime.io/advisories/CVE-2026-93399.md)
  `CVE-2026-93399` · CVE record: ladela Online Scheduling and Appointment Booking System – Bookly · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control
- [Customer Reviews for WooCommerce <= 5.120.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items\[\]\[media\]' Parameter](https://agentprime.io/advisories/CVE-2026-89055.md)
  `CVE-2026-89055` · CVE record: ivole Customer Reviews for WooCommerce · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control
- [Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verif…](https://agentprime.io/advisories/CVE-2026-92289.md)
  `CVE-2026-92289` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass
- [Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not v…](https://agentprime.io/advisories/CVE-2026-92288.md)
  `CVE-2026-92288` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Sept 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA5LTI1VDAwOjEwOjI0LjUwMDAwMFoiLCJDVkUtMjAyNi05MjI4OCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA5LTI4VDEwOjQ1OjEzLjY0OTAwMFoiLCJDVkUtMjAyNi0xMDEwMzkiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA5LTI4VDEwOjQ1OjEzLjY0OTAwMFoiLCJDVkUtMjAyNi0xMDEwMzkiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.