# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL](https://agentprime.io/advisories/GHSA-wf65-4jjx-q444.md)
  `GHSA-wf65-4jjx-q444`, `CVE-2026-60090`, `PYSEC-2026-4260` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: SQL injection, Other injection
- [PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets](https://agentprime.io/advisories/GHSA-2xv2-w8cq-5gxw.md)
  `GHSA-2xv2-w8cq-5gxw`, `CVE-2026-61447`, `PYSEC-2026-4266` · PyPI `praisonaiagents`: affected `<1.6.78`, fixed in `1.6.78` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.15 · Not analysed yet · Published 8 Oct 2026 · Tags: Code injection, Information disclosure
- [AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host](https://agentprime.io/advisories/GHSA-jmqq-x5g9-9p2w.md)
  `GHSA-jmqq-x5g9-9p2w`, `CVE-2026-107282` · Maven `org.asynchttpclient:async-http-client`: affected `>=3.0.0, <3.0.13 || >=2.0.0, <2.16.1`, fixed in `3.0.13`, `2.16.1` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Weak cryptography or TLS, Hard-coded credentials, CWE-441
- [mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx](https://agentprime.io/advisories/CVE-2026-9209.md)
  `CVE-2026-9209` · CVE record: mJob mJobTime · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Privilege escalation, Authentication bypass
- [IBM DataPower Gateway Buffer Overflow](https://agentprime.io/advisories/CVE-2026-14269.md)
  `CVE-2026-14269` · CVE record: IBM DataPower Gateway 10.6CD and 3 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Memory corruption
- [Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API](https://agentprime.io/advisories/CVE-2026-107640.md)
  `CVE-2026-107640` · CVE record: Integrics Enswitch · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-640
- [IBM DataPower Gateway Improper Authentication](https://agentprime.io/advisories/CVE-2026-14502.md)
  `CVE-2026-14502` · CVE record: IBM DataPower Gateway 10.6CD and 3 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass
- [CVE-2026-93034](https://agentprime.io/advisories/CVE-2026-93034.md)
  `CVE-2026-93034` · CVE record: SGLang SGLang · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Insecure deserialization
- [IBM DataPower Gateway Out-of-bounds Write](https://agentprime.io/advisories/CVE-2026-14992.md)
  `CVE-2026-14992` · CVE record: IBM DataPower Gateway 10.6CD and 3 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Memory corruption
- [IBM DataPower Gateway affected by cross-site scripting](https://agentprime.io/advisories/CVE-2026-14990.md)
  `CVE-2026-14990` · CVE record: IBM DataPower Gateway 10.6.0 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Cross-site scripting (XSS)
- [IBM DataPower Gateway Out-of-bounds Write](https://agentprime.io/advisories/CVE-2026-14991.md)
  `CVE-2026-14991` · CVE record: IBM DataPower Gateway 10.6CD and 3 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Memory corruption
- [IBM DataPower Gateway Out-of-bounds Write](https://agentprime.io/advisories/CVE-2026-15762.md)
  `CVE-2026-15762` · CVE record: IBM DataPower Gateway 10.6CD and 3 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Memory corruption
- [IBM DataPower Gateway Out-of-bounds Write](https://agentprime.io/advisories/CVE-2026-16340.md)
  `CVE-2026-16340` · CVE record: IBM DataPower Gateway 10.6CD and 3 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Memory corruption
- [Password Reset Code Brute Force Leading to Account Takeover in AKIN Software's MyRezzta](https://agentprime.io/advisories/CVE-2026-19218.md)
  `CVE-2026-19218` · CVE record: AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-640
- [Database Credentials Disclosure in AKIN Software's AKINSOFT WOLVOX Control Panel](https://agentprime.io/advisories/CVE-2026-92555.md)
  `CVE-2026-92555` · CVE record: AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure
- [Authenticated argument injection in NIOS command line leading to privilege escalation](https://agentprime.io/advisories/CVE-2026-107510.md)
  `CVE-2026-107510` · CVE record: Infoblox NIOS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection, Privilege escalation, Broken access control
- [Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter](https://agentprime.io/advisories/CVE-2026-105110.md)
  `CVE-2026-105110` · CVE record: Iskratel Innbox · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection, Authentication bypass
- [SQL injection in the NetBoard CRM demo platform](https://agentprime.io/advisories/CVE-2026-12260.md)
  `CVE-2026-12260` · CVE record: NetBoard CRM NetBoard CRM Demo Platform · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: SQL injection
- [Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter](https://agentprime.io/advisories/CVE-2026-85097.md)
  `CVE-2026-85097` · CVE record: Bricksforge Bricksforge · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Unrestricted file upload
- [Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation via Arbitrary Function Call](https://agentprime.io/advisories/CVE-2026-103692.md)
  `CVE-2026-103692` · CVE record: Unknown Frontend Dashboard · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Privilege escalation
- [Ultimate Multisite < 2.17.0 - Unauthenticated Authentication Bypass via 'email_address' Parameter](https://agentprime.io/advisories/CVE-2026-103646.md)
  `CVE-2026-103646` · CVE record: Unknown Ultimate Multisite · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass
- [Openfind｜SecuShare Pro - OS Command Injection](https://agentprime.io/advisories/CVE-2026-107459.md)
  `CVE-2026-107459` · CVE record: Openfind SecuShare Pro · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection
- [Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data\[...\]\[files\]\[\]\[subdir\]' Parameter](https://agentprime.io/advisories/CVE-2026-17609.md)
  `CVE-2026-17609` · CVE record: WebRehab Super Forms – Drag & Drop Form Builder · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Unrestricted file upload
- [Improper Adherence to Coding Standards in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76285.md)
  `CVE-2026-76285` · CVE record: Splunk Splunk Enterprise · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-710
- [Improper Neutralization in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76284.md)
  `CVE-2026-76284` · CVE record: Splunk Splunk Enterprise · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-707
- [Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76268.md)
  `CVE-2026-76268` · CVE record: Splunk Splunk Enterprise · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration](https://agentprime.io/advisories/GHSA-w794-rj3p-xv45.md)
  `GHSA-w794-rj3p-xv45`, `CVE-2026-105697`, `PYSEC-2026-4237`, `PYSEC-2026-4239`, `PYSEC-2026-4241` · PyPI `langflow` and 2 more: affected `>=1.1.2, <1.10.3`, fixed in `1.10.3` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Command injection
- [Payload Form Builder has an RCE issue](https://agentprime.io/advisories/GHSA-r488-j9vj-wx3q.md)
  `GHSA-r488-j9vj-wx3q`, `CVE-2026-105857` · npm `@payloadcms/plugin-form-builder`: affected `<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection, Prototype pollution
- [Payload: Unauthorized update to collection documents](https://agentprime.io/advisories/GHSA-f7hx-52q9-hcrf.md)
  `GHSA-f7hx-52q9-hcrf`, `CVE-2026-105859` · npm `payload`: affected `<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Payload authentication token field handling issue](https://agentprime.io/advisories/GHSA-66wr-7vmr-p5jq.md)
  `GHSA-66wr-7vmr-p5jq`, `CVE-2026-105863` · npm `payload`: affected `>=3.0.0, <3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass, Broken access control
- [vm2 contains a sandbox escape vulnerability](https://agentprime.io/advisories/GHSA-pq68-rvw4-xp4r.md)
  `GHSA-pq68-rvw4-xp4r`, `CVE-2026-93605` · npm `vm2`: affected `<3.12.1`, fixed in `3.12.1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-693, CWE-913
- [Backstage: Sensitive information exposure in Scaffolder](https://agentprime.io/advisories/GHSA-g2v8-7jhw-pp8p.md)
  `GHSA-g2v8-7jhw-pp8p`, `CVE-2026-106501` · npm `@backstage/plugin-scaffolder-backend`: affected `<3.3.1 || >=3.4.0, <3.4.1 || >=4.0.0, <4.0.3 || >=4.0.4, <4.1.0`, fixed in `3.3.1`, `3.4.1`, `4.0.3`, `4.1.0` · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure
- [WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-95606.md)
  `CVE-2026-95606` · CVE record: Liquid Web / StellarWP The Events Calendar · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Insecure deserialization
- [WordPress WP Data Access plugin <= 5.5.82 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-95605.md)
  `CVE-2026-95605` · CVE record: Passionate Programmer Peter WP Data Access · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: SQL injection
- [Cisco Meraki Hardening Release October 2026 - Buffer Management Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76464.md)
  `CVE-2026-76464` · CVE record: Cisco Cisco Campus Gateway Software and 3 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption
- [Cisco Nexus 9000 Series Switches SRv6 OAM (NGOAM) Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-76501.md)
  `CVE-2026-76501` · CVE record: Cisco Cisco NX-OS Software · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption
- [Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Control of a Resource Through its Lifetime Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76500.md)
  `CVE-2026-76500` · CVE record: Cisco Cisco Application Policy Infrastructure Controller (APIC) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-664
- [Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Access Control Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76498.md)
  `CVE-2026-76498` · CVE record: Cisco Cisco Application Policy Infrastructure Controller (APIC) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Neutralization Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76499.md)
  `CVE-2026-76499` · CVE record: Cisco Cisco Application Policy Infrastructure Controller (APIC) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-707
- [Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass](https://agentprime.io/advisories/GHSA-w7x8-q2gp-5cgg.md)
  `GHSA-w7x8-q2gp-5cgg`, `CVE-2026-73487` · npm `flowise` and 1 more: affected `<3.1.3`, fixed in `3.1.3` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection
- [Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-76486.md)
  `CVE-2026-76486` · CVE record: Cisco Cisco NX-OS Software · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption
- [Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-76485.md)
  `CVE-2026-76485` · CVE record: Cisco Cisco NX-OS Software · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption
- [Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium](https://agentprime.io/advisories/GHSA-9gvv-qjj3-2p6g.md)
  `GHSA-9gvv-qjj3-2p6g`, `CVE-2026-119978`, `CVE-2026-73483` · npm `flowise` and 1 more: affected `<3.1.3`, fixed in `3.1.3` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Command injection, CWE-749
- [Cisco License On-Prem Security Hardening Release](https://agentprime.io/advisories/CVE-2026-76483.md)
  `CVE-2026-76483` · CVE record: Cisco Cisco License On-Prem · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Hard-coded credentials
- [Cisco License On-Prem Security Hardening Release](https://agentprime.io/advisories/CVE-2026-76482.md)
  `CVE-2026-76482` · CVE record: Cisco Cisco License On-Prem · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Weak cryptography or TLS
- [Cisco License On-Prem Security Hardening Release](https://agentprime.io/advisories/CVE-2026-76480.md)
  `CVE-2026-76480` · CVE record: Cisco Cisco License On-Prem · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76459.md)
  `CVE-2026-76459` · CVE record: Cisco Cisco NX-OS Software and 2 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption
- [Cisco NX-OS Software NX-API Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-76471.md)
  `CVE-2026-76471` · CVE record: Cisco Cisco NX-OS Software and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Memory corruption
- [Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76455.md)
  `CVE-2026-76455` · CVE record: Cisco Cisco NX-OS Software and 2 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-76465.md)
  `CVE-2026-76465` · CVE record: Cisco Cisco NX-OS Software · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: CWE-590
- [Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()](https://agentprime.io/advisories/GHSA-pq96-jpmf-w254.md)
  `GHSA-pq96-jpmf-w254`, `CVE-2026-106102` · npm `quasar`: affected `<2.22.0`, fixed in `2.22.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability](https://agentprime.io/advisories/CVE-2026-76454.md)
  `CVE-2026-76454` · CVE record: Cisco Cisco License On-Prem · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal
- [Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability](https://agentprime.io/advisories/CVE-2026-20328.md)
  `CVE-2026-20328` · CVE record: Cisco Cisco License On-Prem · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login](https://agentprime.io/advisories/GHSA-6xp5-7rcx-xfgx.md)
  `GHSA-6xp5-7rcx-xfgx`, `CVE-2026-62252`, `GO-2026-6671` · Go `github.com/sipcapture/homer-app`: affected `<0.0.0-20260625091610-b2e942031ff8`, fixed in `0.0.0-20260625091610-b2e942031ff8` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Hard-coded credentials
- [Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)](https://agentprime.io/advisories/GHSA-rqcc-94gv-wjm9.md)
  `GHSA-rqcc-94gv-wjm9`, `CVE-2026-62253`, `GO-2026-6673` · Go `github.com/sipcapture/homer-app`: affected `<0.0.0-20260625093330-5e90809657c9`, fixed in `0.0.0-20260625093330-5e90809657c9` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation](https://agentprime.io/advisories/GHSA-g6j7-pffp-8whg.md)
  `GHSA-g6j7-pffp-8whg`, `CVE-2026-61444`, `CVE-2026-62176`, `PYSEC-2026-4256` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Code injection
- [Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens](https://agentprime.io/advisories/CVE-2026-92414.md)
  `CVE-2026-92414` · CVE record: Apache Software Foundation Apache Jackrabbit · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint](https://agentprime.io/advisories/CVE-2026-107204.md)
  `CVE-2026-107204` · CVE record: LMCache LMCache · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass
- [CVE-2026-107202](https://agentprime.io/advisories/CVE-2026-107202.md)
  `CVE-2026-107202` · CVE record: jonssonyan h-ui · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Command injection
- [Authentication bypass in Sungrow iSolarCloud](https://agentprime.io/advisories/CVE-2026-107194.md)
  `CVE-2026-107194` · CVE record: Sungrow iSolarCloud · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTEwLTA3VDEzOjU0OjQ1LjIxMTAwMFoiLCJDVkUtMjAyNi0xMDcxOTQiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTEwLTA4VDE3OjUyOjI2LjAwMDAwMFoiLCJHSFNBLXA4d2ctdnJ2Mi12ODZmIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTEwLTA4VDE3OjUyOjI2LjAwMDAwMFoiLCJHSFNBLXA4d2ctdnJ2Mi12ODZmIl0>. Everything for agents: <https://agentprime.io/llms.txt>.