# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)](https://agentprime.io/advisories/CVE-2026-75699.md)
  `CVE-2026-75699` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection
- [Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)](https://agentprime.io/advisories/CVE-2026-73369.md)
  `CVE-2026-73369` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection
- [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-82011.md)
  `CVE-2026-82011` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: SQL injection
- [Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2026-82443.md)
  `CVE-2026-82443` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Adobe Campaign Classic (ACC) | Improper Input Validation (CWE-20)](https://agentprime.io/advisories/CVE-2026-82008.md)
  `CVE-2026-82008` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-20
- [Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)](https://agentprime.io/advisories/CVE-2026-89275.md)
  `CVE-2026-89275` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection
- [Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-75728.md)
  `CVE-2026-75728` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-82010.md)
  `CVE-2026-82010` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: SQL injection
- [PHP file inclusion in WordPress](https://agentprime.io/advisories/CVE-2026-87902.md)
  `CVE-2026-87902` · CVE record: WordPress WordPress · CVSS 8.1 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.96 · Not analysed yet · Published 22 Sept 2026 · Tags: File inclusion
- [Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one](https://agentprime.io/advisories/CVE-2026-86059.md)
  `CVE-2026-86059` · CVE record: Dokploy dokploy · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Information disclosure, Broken access control
- [Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys](https://agentprime.io/advisories/CVE-2026-94456.md)
  `CVE-2026-94456` · CVE record: GitroomHQ postiz-app · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Weak cryptography or TLS, CWE-341
- [Databasement before 1.7.14 Authorization Bypass via Stale Invitation Token](https://agentprime.io/advisories/CVE-2026-95654.md)
  `CVE-2026-95654` · CVE record: David-Crty Databasement · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation Bypass](https://agentprime.io/advisories/CVE-2026-80156.md)
  `CVE-2026-80156` · CVE record: LANTRONIX SLC8000 and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Path traversal
- [Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation](https://agentprime.io/advisories/CVE-2026-80155.md)
  `CVE-2026-80155` · CVE record: LANTRONIX SLC8000 and 4 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Path traversal
- [Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule](https://agentprime.io/advisories/CVE-2026-80152.md)
  `CVE-2026-80152` · CVE record: LANTRONIX SLC8000 and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection
- [Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs download](https://agentprime.io/advisories/CVE-2026-80151.md)
  `CVE-2026-80151` · CVE record: LANTRONIX SLC8000 and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection
- [Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom write](https://agentprime.io/advisories/CVE-2026-80147.md)
  `CVE-2026-80147` · CVE record: LANTRONIX SLC8000 and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Memory corruption
- [Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom read](https://agentprime.io/advisories/CVE-2026-80146.md)
  `CVE-2026-80146` · CVE record: LANTRONIX SLC8000 and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Memory corruption
- [Vector: Arbitrary file write in the file sink via templated path (path traversal).](https://agentprime.io/advisories/CVE-2026-77621.md)
  `CVE-2026-77621` · CVE record: vectordotdev vector · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Path traversal
- [Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs password](https://agentprime.io/advisories/CVE-2026-80145.md)
  `CVE-2026-80145` · CVE record: LANTRONIX SLC8000 and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection
- [Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write](https://agentprime.io/advisories/CVE-2026-80144.md)
  `CVE-2026-80144` · CVE record: LANTRONIX SLC8000 and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection
- [Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom read](https://agentprime.io/advisories/CVE-2026-80143.md)
  `CVE-2026-80143` · CVE record: LANTRONIX SLC8000 and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection
- [BIG-IP APM OAuth vulnerability](https://agentprime.io/advisories/CVE-2026-94127.md)
  `CVE-2026-94127` · CVE record: F5 BIG-IP · CVSS 9.3 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.27 · Not analysed yet · Published 22 Sept 2026 · Tags: Memory corruption
- [Clickjacking in Fortinet FortiPAM Chrome Extension](https://agentprime.io/advisories/CVE-2026-84388.md)
  `CVE-2026-84388` · CVE record: Fortinet FortiPAM Chrome Extension · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-1021
- [Hard-coded credentials in NVIDIA Infrastructure Controller](https://agentprime.io/advisories/CVE-2026-65113.md)
  `CVE-2026-65113` · CVE record: NVIDIA Infrastructure Controller · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Hard-coded credentials
- [CVE-2026-93088](https://agentprime.io/advisories/CVE-2026-93088.md)
  `CVE-2026-93088` · CVE record: SGLang SGLang · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Insecure deserialization
- [SQLi in Karel Electronics' KarelIPS](https://agentprime.io/advisories/CVE-2026-12718.md)
  `CVE-2026-12718` · CVE record: Karel Electronic Industry and Trade Inc. KarelIPS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: SQL injection
- [D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface](https://agentprime.io/advisories/CVE-2026-95675.md)
  `CVE-2026-95675` · CVE record: D-LINK DAP-1360 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection
- [Directory Traversal and File upload allows execution of arbitrary script on the Management Server](https://agentprime.io/advisories/CVE-2026-93616.md)
  `CVE-2026-93616` · CVE record: checkpoint Quantum Security Management · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.92 · Not analysed yet · Published 22 Sept 2026 · Tags: Path traversal
- [Remote code execution vulnerability](https://agentprime.io/advisories/CVE-2026-74849.md)
  `CVE-2026-74849` · CVE record: Zohocorp ManageEngine ADSelfService Plus · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection
- [Improper authorization in Qualcomm Software Center](https://agentprime.io/advisories/CVE-2026-25254.md)
  `CVE-2026-25254` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [Direct references to unsafe objects (IDOR) in Tankuam Places by Kompini](https://agentprime.io/advisories/CVE-2026-93556.md)
  `CVE-2026-93556` · CVE record: Kompini Tankuam Places · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension](https://agentprime.io/advisories/CVE-2026-89422.md)
  `CVE-2026-89422` · CVE record: Erlang OTP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-322
- [Security Advisory 0183](https://agentprime.io/advisories/CVE-2026-93952.md)
  `CVE-2026-93952` · CVE record: Arista Networks VeloCloud Orchestrator (VCO) On-Prem · CVSS 9.5 Critical · Critical (KEV, CVSS 9+) · In CISA KEV · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-20
- [Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode](https://agentprime.io/advisories/CVE-2026-87080.md)
  `CVE-2026-87080` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-1286
- [Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode](https://agentprime.io/advisories/CVE-2026-87078.md)
  `CVE-2026-87078` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Denial of service
- [Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode](https://agentprime.io/advisories/CVE-2016-15059.md)
  `CVE-2016-15059` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Memory corruption
- [Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify\[recipient\]\[personalized\]\[\]' Parameter](https://agentprime.io/advisories/CVE-2026-19658.md)
  `CVE-2026-19658` · CVE record: LiquidWeb Give Tributes · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Insecure deserialization
- [Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter](https://agentprime.io/advisories/CVE-2026-13355.md)
  `CVE-2026-13355` · CVE record: Meta Box Meta Box Frontend Submission · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Privilege escalation
- [Gigatech PDV5701 WebSocket Service index.html missing authentication](https://agentprime.io/advisories/CVE-2026-94493.md)
  `CVE-2026-94493` · CVE record: Gigatech PDV5701 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload.](https://agentprime.io/advisories/CVE-2026-88624.md)
  `CVE-2026-88624` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Path traversal
- [MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature.](https://agentprime.io/advisories/CVE-2026-88416.md)
  `CVE-2026-88416` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: SQL injection
- [MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do).](https://agentprime.io/advisories/CVE-2026-88414.md)
  `CVE-2026-88414` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: SQL injection
- [webpy web.py 0.76 is vulnerable to Insufficient Session Expiration.](https://agentprime.io/advisories/CVE-2026-79313.md)
  `CVE-2026-79313` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140006F0C privileges management](https://agentprime.io/advisories/CVE-2026-94425.md)
  `CVE-2026-94425` · CVE record: Moore Threads MTT S80 Driver Package · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Privilege escalation
- [Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint](https://agentprime.io/advisories/CVE-2026-46649.md)
  `CVE-2026-46649` · CVE record: laurent22 joplin · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass
- [MaxKB: Prompt-injectable agent can lead to command execution](https://agentprime.io/advisories/CVE-2026-77521.md)
  `CVE-2026-77521` · CVE record: 1Panel-dev MaxKB · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Command injection, Privilege escalation, CWE-749
- [Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140001000 heap-based overflow](https://agentprime.io/advisories/CVE-2026-94424.md)
  `CVE-2026-94424` · CVE record: Moore Threads MTT S80 Driver Package · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Memory corruption
- [MaxKB AWS Bedrock model credential injection leads to remote code execution](https://agentprime.io/advisories/CVE-2026-79916.md)
  `CVE-2026-79916` · CVE record: 1Panel-dev MaxKB · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Command injection
- [Code injection in OpenStack Octavia](https://agentprime.io/advisories/CVE-2026-94572.md)
  `CVE-2026-94572` · CVE record: OpenStack Octavia · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Code injection
- [Code injection in OpenStack Octavia](https://agentprime.io/advisories/CVE-2026-94571.md)
  `CVE-2026-94571` · CVE record: OpenStack Octavia · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Code injection
- [Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter](https://agentprime.io/advisories/CVE-2026-58491.md)
  `CVE-2026-58491` · CVE record: warp-tech warpgate · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Cross-site scripting (XSS)
- [ColorFul iGameCenter IOCTL ene.sys sub_140001AF0 untrusted pointer dereference](https://agentprime.io/advisories/CVE-2026-94403.md)
  `CVE-2026-94403` · CVE record: ColorFul iGameCenter · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Memory corruption
- [Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in \_sendmail_pipe](https://agentprime.io/advisories/CVE-2026-93012.md)
  `CVE-2026-93012` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Command injection
- [Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task](https://agentprime.io/advisories/CVE-2026-79920.md)
  `CVE-2026-79920` · CVE record: ajenti ajenti · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [Fluent Bit: Remote stack buffer overflow in Fluent Bit \`out_forward\` Secure-Forward \`PONG\` handler](https://agentprime.io/advisories/CVE-2026-61674.md)
  `CVE-2026-61674` · CVE record: fluent fluent-bit · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Memory corruption
- [Mailu: Authentication bypass in header-based proxy authentication via spoofable \`X-Forwarded-By\` trust](https://agentprime.io/advisories/CVE-2026-85751.md)
  `CVE-2026-85751` · CVE record: Mailu Mailu and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass, CWE-807
- [Apache Airflow: the Core API logout endpoint revokes only a session token presented as the \_token cookie. When a client logs out presenting its credential as an Authorization bearer header instead,...](https://agentprime.io/advisories/PYSEC-2026-3990.md)
  `PYSEC-2026-3990`, `BIT-airflow-2026-86473`, `CVE-2026-86473` · PyPI `apache-airflow`: affected `>=3.0.0, <3.3.2`, fixed in `3.3.2` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Authentication bypass
- [Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232](https://agentprime.io/advisories/CVE-2026-94301.md)
  `CVE-2026-94301` · CVE record: Apache Software Foundation Apache MINA · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: Insecure deserialization
- [Insufficient verification of data authenticity in Eclipse Foundation Eclipse Open VSX](https://agentprime.io/advisories/CVE-2025-12999.md)
  `CVE-2025-12999` · CVE record: Eclipse Foundation Eclipse Open VSX · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Sept 2026 · Tags: CWE-345

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA5LTIxVDA4OjU5OjAwLjQ2NTAwMFoiLCJDVkUtMjAyNS0xMjk5OSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA5LTIyVDE3OjM5OjU2LjE5NzAwMFoiLCJDVkUtMjAyNi03NTcyMyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA5LTIyVDE3OjM5OjU2LjE5NzAwMFoiLCJDVkUtMjAyNi03NTcyMyJd>. Everything for agents: <https://agentprime.io/llms.txt>.