# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path](https://agentprime.io/advisories/CVE-2026-96754.md)
  `CVE-2026-96754` · CVE record: orval-labs orval · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Code injection
- [Plex Media Server arbitrary file write](https://agentprime.io/advisories/CVE-2026-96656.md)
  `CVE-2026-96656` · CVE record: Plex Media Server · CVSS 8.6 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 23 Sept 2026 · Tags: Path traversal
- [Plex Media Server arbitrary-host SSRF](https://agentprime.io/advisories/CVE-2026-96655.md)
  `CVE-2026-96655` · CVE record: Plex Media Server · CVSS 5.3 Medium · Critical (KEV) · In CISA KEV · EPSS 0.11 · Not analysed yet · Published 23 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Plex Media Server URL injection](https://agentprime.io/advisories/CVE-2026-96654.md)
  `CVE-2026-96654` · CVE record: Plex Media Server · CVSS 6.9 Medium · Critical (KEV) · In CISA KEV · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-84
- [Plex Media Server SSRF](https://agentprime.io/advisories/CVE-2026-96652.md)
  `CVE-2026-96652` · CVE record: Plex Media Server · CVSS 5.3 Medium · Critical (KEV) · In CISA KEV · EPSS 0.12 · Not analysed yet · Published 23 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-18872.md)
  `CVE-2026-18872` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Cross-site scripting (XSS)
- [plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection](https://agentprime.io/advisories/GHSA-rr49-f9g6-c9r5.md)
  `GHSA-rr49-f9g6-c9r5`, `CVE-2026-57149`, `PYSEC-2026-4138` · PyPI `plone-app-portlets`: affected `>=5.0.0, <5.0.8 || >=6.0.0, <6.0.4 || >=7.0.0, <7.0.2`, fixed in `5.0.8`, `6.0.4`, `7.0.2` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Code injection
- [LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel](https://agentprime.io/advisories/CVE-2026-96560.md)
  `CVE-2026-96560` · CVE record: ModelTC LightLLM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Insecure deserialization
- [Sensitive data exposure](https://agentprime.io/advisories/CVE-2026-86708.md)
  `CVE-2026-86708` · CVE record: Zohocorp ManageEngine Applications Manager · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Hard-coded credentials
- [Remote Code Execution vulnerability](https://agentprime.io/advisories/CVE-2026-19599.md)
  `CVE-2026-19599` · CVE record: Zohocorp ManageEngine OpManager · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection
- [Apache Tomcat Native: Insecure OpenSSL options enabled](https://agentprime.io/advisories/CVE-2026-86246.md)
  `CVE-2026-86246` · CVE record: Apache Software Foundation Apache Tomcat Native · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-1188
- [Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up](https://agentprime.io/advisories/CVE-2026-86350.md)
  `CVE-2026-86350` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: HTTP request smuggling
- [Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled](https://agentprime.io/advisories/CVE-2026-86248.md)
  `CVE-2026-86248` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Authentication bypass
- [Apache Tomcat: Bypass of security constraints for WebSocket endpoints](https://agentprime.io/advisories/CVE-2026-76183.md)
  `CVE-2026-76183` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: CWE-289
- [Apache BuildStream: tar source extraction escape](https://agentprime.io/advisories/CVE-2026-82331.md)
  `CVE-2026-82331` · CVE record: Apache Software Foundation Apache BuildStream · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Path traversal
- [WP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token Substitution](https://agentprime.io/advisories/CVE-2026-82843.md)
  `CVE-2026-82843` · CVE record: Unknown WP OAuth Server ( Login with WordPress ) · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Authentication bypass
- [YAHMAN Add-ons < 0.9.31 - Unauthenticated Arbitrary File Upload via Blog Card Cache](https://agentprime.io/advisories/CVE-2026-75799.md)
  `CVE-2026-75799` · CVE record: Unknown YAHMAN Add-ons · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Code injection
- [Fast FAC1203R Gigabit Edition Device Discovery Service copy_msg_element stack-based overflow](https://agentprime.io/advisories/CVE-2026-96257.md)
  `CVE-2026-96257` · CVE record: Fast FAC1203R Gigabit Edition · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Memory corruption
- [SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests](https://agentprime.io/advisories/CVE-2025-63564.md)
  `CVE-2025-63564` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: SQL injection
- [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-18169.md)
  `CVE-2026-18169` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Path traversal
- [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-18163.md)
  `CVE-2026-18163` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Insecure deserialization
- [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-18162.md)
  `CVE-2026-18162` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection
- [Token Cache Reuse in mcp-toolbox-sdk-python](https://agentprime.io/advisories/CVE-2026-19202.md)
  `CVE-2026-19202` · CVE record: Google mcp-toolbox-sdk-python · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-524
- [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-17645.md)
  `CVE-2026-17645` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Privilege escalation
- [IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities](https://agentprime.io/advisories/CVE-2026-17635.md)
  `CVE-2026-17635` · CVE record: IBM Financial Transaction Manager (FTM) for RedHat OpenShift · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [Multiple Vulnerabilities in IBM Concert Software](https://agentprime.io/advisories/CVE-2026-17472.md)
  `CVE-2026-17472` · CVE record: IBM Concert · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Privilege escalation
- [DataStage on Cloud Pak for Data has several vulnerabilities](https://agentprime.io/advisories/CVE-2026-16346.md)
  `CVE-2026-16346` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [GitHub Enterprise Server notebook viewer vulnerable to Server-side request forgery](https://agentprime.io/advisories/CVE-2026-77987.md)
  `CVE-2026-77987` · CVE record: GitHub Enterprise Server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF), CWE-208
- [Home Assistant: XSS in Statistics Graph Card](https://agentprime.io/advisories/GHSA-wx4m-69m9-gx3m.md)
  `GHSA-wx4m-69m9-gx3m`, `CVE-2026-91130`, `PYSEC-2026-4052` · PyPI `homeassistant`: affected `<2026.7.0`, fixed in `2026.7.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks](https://agentprime.io/advisories/GHSA-frch-4w6v-q5xx.md)
  `GHSA-frch-4w6v-q5xx`, `CVE-2026-85734`, `PYSEC-2026-4062` · PyPI `lightrag-hku`: affected `<1.5.5`, fixed in `1.5.5` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack](https://agentprime.io/advisories/GHSA-34fc-gh42-pj53.md)
  `GHSA-34fc-gh42-pj53`, `BIT-openbao-2026-63132`, `CVE-2026-63132`, `GO-2026-6553` · Go `github.com/openbao/openbao`: affected `<0.0.0-20260713141742-763625a20721 || >=0.1.0, <=1.1.5`, fixed in `0.0.0-20260713141742-763625a20721` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-208
- [\[mcp-atlassian\] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token](https://agentprime.io/advisories/GHSA-wrhw-j3f9-8vc6.md)
  `GHSA-wrhw-j3f9-8vc6`, `CVE-2026-77244`, `PYSEC-2026-4103` · PyPI `mcp-atlassian`: affected `<0.22.0`, fixed in `0.22.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass, Broken access control
- [Out-of-bounds write in lwIP TCP/IP Stack MQTT Client Application](https://agentprime.io/advisories/CVE-2026-87121.md)
  `CVE-2026-87121` · CVE record: lwIP TCP/IP Stack MQTT · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Memory corruption
- [LTSecurity LTK3500SF Hard-coded Credentials via Telnet/SSH](https://agentprime.io/advisories/CVE-2026-47116.md)
  `CVE-2026-47116` · CVE record: LTSecurity LTK3500SF · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Hard-coded credentials
- [CVE-2026-89282](https://agentprime.io/advisories/CVE-2026-89282.md)
  `CVE-2026-89282` · CVE record: Apache HTTP Server Project Apache Lounge Windows · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [Unauthenticated Remote Arbitrary File Write Vulnerability in HPE Networking Analytics and Location Engine (ALE)](https://agentprime.io/advisories/CVE-2026-76709.md)
  `CVE-2026-76709` · CVE record: Hewlett Packard Enterprise (HPE) ALE · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [Unauthenticated Remote Unauthorized Access Vulnerability in HPE Networking Analytics and Location Engine (ALE)](https://agentprime.io/advisories/CVE-2026-76708.md)
  `CVE-2026-76708` · CVE record: Hewlett Packard Enterprise (HPE) ALE · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Hard-coded credentials
- [SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-28324.md)
  `CVE-2026-28324` · CVE record: SolarWinds Observability Self-Hosted · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-345
- [Adobe Experience Manager Forms JEE | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-75745.md)
  `CVE-2026-75745` · CVE record: Adobe AEM 6.5 Forms JEE and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [Adobe Experience Manager Forms JEE | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2026-82000.md)
  `CVE-2026-82000` · CVE record: Adobe AEM 6.5 Forms JEE and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Adobe Experience Manager Forms JEE | Improper Input Validation (CWE-20)](https://agentprime.io/advisories/CVE-2026-81995.md)
  `CVE-2026-81995` · CVE record: Adobe AEM 6.5 Forms JEE and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-20
- [Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75689.md)
  `CVE-2026-75689` · CVE record: Adobe Adobe Connect and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Connect | Improper Input Validation (CWE-20)](https://agentprime.io/advisories/CVE-2026-75686.md)
  `CVE-2026-75686` · CVE record: Adobe Adobe Connect and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-20
- [Adobe Connect | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-75682.md)
  `CVE-2026-75682` · CVE record: Adobe Adobe Connect and 1 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: SQL injection
- [Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75698.md)
  `CVE-2026-75698` · CVE record: Adobe Adobe Connect and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75684.md)
  `CVE-2026-75684` · CVE record: Adobe Adobe Connect and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-75697.md)
  `CVE-2026-75697` · CVE record: Adobe Adobe Connect and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Cross-site scripting (XSS)
- [MCP Atlassian: Unauthenticated HTTP MCP requests can use globally configured Jira and Confluence credentials](https://agentprime.io/advisories/CVE-2026-77254.md)
  `CVE-2026-77254` · CVE record: sooperset mcp-atlassian · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Authentication bypass
- [Softaculous Virtualizor PHP Object Injection via Billing Module Handler](https://agentprime.io/advisories/CVE-2026-43642.md)
  `CVE-2026-43642` · CVE record: Softaculous Virtualizor · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Insecure deserialization
- [Softaculous Virtualizor OS Command Injection via Billing Module Handler](https://agentprime.io/advisories/CVE-2026-43641.md)
  `CVE-2026-43641` · CVE record: Softaculous Virtualizor · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Command injection
- [Use of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries) allows Format String Injection.](https://agentprime.io/advisories/CVE-2026-18461.md)
  `CVE-2026-18461` · CVE record: RTI Connext Professional · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Memory corruption
- [Stack-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers.](https://agentprime.io/advisories/CVE-2026-7866.md)
  `CVE-2026-7866` · CVE record: RTI Connext Professional · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Memory corruption
- [Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)](https://agentprime.io/advisories/CVE-2026-75703.md)
  `CVE-2026-75703` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection
- [Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)](https://agentprime.io/advisories/CVE-2026-84412.md)
  `CVE-2026-84412` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection
- [Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)](https://agentprime.io/advisories/CVE-2026-89276.md)
  `CVE-2026-89276` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection
- [Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2026-83660.md)
  `CVE-2026-83660` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2026-82013.md)
  `CVE-2026-82013` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-82009.md)
  `CVE-2026-82009` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: SQL injection
- [Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)](https://agentprime.io/advisories/CVE-2026-75721.md)
  `CVE-2026-75721` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Code injection
- [Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-75723.md)
  `CVE-2026-75723` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA5LTIyVDE3OjM5OjU2LjE5NzAwMFoiLCJDVkUtMjAyNi03NTcyMyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA5LTIzVDE2OjIzOjUyLjAxMTAwMFoiLCJDVkUtMjAyNi05Njc1NSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA5LTIzVDE2OjIzOjUyLjAxMTAwMFoiLCJDVkUtMjAyNi05Njc1NSJd>. Everything for agents: <https://agentprime.io/llms.txt>.