# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser](https://agentprime.io/advisories/CVE-2026-107183.md)
  `CVE-2026-107183` · CVE record: ggml-org llama.cpp · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption
- [Server-side request forgery in SonicWall SMA1000](https://agentprime.io/advisories/CVE-2026-102255.md)
  `CVE-2026-102255` · CVE record: SonicWall SMA1000 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Server-side request forgery (SSRF), CWE-441
- [Code injection in Six Apart Ltd. Movable Type Cloud Edition and others](https://agentprime.io/advisories/CVE-2026-96408.md)
  `CVE-2026-96408` · CVE record: Six Apart Ltd. Movable Type Cloud Edition and 3 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection
- [Out-of-bounds write in Eclipse Foundation Eclipse ThreadX - NetX Duo](https://agentprime.io/advisories/CVE-2026-103416.md)
  `CVE-2026-103416` · CVE record: Eclipse Foundation Eclipse ThreadX - NetX Duo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption
- [Deserialization of untrusted data in Veeam Backup and Replication](https://agentprime.io/advisories/CVE-2025-64393.md)
  `CVE-2025-64393` · CVE record: Veeam Backup and Replication · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Insecure deserialization
- [Apache Impala: Impala Executor Webserver Auth Bypass](https://agentprime.io/advisories/CVE-2026-97720.md)
  `CVE-2026-97720` · CVE record: Apache Software Foundation Apache Impala · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [Unsafe Deserialization Vulnerability in Manacle Technologies ERP System](https://agentprime.io/advisories/CVE-2026-107104.md)
  `CVE-2026-107104` · CVE record: Manacle Technologies Multi-tenant ERP System · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Insecure deserialization
- [SQL Injection Vulnerability in Manacle Technologies ERP System](https://agentprime.io/advisories/CVE-2026-107103.md)
  `CVE-2026-107103` · CVE record: Manacle Technologies Multi-tenant ERP System · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: SQL injection
- [Account Takeover Vulnerability in Manacle Technologies ERP System](https://agentprime.io/advisories/CVE-2026-107102.md)
  `CVE-2026-107102` · CVE record: Manacle Technologies Multi-tenant ERP System · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-345
- [Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0](https://agentprime.io/advisories/CVE-2026-102782.md)
  `CVE-2026-102782` · CVE record: ordasoft.com OrdaSoft Simple Membership extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: SQL injection
- [VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability](https://agentprime.io/advisories/CVE-2026-59346.md)
  `CVE-2026-59346` · CVE record: VMware VMware Workstation and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption
- [FlexNet Publisher lmadmin SOAP Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-19572.md)
  `CVE-2026-19572` · CVE record: Flexera FlexNet Publisher · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [wolfSSH ECDSA host key curve not validated against negotiated algorithm](https://agentprime.io/advisories/CVE-2026-16516.md)
  `CVE-2026-16516` · CVE record: wolfSSL Inc. wolfSSH · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-345
- [Cross-site scripting in ASUS Router](https://agentprime.io/advisories/CVE-2026-14911.md)
  `CVE-2026-14911` · CVE record: ASUS Router · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Stack-based buffer overflow in ASUS Router](https://agentprime.io/advisories/CVE-2026-19386.md)
  `CVE-2026-19386` · CVE record: ASUS Router · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption
- [An HTTP header injection vulnerability was found in the ADM](https://agentprime.io/advisories/CVE-2026-105324.md)
  `CVE-2026-105324` · CVE record: ASUSTOR Inc. ADM · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Other injection
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-93674.md)
  `CVE-2026-93674` · CVE record: IBM Langflow OSS · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection
- [The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely.](https://agentprime.io/advisories/CVE-2025-70521.md)
  `CVE-2025-70521` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Command injection
- [The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users.](https://agentprime.io/advisories/CVE-2025-70520.md)
  `CVE-2025-70520` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely.](https://agentprime.io/advisories/CVE-2025-70518.md)
  `CVE-2025-70518` · CVE record · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Command injection
- [The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users.](https://agentprime.io/advisories/CVE-2025-70516.md)
  `CVE-2025-70516` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-104334.md)
  `CVE-2026-104334` · CVE record: IBM Langflow OSS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Code injection
- [Gitea OAuth2 refresh token grant accepts access tokens](https://agentprime.io/advisories/CVE-2026-101023.md)
  `CVE-2026-101023` · CVE record: Gitea Gitea · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Security Advisory 0197](https://agentprime.io/advisories/CVE-2026-102167.md)
  `CVE-2026-102167` · CVE record: Arista Networks Wi-Fi Access Points · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Memory corruption
- [Security Advisory 0193](https://agentprime.io/advisories/CVE-2026-102162.md)
  `CVE-2026-102162` · CVE record: Arista Networks Wi-Fi Access Points · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Memory corruption
- [Security Advisory 0192](https://agentprime.io/advisories/CVE-2026-101157.md)
  `CVE-2026-101157` · CVE record: Arista Networks CloudVision CUE · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Security Advisory 0190](https://agentprime.io/advisories/CVE-2026-102159.md)
  `CVE-2026-102159` · CVE record: Arista Networks CloudVision CUE · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Security Advisory 0185](https://agentprime.io/advisories/CVE-2026-101158.md)
  `CVE-2026-101158` · CVE record: Arista Networks CloudVision Portal · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Gitea WebAuthn bypass during OAuth and OIDC sign-in](https://agentprime.io/advisories/CVE-2026-73278.md)
  `CVE-2026-73278` · CVE record: Gitea Gitea · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Gitea fork workflow approval bypass through maintainer-triggered events](https://agentprime.io/advisories/CVE-2026-94205.md)
  `CVE-2026-94205` · CVE record: Gitea Gitea · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control, CWE-441
- [Gitea review and execution mismatch through duplicate tree entries](https://agentprime.io/advisories/CVE-2026-95106.md)
  `CVE-2026-95106` · CVE record: Gitea Gitea · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-706
- [Gitea built-in SSH server authentication bypass through key case folding](https://agentprime.io/advisories/CVE-2026-103059.md)
  `CVE-2026-103059` · CVE record: Gitea Gitea · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-305
- [Authenticated Path Traversal Vulnerability Leads to Unauthorized File Access and Modification in ClearPass Policy Manager](https://agentprime.io/advisories/CVE-2026-79805.md)
  `CVE-2026-79805` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Path traversal
- [Unauthenticated Missing Integrity Verification allows Remote Code Execution in ClearPass Policy Manager Client Agent](https://agentprime.io/advisories/CVE-2026-79801.md)
  `CVE-2026-79801` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-353
- [Authenticated SQL Injection Vulnerabilities in ClearPass Policy Manager Web-Based Management Interface](https://agentprime.io/advisories/CVE-2026-79798.md)
  `CVE-2026-79798` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [Authentication Bypass Vulnerabilities in ClearPass Policy Manager](https://agentprime.io/advisories/CVE-2026-79796.md)
  `CVE-2026-79796` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Authenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management Interface](https://agentprime.io/advisories/CVE-2026-79794.md)
  `CVE-2026-79794` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: SQL injection
- [Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in ClearPass Policy Manager](https://agentprime.io/advisories/CVE-2026-76754.md)
  `CVE-2026-76754` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Command injection
- [Unauthenticated Format String Vulnerability in HPE Networking ClearPass Policy Manager](https://agentprime.io/advisories/CVE-2026-76753.md)
  `CVE-2026-76753` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Memory corruption
- [Authentication Bypass Vulnerabilities in HPE Networking ClearPass Policy Manager Allow Unauthorized Administrative Access](https://agentprime.io/advisories/CVE-2026-76752.md)
  `CVE-2026-76752` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Missing Integrity Verification in the OnGuard Agent of ClearPass Policy Manager Allows Unauthenticated Remote Code Execution](https://agentprime.io/advisories/CVE-2026-76751.md)
  `CVE-2026-76751` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-353
- [Unauthenticated Deserialization of Untrusted Data allows Remote Code Execution in the Web Interface of HPE Networking ClearPass Policy Manager](https://agentprime.io/advisories/CVE-2026-76750.md)
  `CVE-2026-76750` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Insecure deserialization
- [Unauthenticated Buffer Overflow Vulnerabilities lead to Information Disclosure in AOS-S](https://agentprime.io/advisories/CVE-2026-76747.md)
  `CVE-2026-76747` · CVE record: Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Memory corruption
- [Unauthenticated Adjacent Buffer Overflow Vulnerability Leading to Information Disclosure in AOS-S](https://agentprime.io/advisories/CVE-2026-76746.md)
  `CVE-2026-76746` · CVE record: Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Memory corruption
- [Unauthenticated Adjacent Memory Corruption Vulnerabilities Leading to Remote Code Execution in AOS-S](https://agentprime.io/advisories/CVE-2026-76745.md)
  `CVE-2026-76745` · CVE record: Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S) · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Memory corruption
- [Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-S](https://agentprime.io/advisories/CVE-2026-76744.md)
  `CVE-2026-76744` · CVE record: Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Memory corruption
- [Authentication Bypass Vulnerability in the Management Interface of AOS-S](https://agentprime.io/advisories/CVE-2026-76743.md)
  `CVE-2026-76743` · CVE record: Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass in the Web Management Interface of AOS-S](https://agentprime.io/advisories/CVE-2026-76742.md)
  `CVE-2026-76742` · CVE record: Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation
- [CVE-2026-106511](https://agentprime.io/advisories/CVE-2026-106511.md)
  `CVE-2026-106511` · CVE record: MultiversX Labs S.R.L. multisig-improved · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-106234.md)
  `CVE-2026-106234` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Memory corruption
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-106294.md)
  `CVE-2026-106294` · CVE record: Google Chrome · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-459
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-106195.md)
  `CVE-2026-106195` · CVE record: Google Chrome · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-106237.md)
  `CVE-2026-106237` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure
- [Integer overflow in Google Chrome](https://agentprime.io/advisories/CVE-2026-106417.md)
  `CVE-2026-106417` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Memory corruption
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-106372.md)
  `CVE-2026-106372` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Out-of-bounds write in Google Chrome](https://agentprime.io/advisories/CVE-2026-106401.md)
  `CVE-2026-106401` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Memory corruption
- [Incomplete cleanup in Google Chrome](https://agentprime.io/advisories/CVE-2026-106375.md)
  `CVE-2026-106375` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-459
- [Improper input validation in Google Chrome](https://agentprime.io/advisories/CVE-2026-106414.md)
  `CVE-2026-106414` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-20
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-106241.md)
  `CVE-2026-106241` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-106329.md)
  `CVE-2026-106329` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTEwLTA2VDE4OjQxOjExLjgyNDAwMFoiLCJDVkUtMjAyNi0xMDYzMjkiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTEwLTA3VDEzOjU0OjQ1LjIxMTAwMFoiLCJDVkUtMjAyNi0xMDcxOTQiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTEwLTA3VDEzOjU0OjQ1LjIxMTAwMFoiLCJDVkUtMjAyNi0xMDcxOTQiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.