# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard](https://agentprime.io/advisories/GHSA-ffc3-869f-jxw9.md)
  `GHSA-ffc3-869f-jxw9`, `CVE-2026-102268`, `PYSEC-2026-4145` · PyPI `pyjwt`: affected `<2.14.0`, fixed in `2.14.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Weak cryptography or TLS
- [Ziroom ZHOME A0101 set_time_zone command injection](https://agentprime.io/advisories/CVE-2026-102793.md)
  `CVE-2026-102793` · CVE record: Ziroom ZHOME A0101 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Other injection, Command injection
- [Fireware OS Code Injection in BOVPN Over TLS Client Allows Remote Code Execution](https://agentprime.io/advisories/CVE-2026-86131.md)
  `CVE-2026-86131` · CVE record: WatchGuard Fireware OS · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Code injection, Weak cryptography or TLS, CWE-829
- [LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Embed Cache RPyC Service](https://agentprime.io/advisories/CVE-2026-103041.md)
  `CVE-2026-103041` · CVE record: ModelTC LightLLM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Insecure deserialization
- [LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service](https://agentprime.io/advisories/CVE-2026-103040.md)
  `CVE-2026-103040` · CVE record: ModelTC LightLLM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Insecure deserialization
- [EasyTimeline should not serve image maps as application/xml](https://agentprime.io/advisories/CVE-2026-103044.md)
  `CVE-2026-103044` · CVE record: The Wikimedia Foundation Mediawiki - EasyTimeline extension · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal, Other injection
- [Ziroom ZHOME A0101 set_syslog command injection](https://agentprime.io/advisories/CVE-2026-102792.md)
  `CVE-2026-102792` · CVE record: Ziroom ZHOME A0101 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Other injection, Command injection
- [Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type](https://agentprime.io/advisories/CVE-2026-70356.md)
  `CVE-2026-70356` · CVE record: Toptech Systems TMS7 and 1 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Unrestricted file upload
- [Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties](https://agentprime.io/advisories/CVE-2026-71379.md)
  `CVE-2026-71379` · CVE record: Toptech Systems TMS7 and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure
- [Use of Hard-coded Credentials in Viidure Dashcam Android Application](https://agentprime.io/advisories/CVE-2026-96587.md)
  `CVE-2026-96587` · CVE record: Viidure Dashcam Android Application · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Hard-coded credentials
- [Dockhand < 1.0.40 Unauthenticated Webhook Trigger via Git Webhook Endpoints](https://agentprime.io/advisories/CVE-2026-53988.md)
  `CVE-2026-53988` · CVE record: Finsys dockhand · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Authentication bypass
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-102308.md)
  `CVE-2026-102308` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-102309.md)
  `CVE-2026-102309` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-102304.md)
  `CVE-2026-102304` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-102316.md)
  `CVE-2026-102316` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-102306.md)
  `CVE-2026-102306` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Heap-based buffer overflow in Google Chrome](https://agentprime.io/advisories/CVE-2026-102331.md)
  `CVE-2026-102331` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Initialization of a resource with an insecure default in Anjvision YSSD-RTMP-H5](https://agentprime.io/advisories/CVE-2026-100291.md)
  `CVE-2026-100291` · CVE record: Anjvision YSSD-RTMP-H5 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-1188
- [Authentication Bypass in a Management Protocol of HPE Networking Instant ON APs](https://agentprime.io/advisories/CVE-2026-76725.md)
  `CVE-2026-76725` · CVE record: Hewlett Packard Enterprise (HPE) Instant ON · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Authentication bypass
- [Unauthenticated Adjacent Command Injection Vulnerability in HPE Networking Instant ON APs Command Line Interface (CLI) Accessed by the PAPI Protocol](https://agentprime.io/advisories/CVE-2026-76724.md)
  `CVE-2026-76724` · CVE record: Hewlett Packard Enterprise (HPE) Instant ON · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Command injection
- [Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking Instant ON APS](https://agentprime.io/advisories/CVE-2026-76723.md)
  `CVE-2026-76723` · CVE record: Hewlett Packard Enterprise (HPE) Instant ON · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Uncontrolled Format String Vulnerabilities lead to Remote Code Execution or Denial-of-Service in HPE Networking Instant ON APs](https://agentprime.io/advisories/CVE-2026-76722.md)
  `CVE-2026-76722` · CVE record: Hewlett Packard Enterprise (HPE) Instant ON · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in HPE Networking Instant ON APs](https://agentprime.io/advisories/CVE-2026-76721.md)
  `CVE-2026-76721` · CVE record: Hewlett Packard Enterprise (HPE) Instant ON · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-84436.md)
  `CVE-2026-84436` · CVE record: IBM Guardium Data Protection · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Command injection
- [Google Chrome: Free of non-heap memory in Fonts in Google Chrome prior to 154.0.8037.57 allowed a remote…](https://agentprime.io/advisories/CVE-2026-95311.md)
  `CVE-2026-95311` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-590
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-95347.md)
  `CVE-2026-95347` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-95325.md)
  `CVE-2026-95325` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds write in Google Chrome](https://agentprime.io/advisories/CVE-2026-95331.md)
  `CVE-2026-95331` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-95299.md)
  `CVE-2026-95299` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Heap-based buffer overflow in Google Chrome](https://agentprime.io/advisories/CVE-2026-95318.md)
  `CVE-2026-95318` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-95277.md)
  `CVE-2026-95277` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Heap-based buffer overflow in Google Chrome](https://agentprime.io/advisories/CVE-2026-95283.md)
  `CVE-2026-95283` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-95310.md)
  `CVE-2026-95310` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-95356.md)
  `CVE-2026-95356` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds write in Google Chrome](https://agentprime.io/advisories/CVE-2026-95329.md)
  `CVE-2026-95329` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Heap-based buffer overflow in Google Chrome](https://agentprime.io/advisories/CVE-2026-95284.md)
  `CVE-2026-95284` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Heap-based buffer overflow in Google Chrome](https://agentprime.io/advisories/CVE-2026-95349.md)
  `CVE-2026-95349` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-95313.md)
  `CVE-2026-95313` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Heap-based buffer overflow in Google Chrome](https://agentprime.io/advisories/CVE-2026-95281.md)
  `CVE-2026-95281` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-95339.md)
  `CVE-2026-95339` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds write in Google Chrome](https://agentprime.io/advisories/CVE-2026-95357.md)
  `CVE-2026-95357` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Heap-based buffer overflow in Google Chrome](https://agentprime.io/advisories/CVE-2026-95350.md)
  `CVE-2026-95350` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Out-of-bounds write in Eclipse Foundation NetX Duo](https://agentprime.io/advisories/CVE-2026-102761.md)
  `CVE-2026-102761` · CVE record: Eclipse Foundation NetX Duo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4](https://agentprime.io/advisories/CVE-2026-102425.md)
  `CVE-2026-102425` · CVE record: balbooa.com Balbooa Forms extension for Joomla · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Code injection
- [TemplateSandbox does not check read permissions for the page being previewed](https://agentprime.io/advisories/CVE-2026-100240.md)
  `CVE-2026-100240` · CVE record: Wikimedia Foundation Mediawiki - TemplateSandbox Extension · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname](https://agentprime.io/advisories/CVE-2023-54400.md)
  `CVE-2023-54400` · CVE record: Fumasoft Fumeng Cloud · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: SQL injection
- [Webmin: Reflected XSS in the Configuration module](https://agentprime.io/advisories/CVE-2026-49243.md)
  `CVE-2026-49243` · CVE record: webmin webmin · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Weak root password in EVbee DC 80](https://agentprime.io/advisories/CVE-2026-22094.md)
  `CVE-2026-22094` · CVE record: EVbee DC 80 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Hard-coded credentials
- [Mitigation bypass in the DOM: Security component](https://agentprime.io/advisories/CVE-2026-100829.md)
  `CVE-2026-100829` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-693
- [Mitigation bypass in the Bookmarks & History component](https://agentprime.io/advisories/CVE-2026-100828.md)
  `CVE-2026-100828` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-693
- [Sandbox escape due to incorrect boundary conditions in the XPCOM component](https://agentprime.io/advisories/CVE-2026-100819.md)
  `CVE-2026-100819` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Sandbox escape due to use-after-free in the Widget: Gtk component](https://agentprime.io/advisories/CVE-2026-100818.md)
  `CVE-2026-100818` · CVE record: Mozilla Thunderbird and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Sandbox escape due to use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-100811.md)
  `CVE-2026-100811` · CVE record: Mozilla Thunderbird and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Other issue in the DevTools component](https://agentprime.io/advisories/CVE-2026-100810.md)
  `CVE-2026-100810` · CVE record: Mozilla Thunderbird and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure
- [Sandbox escape due to use-after-free in the Preferences: Backend component](https://agentprime.io/advisories/CVE-2026-100804.md)
  `CVE-2026-100804` · CVE record: Mozilla Thunderbird and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Sandbox escape due to use-after-free in the Disability Access APIs component](https://agentprime.io/advisories/CVE-2026-100800.md)
  `CVE-2026-100800` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Sandbox escape due to incorrect boundary conditions in the Internationalization component](https://agentprime.io/advisories/CVE-2026-100794.md)
  `CVE-2026-100794` · CVE record: Mozilla Thunderbird and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Invalid pointer in the JavaScript: WebAssembly component](https://agentprime.io/advisories/CVE-2026-100788.md)
  `CVE-2026-100788` · CVE record: Mozilla Thunderbird and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption
- [Sandbox escape in the XUL component](https://agentprime.io/advisories/CVE-2026-100787.md)
  `CVE-2026-100787` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-20
- [Sandbox escape due to use-after-free in the Graphics component](https://agentprime.io/advisories/CVE-2026-100786.md)
  `CVE-2026-100786` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Memory corruption

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA5LTI5VDEyOjM2OjEwLjE2MTAwMFoiLCJDVkUtMjAyNi0xMDA3ODYiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA5LTI5VDIzOjMwOjEwLjAxNTAwMFoiLCJDVkUtMjAyNi0xMDI3OTQiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA5LTI5VDIzOjMwOjEwLjAxNTAwMFoiLCJDVkUtMjAyNi0xMDI3OTQiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.