# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Seroval: \`fromJSON()\` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)](https://agentprime.io/advisories/GHSA-p6vx-979v-rg4c.md)
  `GHSA-p6vx-979v-rg4c`, `CVE-2026-104846` · npm `seroval`: affected `>=0.12.0, <1.6.2`, fixed in `1.6.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Memory corruption
- [proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet](https://agentprime.io/advisories/GHSA-jqcg-44mw-7w3h.md)
  `GHSA-jqcg-44mw-7w3h`, `CVE-2026-90711` · npm `proxy-addr`: affected `>=1.1.0, <2.0.8`, fixed in `2.0.8` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass, CWE-348, CWE-697
- [vm2: NodeVM custom resolution bypasses external path boundaries](https://agentprime.io/advisories/GHSA-5h3f-q97h-ccvc.md)
  `GHSA-5h3f-q97h-ccvc`, `CVE-2026-100721` · npm `vm2`: affected `<3.12.2`, fixed in `3.12.2` · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [CVE-2026-82989](https://agentprime.io/advisories/CVE-2026-82989.md)
  `CVE-2026-82989` · CVE record: Viewsonic vCast · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Other injection, CWE-147
- [Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL](https://agentprime.io/advisories/CVE-2026-105763.md)
  `CVE-2026-105763` · CVE record: twentyhq twenty · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Hard-coded credentials
- [Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path](https://agentprime.io/advisories/GHSA-rvm3-566m-v7fv.md)
  `GHSA-rvm3-566m-v7fv`, `CVE-2026-103922` · Maven `com.capacitorjs:core` and 2 more: affected `>=6.0.0, <6.2.2 || >=7.0.0, <7.6.9 || >=8.5.0, <8.5.1 || >=8.3.5, <8.4.3 || >=8.0.0, <=8.3.4`, fixed in `6.2.2`, `7.6.9`, `8.5.1`, `8.4.3` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-346, CWE-441
- [Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution](https://agentprime.io/advisories/GHSA-5gmw-xhrv-c9v3.md)
  `GHSA-5gmw-xhrv-c9v3`, `CVE-2026-104848` · npm `tinypool`: affected `<2.1.1`, fixed in `2.1.1` · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Prototype pollution
- [Tinypool: Prototype Pollution Gadget to RCE in run() options](https://agentprime.io/advisories/GHSA-85c8-ppgw-ccpr.md)
  `GHSA-85c8-ppgw-ccpr`, `CVE-2026-104849` · npm `tinypool`: affected `<2.1.2`, fixed in `2.1.2` · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Code injection, Prototype pollution
- [vm2: Sandbox Escape (NodeVM)](https://agentprime.io/advisories/GHSA-88hf-g992-jg85.md)
  `GHSA-88hf-g992-jg85`, `CVE-2026-92955` · npm `vm2`: affected `<3.11.8`, fixed in `3.11.8` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-913
- [vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process](https://agentprime.io/advisories/GHSA-gjq8-xm47-88rc.md)
  `GHSA-gjq8-xm47-88rc`, `CVE-2026-92954` · npm `vm2`: affected `>=3.10.0, <3.11.8`, fixed in `3.11.8` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-248, CWE-703
- [vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix](https://agentprime.io/advisories/GHSA-3vgf-8m4q-q4qr.md)
  `GHSA-3vgf-8m4q-q4qr`, `CVE-2026-92953` · npm `vm2`: affected `>=3.11.0, <3.11.8`, fixed in `3.11.8` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Prototype pollution, CWE-913
- [vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit](https://agentprime.io/advisories/GHSA-x965-fc75-jpqh.md)
  `GHSA-x965-fc75-jpqh`, `CVE-2026-92934` · npm `vm2`: affected `<3.11.8`, fixed in `3.11.8` · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-693
- [vm2: NodeVM \`require.external\` without an explicit \`require.root\` grants unrestricted host filesystem access and full RCE](https://agentprime.io/advisories/GHSA-j3hm-6rg5-mchv.md)
  `GHSA-j3hm-6rg5-mchv`, `CVE-2026-92946` · npm `vm2`: affected `<3.11.7`, fixed in `3.11.7` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-913
- [vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool](https://agentprime.io/advisories/GHSA-fcqc-726x-5wfc.md)
  `GHSA-fcqc-726x-5wfc`, `CVE-2026-92947` · npm `vm2`: affected `<3.11.7`, fixed in `3.11.7` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, CWE-653
- [vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass](https://agentprime.io/advisories/GHSA-wjwh-qqvp-g4p4.md)
  `GHSA-wjwh-qqvp-g4p4`, `CVE-2026-92956` · npm `vm2`: affected `>=3.10.1, <3.11.7`, fixed in `3.11.7` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-693, CWE-913
- [Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass](https://agentprime.io/advisories/GHSA-cf6m-vc3m-7cgm.md)
  `GHSA-cf6m-vc3m-7cgm`, `CVE-2026-8505`, `PYSEC-2026-4233` · PyPI `langflow`: affected `>=1.7.0, <1.9.1`, fixed in `1.9.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass
- [Files accessible to external parties in Atlassian Bamboo Data Center and others](https://agentprime.io/advisories/CVE-2026-21589.md)
  `CVE-2026-21589` · CVE record: Atlassian Bamboo Data Center and 4 more · CVSS 9.3 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 1.00 · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure
- [openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)](https://agentprime.io/advisories/CVE-2026-91107.md)
  `CVE-2026-91107` · CVE record: OS4ED openSIS-Classic · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server](https://agentprime.io/advisories/CVE-2026-105740.md)
  `CVE-2026-105740` · CVE record: langflow-ai langflow · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Command injection
- [Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource Endpoint](https://agentprime.io/advisories/CVE-2026-77226.md)
  `CVE-2026-77226` · CVE record: Camunda Camunda 7 · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color](https://agentprime.io/advisories/CVE-2026-105691.md)
  `CVE-2026-105691` · CVE record: penpot penpot · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Command injection
- [Apache Struts: OGNL injection in the legacy RESTful action mapper](https://agentprime.io/advisories/CVE-2026-104711.md)
  `CVE-2026-104711` · CVE record: Apache Software Foundation Apache Struts · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Code injection
- [Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass](https://agentprime.io/advisories/CVE-2026-105641.md)
  `CVE-2026-105641` · CVE record: makeplane plane · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Hard-coded credentials
- [Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)](https://agentprime.io/advisories/CVE-2026-105640.md)
  `CVE-2026-105640` · CVE record: makeplane plane · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass
- [Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane](https://agentprime.io/advisories/CVE-2026-105639.md)
  `CVE-2026-105639` · CVE record: makeplane plane · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, Authentication bypass, Broken access control
- [Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force](https://agentprime.io/advisories/CVE-2026-105638.md)
  `CVE-2026-105638` · CVE record: makeplane plane · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass
- [WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-103352.md)
  `CVE-2026-103352` · CVE record: WP BASE WP BASE Booking · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: SQL injection
- [WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-97283.md)
  `CVE-2026-97283` · CVE record: Liquid Web / StellarWP Advanced Post Manager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Insecure deserialization
- [Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)](https://agentprime.io/advisories/CVE-2026-105637.md)
  `CVE-2026-105637` · CVE record: makeplane plane · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)](https://agentprime.io/advisories/CVE-2026-105636.md)
  `CVE-2026-105636` · CVE record: makeplane plane · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16](https://agentprime.io/advisories/CVE-2026-102428.md)
  `CVE-2026-102428` · CVE record: ordasoft.com OrdaSoft Joomla CCK · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: SQL injection
- [Improper authentication in Hewlett Packard Enterprise (HPE) HPE Integrated Lights-Out (iLO) 7](https://agentprime.io/advisories/CVE-2026-79820.md)
  `CVE-2026-79820` · CVE record: Hewlett Packard Enterprise (HPE) HPE Integrated Lights-Out (iLO) 7 · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass
- [Totolink A3002MU QoS Rule formIpQoS stack-based overflow](https://agentprime.io/advisories/CVE-2026-105285.md)
  `CVE-2026-105285` · CVE record: Totolink A3002MU · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Memory corruption
- [Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization](https://agentprime.io/advisories/CVE-2026-105284.md)
  `CVE-2026-105284` · CVE record: Totolink A3002MU · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Authentication bypass via blank auth token in P4Search](https://agentprime.io/advisories/CVE-2026-103510.md)
  `CVE-2026-103510` · CVE record: Perforce P4 (Helix Core) · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-636
- [RCE via exposed JDWP debug agent in P4Search](https://agentprime.io/advisories/CVE-2026-100102.md)
  `CVE-2026-100102` · CVE record: Perforce P4 (Helix Core) · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-489
- [Authentication bypass via default auth token in P4Search](https://agentprime.io/advisories/CVE-2026-100103.md)
  `CVE-2026-100103` · CVE record: Perfoce P4 (Helix Core) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-1392
- [YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes](https://agentprime.io/advisories/CVE-2017-20285.md)
  `CVE-2017-20285` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Code injection, Insecure deserialization
- [Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfig](https://agentprime.io/advisories/CVE-2026-105294.md)
  `CVE-2026-105294` · CVE record: Legcord Legcord · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-15
- [Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers](https://agentprime.io/advisories/CVE-2026-105293.md)
  `CVE-2026-105293` · CVE record: Legcord Legcord · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Path traversal
- [maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification](https://agentprime.io/advisories/CVE-2026-105223.md)
  `CVE-2026-105223` · CVE record: maclof kubernetes-client · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Weak cryptography or TLS
- [FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter().](https://agentprime.io/advisories/CVE-2026-88424.md)
  `CVE-2026-88424` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: SQL injection
- [GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.](https://agentprime.io/advisories/CVE-2026-88395.md)
  `CVE-2026-88395` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: SQL injection
- [WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export.](https://agentprime.io/advisories/CVE-2026-88393.md)
  `CVE-2026-88393` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Code injection
- [Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/\*\*, so /h2-console is exposed with no authentication and t…](https://agentprime.io/advisories/CVE-2026-88391.md)
  `CVE-2026-88391` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Code injection
- [An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.](https://agentprime.io/advisories/CVE-2026-37719.md)
  `CVE-2026-37719` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Insecure deserialization
- [alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer](https://agentprime.io/advisories/CVE-2026-105222.md)
  `CVE-2026-105222` · CVE record: alexpechkarev google-maps · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Weak cryptography or TLS
- [Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification](https://agentprime.io/advisories/CVE-2026-105221.md)
  `CVE-2026-105221` · CVE record: defunkt gist · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Weak cryptography or TLS
- [gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client](https://agentprime.io/advisories/CVE-2026-105218.md)
  `CVE-2026-105218` · CVE record: go-pay gopay · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Weak cryptography or TLS
- [go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper](https://agentprime.io/advisories/CVE-2026-105216.md)
  `CVE-2026-105216` · CVE record: micro go-micro · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Weak cryptography or TLS
- [WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title](https://agentprime.io/advisories/CVE-2026-105086.md)
  `CVE-2026-105086` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates](https://agentprime.io/advisories/CVE-2026-105089.md)
  `CVE-2026-105089` · CVE record: WWBN AVideo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Cross-site scripting (XSS)
- [ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback](https://agentprime.io/advisories/CVE-2026-105215.md)
  `CVE-2026-105215` · CVE record: zitadel zitadel · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Authentication bypass
- [ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode](https://agentprime.io/advisories/CVE-2026-105211.md)
  `CVE-2026-105211` · CVE record: zitadel zitadel · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Information disclosure
- [ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment](https://agentprime.io/advisories/CVE-2026-105209.md)
  `CVE-2026-105209` · CVE record: zitadel zitadel · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Broken access control
- [ZITADEL before 4.17.3 Account Takeover via External IdP Linking](https://agentprime.io/advisories/CVE-2026-105207.md)
  `CVE-2026-105207` · CVE record: zitadel zitadel · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Authentication bypass
- [WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-103355.md)
  `CVE-2026-103355` · CVE record: Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: SQL injection
- [InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection](https://agentprime.io/advisories/CVE-2026-105135.md)
  `CVE-2026-105135` · CVE record: InternLM MindSearch · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Other injection, Code injection
- [Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection](https://agentprime.io/advisories/CVE-2026-105134.md)
  `CVE-2026-105134` · CVE record: Ahsay AhsayCBS · CVSS 10.0 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.82 · Not analysed yet · Published 4 Oct 2026 · Tags: Command injection
- [Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication](https://agentprime.io/advisories/CVE-2026-105133.md)
  `CVE-2026-105133` · CVE record: Ahsay AhsayCBS · CVSS 6.9 Medium · Critical (KEV) · In CISA KEV · EPSS 0.84 · Not analysed yet · Published 4 Oct 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTEwLTA0VDA1OjE1OjE0LjU2MTAwMFoiLCJDVkUtMjAyNi0xMDUxMzMiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTEwLTA1VDIzOjQ4OjE0LjAwMDAwMFoiLCJHSFNBLXg2anctbTl2NS04NXZoIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTEwLTA1VDIzOjQ4OjE0LjAwMDAwMFoiLCJHSFNBLXg2anctbTl2NS04NXZoIl0>. Everything for agents: <https://agentprime.io/llms.txt>.