# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Memory overflow vulnerability leading to Denial of Service](https://agentprime.io/advisories/CVE-2026-88779.md)
  `CVE-2026-88779` · CVE record: NetScaler ADC and 1 more · CVSS 8.7 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.11 · Not analysed yet · Published 4 Oct 2026 · Tags: Memory corruption
- [Unauthenticated ZeroMQ command/telemetry bus in AIT-Core allows remote spacecraft command injection and telemetry exfiltration](https://agentprime.io/advisories/CVE-2026-105105.md)
  `CVE-2026-105105` · CVE record: NASA-AMMOS AIT-Core · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Oct 2026 · Tags: Authentication bypass
- [MLS X.509 credential not bound to the LeafNode signature key](https://agentprime.io/advisories/CVE-2026-71885.md)
  `CVE-2026-71885` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Oct 2026 · Tags: Authentication bypass, Weak cryptography or TLS
- [Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output](https://agentprime.io/advisories/CVE-2026-92084.md)
  `CVE-2026-92084` · CVE record: beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Oct 2026 · Tags: Code injection
- [VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter](https://agentprime.io/advisories/CVE-2026-87115.md)
  `CVE-2026-87115` · CVE record: e4jvikwp VikAppointments Services Booking Calendar · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Oct 2026 · Tags: Path traversal
- [C4illin ConvertX: In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files…](https://agentprime.io/advisories/CVE-2026-105080.md)
  `CVE-2026-105080` · CVE record: C4illin ConvertX · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Oct 2026 · Tags: CWE-829
- [gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled](https://agentprime.io/advisories/GHSA-x4q3-gcj3-m6cf.md)
  `GHSA-x4q3-gcj3-m6cf`, `CVE-2026-73802`, `GO-2026-6656` · Go `gitea.com/gitea/runner`: affected `<1.0.9-0.20260731160927-34bfa1915022`, fixed in `1.0.9-0.20260731160927-34bfa1915022` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Privilege escalation
- [Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain](https://agentprime.io/advisories/GHSA-v2f8-6655-7grj.md)
  `GHSA-v2f8-6655-7grj`, `CVE-2026-114108` · PyPI `vibe-trading-ai`: affected `>=0.1.0, <0.1.7`, fixed in `0.1.7` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure, Authentication bypass, Unrestricted file upload, Broken access control
- [Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise](https://agentprime.io/advisories/GHSA-pqxw-g93w-hj9x.md)
  `GHSA-pqxw-g93w-hj9x`, `CVE-2026-114087` · npm `trigger.dev`: affected `<4.5.6`, fixed in `4.5.6` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-653, CWE-1393
- [MikroTik RouterOS Integer Underflow](https://agentprime.io/advisories/CVE-2026-84411.md)
  `CVE-2026-84411` · CVE record: MikroTik RouterOS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption
- [Monta monta.app Missing Authentication for Critical Function](https://agentprime.io/advisories/CVE-2026-95102.md)
  `CVE-2026-95102` · CVE record: Monta monta.app · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Authentication bypass
- [OS Command Injection in Digi Accelerated Linux (DAL OS)](https://agentprime.io/advisories/CVE-2026-75937.md)
  `CVE-2026-75937` · CVE record: Digi International IX Family and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Command injection
- [UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilter](https://agentprime.io/advisories/CVE-2026-82042.md)
  `CVE-2026-82042` · CVE record: UTMStack UTMStack · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Authentication bypass
- [OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified Studio](https://agentprime.io/advisories/CVE-2026-104019.md)
  `CVE-2026-104019` · CVE record: AWS sagemaker-distribution · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Command injection
- [Missing authentication for critical function in Loom for AWS](https://agentprime.io/advisories/CVE-2026-103956.md)
  `CVE-2026-103956` · CVE record: AWS loom · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Authentication bypass, CWE-1188
- [H3C CVM Unauthenticated File Upload via fileUpload/upload Token](https://agentprime.io/advisories/CVE-2023-54405.md)
  `CVE-2023-54405` · CVE record: H3C CVM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Unrestricted file upload
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-103630.md)
  `CVE-2026-103630` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-103626.md)
  `CVE-2026-103626` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [Out-of-bounds write in Google Chrome](https://agentprime.io/advisories/CVE-2026-103628.md)
  `CVE-2026-103628` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption
- [Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader](https://agentprime.io/advisories/CVE-2026-103648.md)
  `CVE-2026-103648` · CVE record: demsking image-downloader · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Path traversal
- [Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway](https://agentprime.io/advisories/CVE-2026-90970.md)
  `CVE-2026-90970` · CVE record: GitLab GitLab AI Gateway · CVSS 9.9 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.17 · Not analysed yet · Published 2 Oct 2026 · Tags: Code injection
- [Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter](https://agentprime.io/advisories/CVE-2026-19652.md)
  `CVE-2026-19652` · CVE record: DiviEngine Divi Membership · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Privilege escalation
- [Apache Thrift: C++ THttpTransport grows its line buffer without bound](https://agentprime.io/advisories/CVE-2026-83632.md)
  `CVE-2026-83632` · CVE record: Apache Software Foundation Apache Thrift · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption, Denial of service
- [Tenda AC9 POST Request fast_setting_internet_set stack-based overflow](https://agentprime.io/advisories/CVE-2026-104611.md)
  `CVE-2026-104611` · CVE record: Tenda AC9 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption
- [Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflow](https://agentprime.io/advisories/CVE-2026-104610.md)
  `CVE-2026-104610` · CVE record: Tenda HG7 and 2 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption
- [Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow](https://agentprime.io/advisories/GHSA-32h6-97mm-8q3c.md)
  `GHSA-32h6-97mm-8q3c`, `CVE-2026-115384`, `RUSTSEC-2026-0327` · crates.io `wasmtime`: affected `>=39.0.0, <48.0.4 || >=49.0.0, <49.0.2`, fixed in `48.0.4`, `49.0.2` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-20
- [YesWiki before 4.6.7 Authorization Bypass via Public API Mode](https://agentprime.io/advisories/CVE-2026-104467.md)
  `CVE-2026-104467` · CVE record: YesWiki yeswiki · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [Apache Thrift: C++ \`THeaderTransport::transform()\` heap buffer overflow (write direction)](https://agentprime.io/advisories/CVE-2026-91135.md)
  `CVE-2026-91135` · CVE record: Apache Software Foundation Apache Thrift · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in Moxa MGate MB3170 Series and others](https://agentprime.io/advisories/CVE-2026-86325.md)
  `CVE-2026-86325` · CVE record: Moxa MGate MB3170 Series and 1 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption
- [Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements](https://agentprime.io/advisories/CVE-2026-103877.md)
  `CVE-2026-103877` · CVE record: Apache Software Foundation Apache Directory LDAP API · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Insecure deserialization
- [WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category\[\]' Parameter](https://agentprime.io/advisories/CVE-2026-94541.md)
  `CVE-2026-94541` · CVE record: amauric WPMobile.App – Android and iOS App Builder · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response](https://agentprime.io/advisories/CVE-2026-97637.md)
  `CVE-2026-97637` · CVE record: parorrey JSON API Auth · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Authentication bypass
- [MTI/A0 DHAgreement does not validate the peer's ephemeral value](https://agentprime.io/advisories/CVE-2026-63569.md)
  `CVE-2026-63569` · CVE record: Legion of the Bouncy Castle Inc. bc-csharp · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-20
- [Cross-site scripting in Webpros cPanel and others](https://agentprime.io/advisories/CVE-2026-93029.md)
  `CVE-2026-93029` · CVE record: Webpros cPanel and 1 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cross-site scripting in Webpros cPanel and others](https://agentprime.io/advisories/CVE-2026-93697.md)
  `CVE-2026-93697` · CVE record: Webpros cPanel and 1 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Cross-site scripting (XSS)
- [OS command injection in Webpros cPanel and others](https://agentprime.io/advisories/CVE-2026-93698.md)
  `CVE-2026-93698` · CVE record: Webpros cPanel and 1 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Command injection
- [Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter](https://agentprime.io/advisories/CVE-2026-15896.md)
  `CVE-2026-15896` · CVE record: WebRehab Super Forms – Drag & Drop Form Builder · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-26
- [Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter](https://agentprime.io/advisories/CVE-2026-19660.md)
  `CVE-2026-19660` · CVE record: DiviEngine Divi Membership · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Authentication bypass
- [DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow](https://agentprime.io/advisories/CVE-2026-14378.md)
  `CVE-2026-14378` · CVE record: dplugins DevKit Pro · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Authentication bypass
- [Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membership](https://agentprime.io/advisories/CVE-2026-104480.md)
  `CVE-2026-104480` · CVE record: Discord libdave · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control, CWE-390
- [agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/\_coding/\_shell.py).](https://agentprime.io/advisories/CVE-2026-51922.md)
  `CVE-2026-51922` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Code injection
- [FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code ().](https://agentprime.io/advisories/CVE-2026-51918.md)
  `CVE-2026-51918` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Code injection
- [TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller.](https://agentprime.io/advisories/CVE-2026-51915.md)
  `CVE-2026-51915` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py).](https://agentprime.io/advisories/CVE-2026-51911.md)
  `CVE-2026-51911` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Code injection
- [In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server file…](https://agentprime.io/advisories/CVE-2026-51906.md)
  `CVE-2026-51906` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Path traversal
- [SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller.](https://agentprime.io/advisories/CVE-2026-51904.md)
  `CVE-2026-51904` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute.](https://agentprime.io/advisories/CVE-2026-51898.md)
  `CVE-2026-51898` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Code injection
- [389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result](https://agentprime.io/advisories/CVE-2026-86345.md)
  `CVE-2026-86345` · CVE record: Red Hat Red Hat Directory Server 11 and 4 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-923
- [Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport](https://agentprime.io/advisories/CVE-2026-103764.md)
  `CVE-2026-103764` · CVE record: kvcache-ai Mooncake · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Memory corruption
- [SConnect: Native Host Unauthenticated Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-18397.md)
  `CVE-2026-18397` · CVE record: Thales SConnect · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS, Memory corruption, CWE-130, CWE-252
- [Hard-coded cryptographic key in Johnson Controls EasyIO FS32](https://agentprime.io/advisories/CVE-2026-71449.md)
  `CVE-2026-71449` · CVE record: Johnson Controls EasyIO FS32 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Hard-coded credentials
- [Hardcoded Passwords in Teledyne FLIR Robots running Aware2](https://agentprime.io/advisories/CVE-2026-55395.md)
  `CVE-2026-55395` · CVE record: Teledyne FLIR Aware2 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Hard-coded credentials
- [Local File Inclusion in Teledyne FLIR Robots running Aware2](https://agentprime.io/advisories/CVE-2026-55393.md)
  `CVE-2026-55393` · CVE record: Teledyne FLIR Aware2 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal
- [Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2](https://agentprime.io/advisories/CVE-2026-14984.md)
  `CVE-2026-14984` · CVE record: Teledyne FLIR Aware2 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS
- [Cadmos LTI exposure of sensitive information via debug mode](https://agentprime.io/advisories/CVE-2026-102628.md)
  `CVE-2026-102628` · CVE record: Eummena Cadmos LTI · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-215, CWE-489
- [Joyland AI WebView command injection](https://agentprime.io/advisories/CVE-2026-102667.md)
  `CVE-2026-102667` · CVE record: Joyland Joyland.ai · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: CWE-749
- [GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request](https://agentprime.io/advisories/CVE-2026-56662.md)
  `CVE-2026-56662` · CVE record: GetSimpleCMS-CE GetSimpleCMS-CE · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction](https://agentprime.io/advisories/CVE-2026-56660.md)
  `CVE-2026-56660` · CVE record: GetSimpleCMS-CE GetSimpleCMS-CE · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site request forgery (CSRF), Unrestricted file upload, Server-side request forgery (SSRF)
- [GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover](https://agentprime.io/advisories/CVE-2026-53953.md)
  `CVE-2026-53953` · CVE record: GetSimpleCMS-CE GetSimpleCMS-CE · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Weak cryptography or TLS, CWE-640
- [Path traversal in Fortinet FortiMail](https://agentprime.io/advisories/CVE-2026-104286.md)
  `CVE-2026-104286` · CVE record: Fortinet FortiMail · CVSS 9.8 Critical · Critical (KEV, CVSS 9+) · In CISA KEV · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTEwLTAxVDE5OjE3OjM4LjkzODAwMFoiLCJDVkUtMjAyNi0xMDQyODYiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTEwLTA0VDA1OjE1OjE0LjU2MTAwMFoiLCJDVkUtMjAyNi0xMDUxMzMiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTEwLTA0VDA1OjE1OjE0LjU2MTAwMFoiLCJDVkUtMjAyNi0xMDUxMzMiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.