# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Kiteworks Email Protection Gateway Improper Access Control](https://agentprime.io/advisories/CVE-2026-102149.md)
  `CVE-2026-102149` · CVE record: Kiteworks Email Protection Gateway · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Authentication bypass
- [Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)](https://agentprime.io/advisories/CVE-2026-102147.md)
  `CVE-2026-102147` · CVE record: Kiteworks Core · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Kiteworks Email Protection Gateway server-side request forgery](https://agentprime.io/advisories/CVE-2026-102095.md)
  `CVE-2026-102095` · CVE record: Kiteworks Email Protection Gateway · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Incorrect authorization in OpenBSD](https://agentprime.io/advisories/CVE-2026-103547.md)
  `CVE-2026-103547` · CVE record: OpenBSD OpenBSD · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-100512.md)
  `CVE-2026-100512` · CVE record: Hook & Filter Nested Pages · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization
- [yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure](https://agentprime.io/advisories/CVE-2026-103475.md)
  `CVE-2026-103475` · CVE record: yii2-starter-kit yii2-starter-kit · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-489
- [Deno 2.7.0 through 2.9.7 Command Injection via node:child_process](https://agentprime.io/advisories/CVE-2026-103473.md)
  `CVE-2026-103473` · CVE record: denoland deno · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Command injection
- [Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint](https://agentprime.io/advisories/CVE-2026-62308.md)
  `CVE-2026-62308` · CVE record: Quenary tugtainer · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Server-side request forgery (SSRF)
- [Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset](https://agentprime.io/advisories/CVE-2026-55494.md)
  `CVE-2026-55494` · CVE record: Quenary tugtainer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false](https://agentprime.io/advisories/CVE-2026-55181.md)
  `CVE-2026-55181` · CVE record: Quenary tugtainer · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Soft Machine: Cross-tenant workspace API auth bypass via shared \`CONTAINER_SHARED_SECRET\` bearer token](https://agentprime.io/advisories/CVE-2026-55176.md)
  `CVE-2026-55176` · CVE record: Soft-Machine-io security · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [PTZOptics Missing Authentication in Firmware Upload](https://agentprime.io/advisories/CVE-2026-75969.md)
  `CVE-2026-75969` · CVE record: PTZOptics Move 4K 12X and 4 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Authentication bypass
- [Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package](https://agentprime.io/advisories/CVE-2026-102490.md)
  `CVE-2026-102490` · CVE record: Zammad GmbH Zammad · CVSS 8.5 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.11 · Not analysed yet · Published 30 Sept 2026 · Tags: Privilege escalation
- [Undisclosed RCE in Zammad v6.3 and higher](https://agentprime.io/advisories/CVE-2026-102489.md)
  `CVE-2026-102489` · CVE record: Zammad GmbH Zammad · CVSS 8.7 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.50 · Not analysed yet · Published 30 Sept 2026 · Tags: Authentication bypass
- [Use-after-free of a server-side SSLContext when sni_callback switches contexts](https://agentprime.io/advisories/CVE-2026-19445.md)
  `CVE-2026-19445` · CVE record: Python Software Foundation CPython · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Memory corruption
- [Internet2 Grouper: In Internet2 Grouper before 7.5.1 (in some configurations)…](https://agentprime.io/advisories/CVE-2026-103470.md)
  `CVE-2026-103470` · CVE record: Internet2 Grouper · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Privilege escalation
- [Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16](https://agentprime.io/advisories/CVE-2026-102427.md)
  `CVE-2026-102427` · CVE record: ordasoft.com OrdaSoft Joomla CCK · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Unrestricted file upload
- [LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service](https://agentprime.io/advisories/CVE-2026-103395.md)
  `CVE-2026-103395` · CVE record: ModelTC LightLLM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization
- [Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1](https://agentprime.io/advisories/CVE-2026-76570.md)
  `CVE-2026-76570` · CVE record: joomcode.com JCTables extension for Joomla · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [SQL Injection in Trex Digital Manufacturing's Trex MES](https://agentprime.io/advisories/CVE-2026-18782.md)
  `CVE-2026-18782` · CVE record: Trex Digital Smart Manufacturing Systems Inc. Trex MES · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [litespeedtech LiteSpeed Web Server: LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL…](https://agentprime.io/advisories/CVE-2026-93903.md)
  `CVE-2026-93903` · CVE record: litespeedtech LiteSpeed Web Server · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-174
- [Multiple Vulnerabilities in Dolusoft Software's SOPLOG](https://agentprime.io/advisories/CVE-2026-82307.md)
  `CVE-2026-82307` · CVE record: Dolusoft Software Technologies SOPLOG · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-76504.md)
  `CVE-2026-76504` · CVE record: Cisco Cisco Catalyst SD-WAN Manager · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.39 · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-177
- [WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability](https://agentprime.io/advisories/CVE-2026-97274.md)
  `CVE-2026-97274` · CVE record: miniOrange OAuth Single Sign On – SSO (OAuth Client) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Authentication bypass
- [WordPress Booking Activities plugin <= 1.18.7.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-97248.md)
  `CVE-2026-97248` · CVE record: Booking Activities Team Booking Activities · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization
- [WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96822.md)
  `CVE-2026-96822` · CVE record: Hossni Mubarak Books Gallery · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: SQL injection
- [WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-96350.md)
  `CVE-2026-96350` · CVE record: Estatik Estatik · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Privilege escalation
- [WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-96349.md)
  `CVE-2026-96349` · CVE record: SiteSkite SiteSkite · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-94389.md)
  `CVE-2026-94389` · CVE record: AcyMailing Newsletter Team AcyMailing SMTP Newsletter · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [Authentication Bypass in sogo_yhn](https://agentprime.io/advisories/CVE-2026-74865.md)
  `CVE-2026-74865` · CVE record: YunoHost-Apps sogo_yhn · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Authentication Bypass in sogo_yhn](https://agentprime.io/advisories/CVE-2026-74864.md)
  `CVE-2026-74864` · CVE record: YunoHost-Apps sogo_yhn · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection](https://agentprime.io/advisories/CVE-2026-89238.md)
  `CVE-2026-89238` · CVE record: Apache Software Foundation Apache WSS4J · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-345
- [Apache WSS4J: SAML Sender-Vouches Authentication Bypass](https://agentprime.io/advisories/CVE-2026-88920.md)
  `CVE-2026-88920` · CVE record: Apache Software Foundation Apache WSS4J · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Authentication bypass
- [Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.](https://agentprime.io/advisories/CVE-2026-87830.md)
  `CVE-2026-87830` · CVE record: Apache Software Foundation Apache WSS4J · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [Apache MINA SSHD: Asynchronous authentication can bypass signature verification](https://agentprime.io/advisories/CVE-2026-77185.md)
  `CVE-2026-77185` · CVE record: Apache Software Foundation Apache MINA SSHD · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-305
- [Apache MINA SSHD: LDAP injection in sshd-ldap](https://agentprime.io/advisories/CVE-2026-94053.md)
  `CVE-2026-94053` · CVE record: Apache Software Foundation Apache MINA SSHD · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Other injection, CWE-305
- [Apache MINA SSHD: LDAP password authentication ineffective](https://agentprime.io/advisories/CVE-2026-94052.md)
  `CVE-2026-94052` · CVE record: Apache Software Foundation Apache MINA SSHD · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Authentication bypass
- [DigiWin｜EasyFlow .NET - Missing Authentication](https://agentprime.io/advisories/CVE-2026-102458.md)
  `CVE-2026-102458` · CVE record: DigiWin EasyFlow .NET · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Authentication bypass
- [DigiWin｜EasyFlow .NET - Insecure Deserialization](https://agentprime.io/advisories/CVE-2026-102455.md)
  `CVE-2026-102455` · CVE record: DigiWin EasyFlow .NET · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Insecure deserialization
- [Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade](https://agentprime.io/advisories/CVE-2026-102508.md)
  `CVE-2026-102508` · CVE record: Apache Software Foundation Apache PLC4X · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Weak cryptography or TLS, CWE-757
- [WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability](https://agentprime.io/advisories/CVE-2026-97196.md)
  `CVE-2026-97196` · CVE record: Liquid Web / StellarWP GiveWP · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-1289
- [Zella Theme < 2.6.3 - Unauthenticated Arbitrary File Upload](https://agentprime.io/advisories/CVE-2026-75873.md)
  `CVE-2026-75873` · CVE record: Unknown Zella Theme · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Unrestricted file upload
- [zosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection](https://agentprime.io/advisories/CVE-2026-102911.md)
  `CVE-2026-102911` · CVE record: zosmaai pi-llm-wiki · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Command injection
- [Out-of-bounds write in Pexip Infinity](https://agentprime.io/advisories/CVE-2026-103110.md)
  `CVE-2026-103110` · CVE record: Pexip Infinity · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Memory corruption
- [AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR](https://agentprime.io/advisories/CVE-2026-103056.md)
  `CVE-2026-103056` · CVE record: beenuar AiSOC · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Command injection
- [Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py.](https://agentprime.io/advisories/CVE-2026-51872.md)
  `CVE-2026-51872` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows an attacker to achieve arbitrary code execution by exploiting the direct executi…](https://agentprime.io/advisories/CVE-2026-51871.md)
  `CVE-2026-51871` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute.](https://agentprime.io/advisories/CVE-2026-51870.md)
  `CVE-2026-51870` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Command injection
- [DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.](https://agentprime.io/advisories/CVE-2026-51869.md)
  `CVE-2026-51869` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts.](https://agentprime.io/advisories/CVE-2026-51867.md)
  `CVE-2026-51867` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow.](https://agentprime.io/advisories/CVE-2026-51866.md)
  `CVE-2026-51866` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/python_upload_api.py:42).](https://agentprime.io/advisories/CVE-2026-51864.md)
  `CVE-2026-51864` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:40).](https://agentprime.io/advisories/CVE-2026-51862.md)
  `CVE-2026-51862` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py.](https://agentprime.io/advisories/CVE-2026-51861.md)
  `CVE-2026-51861` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/core/cache/utils.py:290).](https://agentprime.io/advisories/CVE-2026-51859.md)
  `CVE-2026-51859` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Path traversal
- [In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an approval boundary.](https://agentprime.io/advisories/CVE-2026-51858.md)
  `CVE-2026-51858` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary.](https://agentprime.io/advisories/CVE-2026-51857.md)
  `CVE-2026-51857` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python…](https://agentprime.io/advisories/CVE-2026-51856.md)
  `CVE-2026-51856` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Code injection
- [@xhmikosr/decompress: Path traversal via symlink chain](https://agentprime.io/advisories/GHSA-hrh2-vp3x-79xf.md)
  `GHSA-hrh2-vp3x-79xf`, `CVE-2026-101894` · npm `decompress` and 1 more: affected `<=4.2.1`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal
- [Ziroom ZHOME A0101 ping command injection](https://agentprime.io/advisories/CVE-2026-102794.md)
  `CVE-2026-102794` · CVE record: Ziroom ZHOME A0101 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Other injection, Command injection

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTA5LTI5VDIzOjMwOjEwLjAxNTAwMFoiLCJDVkUtMjAyNi0xMDI3OTQiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTA5LTMwVDIwOjEyOjQyLjAzMjAwMFoiLCJDVkUtMjAyNi0xMDIxMDIiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTA5LTMwVDIwOjEyOjQyLjAzMjAwMFoiLCJDVkUtMjAyNi0xMDIxMDIiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.