# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php](https://agentprime.io/advisories/CVE-2026-108107.md)
  `CVE-2026-108107` · CVE record: hotspotbilling phpnuxbill · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [Red Lion Controls N-Tron 700 Series Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2026-39460.md)
  `CVE-2026-39460` · CVE record: Red Lion Controls 700 Series · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Hard-coded credentials
- [Red Lion Controls N-Tron 700 Series Use of Hard-Coded Credentials](https://agentprime.io/advisories/CVE-2026-32645.md)
  `CVE-2026-32645` · CVE record: Red Lion Controls 700 Series · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Hard-coded credentials
- [Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-105278.md)
  `CVE-2026-105278` · CVE record: Grid Protection Alliance openPDC (Docker image) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Hard-coded credentials
- [Grid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Data](https://agentprime.io/advisories/CVE-2026-100730.md)
  `CVE-2026-100730` · CVE record: Grid Protection Alliance openPDC and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Insecure deserialization
- [Payment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShop](https://agentprime.io/advisories/CVE-2026-86405.md)
  `CVE-2026-86405` · CVE record: Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Weak cryptography or TLS
- [Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.x](https://agentprime.io/advisories/CVE-2026-85531.md)
  `CVE-2026-85531` · CVE record: Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Weak cryptography or TLS
- [Pre-shared key mode transmits the TGK in cleartext, exposing the SRTP master key](https://agentprime.io/advisories/GHSA-fwjg-cm92-j3hj.md)
  `GHSA-fwjg-cm92-j3hj`, `RUSTSEC-2026-0335` · crates.io `mykey`: affected `>=0.0.0-0, <2.0.0`, fixed in `2.0.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026
- [Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.](https://agentprime.io/advisories/CVE-2026-107938.md)
  `CVE-2026-107938` · CVE record: Apache Software Foundation Apache CXF · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Weak cryptography or TLS
- [Apache CXF: Authentication bypass via weak cache keys for validated STS tokens](https://agentprime.io/advisories/CVE-2026-97468.md)
  `CVE-2026-97468` · CVE record: Apache Software Foundation Apache CXF · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Weak cryptography or TLS
- [Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter](https://agentprime.io/advisories/CVE-2026-71575.md)
  `CVE-2026-71575` · CVE record: Apache Software Foundation Apache CXF · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93947.md)
  `CVE-2026-93947` · CVE record: Shinetheme Traveler · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability](https://agentprime.io/advisories/CVE-2026-94503.md)
  `CVE-2026-94503` · CVE record: PX-lab Zombify · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Unrestricted file upload
- [WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96809.md)
  `CVE-2026-96809` · CVE record: MultiNet Interactive AB EduAdmin Booking · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96331.md)
  `CVE-2026-96331` · CVE record: wpdreams Ajax Search Pro · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96330.md)
  `CVE-2026-96330` · CVE record: tagDiv tagDiv Opt-In Builder · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96328.md)
  `CVE-2026-96328` · CVE record: jegtheme JNews - Pay Writer · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-96327.md)
  `CVE-2026-96327` · CVE record: VibeThemes WPLMS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose](https://agentprime.io/advisories/CVE-2026-107935.md)
  `CVE-2026-107935` · CVE record: Red Hat Red Hat Build of Podman Desktop and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Path traversal
- [Authentication bypass in FalkorDB Bolt endpoint via fail-open AUTH probe error handling](https://agentprime.io/advisories/CVE-2026-107910.md)
  `CVE-2026-107910` · CVE record: FalkorDB FalkorDB · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [Pre-authentication heap out-of-bounds write in FalkorDB Bolt BoltReadHandler via RESET message](https://agentprime.io/advisories/CVE-2026-107908.md)
  `CVE-2026-107908` · CVE record: FalkorDB FalkorDB · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in FalkorDB \_RdbLoadEntity via unbounded property count in crafted RDB](https://agentprime.io/advisories/CVE-2026-7827.md)
  `CVE-2026-7827` · CVE record: FalkorDB FalkorDB · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Memory corruption
- [Double free and use-after-free in FalkorDB RdbLoadDeletedNodes allows remote code execution via crafted RDB](https://agentprime.io/advisories/CVE-2026-5759.md)
  `CVE-2026-5759` · CVE record: FalkorDB FalkorDB · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Memory corruption
- [Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials.](https://agentprime.io/advisories/CVE-2026-78835.md)
  `CVE-2026-78835` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Hard-coded credentials
- [An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua.](https://agentprime.io/advisories/CVE-2026-78797.md)
  `CVE-2026-78797` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Code injection
- [An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to execute arbitrary code via the www\cgi-bin\upgrade file](https://agentprime.io/advisories/CVE-2026-78796.md)
  `CVE-2026-78796` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Command injection
- [Double flow control refund on HTTP/2 server streams in net/http](https://agentprime.io/advisories/GO-2026-6612.md)
  `GO-2026-6612`, `BIT-golang-2026-78663`, `CVE-2026-78663` · Go `golang.org/x/net` and 1 more: affected `<0.60.0`, fixed in `0.60.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-675
- [Root.Mkdir(All) can follow junctions out of the root on Windows in os](https://agentprime.io/advisories/GO-2026-6604.md)
  `GO-2026-6604`, `BIT-golang-2026-56857`, `CVE-2026-56857` · Go `stdlib`: affected `<1.26.9 || >=1.27.0-0, <1.27.2`, fixed in `1.26.9`, `1.27.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-1386
- [Microsoft Partner Center Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-96207.md)
  `CVE-2026-96207` · CVE record: Microsoft Microsoft Partner Center · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Weak cryptography or TLS
- [Microsoft Bookings Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-94510.md)
  `CVE-2026-94510` · CVE record: Microsoft Microsoft Bookings · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Microsoft Dataverse Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-88131.md)
  `CVE-2026-88131` · CVE record: Microsoft Microsoft Dataverse · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Insecure deserialization
- [Azure App Service Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-77900.md)
  `CVE-2026-77900` · CVE record: Microsoft Azure App Service for Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass
- [Azure SRE Agent Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69435.md)
  `CVE-2026-69435` · CVE record: Microsoft Azure SRE Agent · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Hazelcast allows arbitrary member memory access by low-privileged client](https://agentprime.io/advisories/GHSA-6v25-8wq6-xq4j.md)
  `GHSA-6v25-8wq6-xq4j`, `CVE-2026-107726` · Maven `com.hazelcast:hazelcast`: affected `>=5.6.0, <5.7.0 || >=5.5.0, <5.7.0 || <5.7.0`, fixed in `5.7.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-20
- [fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion](https://agentprime.io/advisories/GHSA-ww5h-9m49-7xx4.md)
  `GHSA-ww5h-9m49-7xx4`, `CVE-2026-107722` · npm `fast-jwt`: affected `>=6.2.0, <6.3.0`, fixed in `6.3.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Weak cryptography or TLS
- [PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls](https://agentprime.io/advisories/GHSA-9mp3-24cc-77mg.md)
  `GHSA-9mp3-24cc-77mg`, `CVE-2026-61445`, `PYSEC-2026-4253` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal, Command injection
- [Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection](https://agentprime.io/advisories/CVE-2026-75875.md)
  `CVE-2026-75875` · CVE record: IBM Guardium Data Protection · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Path traversal
- [Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection](https://agentprime.io/advisories/CVE-2026-80381.md)
  `CVE-2026-80381` · CVE record: IBM Guardium Data Protection · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: SQL injection
- [IBM Guardium Data Protection is affected by vulnerability](https://agentprime.io/advisories/CVE-2026-84249.md)
  `CVE-2026-84249` · CVE record: IBM Guardium Data Protection · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass
- [Memory overflow vulnerability leading to Remote Code Execution or Denial of Service](https://agentprime.io/advisories/CVE-2026-107406.md)
  `CVE-2026-107406` · CVE record: NetScaler ADC and 1 more · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Memory corruption
- [Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-16823.md)
  `CVE-2026-16823` · CVE record: IBM Security Verify Access and 3 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass
- [Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-16916.md)
  `CVE-2026-16916` · CVE record: IBM Security Verify Access and 3 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-693
- [Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-19491.md)
  `CVE-2026-19491` · CVE record: IBM Security Verify Access and 3 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass
- [Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-78401.md)
  `CVE-2026-78401` · CVE record: IBM Security Verify Access and 3 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Insecure deserialization
- [Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-78406.md)
  `CVE-2026-78406` · CVE record: IBM Security Verify Access and 3 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Insecure deserialization
- [Missing authorization in Hewlett Packard Enterprise HPE Intelligent Management Center (iMC)](https://agentprime.io/advisories/CVE-2026-79842.md)
  `CVE-2026-79842` · CVE record: Hewlett Packard Enterprise HPE Intelligent Management Center (iMC) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById](https://agentprime.io/advisories/CVE-2026-107781.md)
  `CVE-2026-107781` · CVE record: dromara skyeye · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter](https://agentprime.io/advisories/CVE-2026-107780.md)
  `CVE-2026-107780` · CVE record: dromara skyeye · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection
- [Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE](https://agentprime.io/advisories/CVE-2026-107779.md)
  `CVE-2026-107779` · CVE record: dromara skyeye · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass
- [Command Injection](https://agentprime.io/advisories/CVE-2026-106126.md)
  `CVE-2026-106126` · CVE record: Tenable, Inc. Tenable Identity Exposure (SaaS) · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection
- [TVU Networks Receiver/Transceiver Missing Authentication via REST API](https://agentprime.io/advisories/CVE-2026-104076.md)
  `CVE-2026-104076` · CVE record: TVU Networks TVU Receiver / Transceiver · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass
- [TVU Networks Receiver/Transceiver Authentication Bypass via /tvu/Login](https://agentprime.io/advisories/CVE-2026-104075.md)
  `CVE-2026-104075` · CVE record: TVU Networks TVU Receiver / Transceiver · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass
- [IBM Guardium Data Protection Cross-Site Scripting](https://agentprime.io/advisories/CVE-2026-84244.md)
  `CVE-2026-84244` · CVE record: IBM Guardium Data Protection · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Cross-site scripting (XSS)
- [IBM Guardium Data Protection Missing Authentication](https://agentprime.io/advisories/CVE-2026-84272.md)
  `CVE-2026-84272` · CVE record: IBM Guardium Data Protection · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass
- [image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format](https://agentprime.io/advisories/CVE-2026-107704.md)
  `CVE-2026-107704` · CVE record: jtescher image_optimizer · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection
- [@enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo](https://agentprime.io/advisories/CVE-2026-107703.md)
  `CVE-2026-107703` · CVE record: enmaso @enmaso/node-convert · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection
- [dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument](https://agentprime.io/advisories/CVE-2026-107700.md)
  `CVE-2026-107700` · CVE record: ntharim dot-access · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Code injection
- [ppt2png through 0.0.6 OS Command Injection via input and output paths](https://agentprime.io/advisories/CVE-2026-107699.md)
  `CVE-2026-107699` · CVE record: tzwm ppt2png · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection
- [Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)](https://agentprime.io/advisories/GHSA-8r5x-fm3f-whwj.md)
  `GHSA-8r5x-fm3f-whwj`, `CVE-2026-106446` · npm `handlebars`: affected `>=4.0.0, <4.7.10`, fixed in `4.7.10` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Code injection, Memory corruption
- [Handlebars: JavaScript Injection via Own Property Check Bypass](https://agentprime.io/advisories/GHSA-p8wg-vrv2-v86f.md)
  `GHSA-p8wg-vrv2-v86f`, `CVE-2026-106445` · npm `handlebars`: affected `>=3.0.0, <4.7.10`, fixed in `4.7.10` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: CWE-184, CWE-1289

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTEwLTA4VDE3OjUyOjI2LjAwMDAwMFoiLCJHSFNBLXA4d2ctdnJ2Mi12ODZmIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTEwLTA5VDE0OjMzOjMyLjIwMTAwMFoiLCJDVkUtMjAyNi0xMDgxMDkiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTEwLTA5VDE0OjMzOjMyLjIwMTAwMFoiLCJDVkUtMjAyNi0xMDgxMDkiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.