# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [@mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir](https://agentprime.io/advisories/CVE-2026-110639.md)
  `CVE-2026-110639` · CVE record: mborne @mborne/extract · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection
- [doc-recog through 1.1.6 OS Command Injection via DocData.\_readPDF File Path](https://agentprime.io/advisories/CVE-2026-110638.md)
  `CVE-2026-110638` · CVE record: zepspaiva doc-recog · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection
- [pypdftk through 0.5 OS Command Injection via PDF and Output Paths](https://agentprime.io/advisories/CVE-2026-110636.md)
  `CVE-2026-110636` · CVE record: revolunet pypdftk · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection
- [webp-converter before 3.0.0 OS Command Injection via File Names and Options](https://agentprime.io/advisories/CVE-2026-110635.md)
  `CVE-2026-110635` · CVE record: scionoftech webp-converter · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection
- [Report One MyReport Updater through 2.1.1 Unauthenticated gRPC Service RCE](https://agentprime.io/advisories/CVE-2026-110632.md)
  `CVE-2026-110632` · CVE record: Report One MyReport Updater · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [Komodo through 2.3.3 Periphery Agent Unauthenticated RCE via Default Configuration](https://agentprime.io/advisories/CVE-2026-110631.md)
  `CVE-2026-110631` · CVE record: moghtech komodo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1188
- [Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment](https://agentprime.io/advisories/CVE-2026-110628.md)
  `CVE-2026-110628` · CVE record: kanbn kan · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [NullHub through 2026.5.29 Missing Authentication for /api Management API](https://agentprime.io/advisories/CVE-2026-110616.md)
  `CVE-2026-110616` · CVE record: nullclaw NullHub · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [vlife through 2.0.1 Authentication Bypass via Hardcoded JWT Secret in TokenUtil](https://agentprime.io/advisories/CVE-2026-110612.md)
  `CVE-2026-110612` · CVE record: wwwlike vlife · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Hard-coded credentials
- [office-converter through 1.0.2 OS Command Injection via fileName in generatePdf](https://agentprime.io/advisories/CVE-2020-37282.md)
  `CVE-2020-37282` · CVE record: vworld4u office-converter · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection
- [Gravitee API Management through 4.12.22 Default JWT Secret Authentication Bypass](https://agentprime.io/advisories/CVE-2020-37281.md)
  `CVE-2020-37281` · CVE record: Gravitee Gravitee API Management · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-1394
- [Unauthenticated SQL Injection in Channel Software WebAlliance eCommerce](https://agentprime.io/advisories/CVE-2026-108065.md)
  `CVE-2026-108065` · CVE record: Channel Software WebAlliance eCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection
- [Missing Authentication for Critical Function in TR7 Cyber Defense's TR7 ASP](https://agentprime.io/advisories/CVE-2026-16740.md)
  `CVE-2026-16740` · CVE record: TR7 Cyber Defense Inc. TR7 ASP · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [OS Command in TR7 Cyber Defense's TR7 ASP](https://agentprime.io/advisories/CVE-2026-16741.md)
  `CVE-2026-16741` · CVE record: TR7 Cyber Defense Inc. TR7 ASP · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection
- [WordPress Affiliates plugin <= 7.0.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-108291.md)
  `CVE-2026-108291` · CVE record: itthinx Affiliates · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Insecure deserialization
- [WordPress Frontend Dashboard plugin <= 3.0.7 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-107424.md)
  `CVE-2026-107424` · CVE record: M A Vinoth Kumar Frontend Dashboard · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Privilege escalation
- [Unauthorised disclosure of information on Copart’s online billing service](https://agentprime.io/advisories/CVE-2026-14851.md)
  `CVE-2026-14851` · CVE record: Copart Copart’s online billing service · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure
- [SimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register](https://agentprime.io/advisories/CVE-2026-104748.md)
  `CVE-2026-104748` · CVE record: wpazleen SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Privilege escalation
- [SQL Command Injection Vulnerability in JTL-WMS](https://agentprime.io/advisories/CVE-2026-89310.md)
  `CVE-2026-89310` · CVE record: JTL SW GmbH JTL-WMS · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection
- [File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion](https://agentprime.io/advisories/CVE-2026-107594.md)
  `CVE-2026-107594` · CVE record: Unknown File Upload to Order · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal
- [OS command injection in EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd and others](https://agentprime.io/advisories/CVE-2026-106931.md)
  `CVE-2026-106931` · CVE record: EG Secure Solutions Inc. SiteGuard Server Edition for Apache httpd and 4 more · CVSS 8.5 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection
- [JTL-Connector for WooCommerce <= 2.4.3 - Unauthenticated Arbitrary File Upload via 'image.push' Method](https://agentprime.io/advisories/CVE-2026-87855.md)
  `CVE-2026-87855` · CVE record: ntbyk JTL-Connector for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Unrestricted file upload
- [AGE-GATE <= 1.0 - Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php](https://agentprime.io/advisories/CVE-2026-104800.md)
  `CVE-2026-104800` · CVE record: streetforce1 AGE-GATE · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Unrestricted file upload
- [OS command injection in Collabora Online - Built-in CODE Server](https://agentprime.io/advisories/CVE-2026-110447.md)
  `CVE-2026-110447` · CVE record: Collabora Collabora Online - Built-in CODE Server · CVSS 9.2 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.73 · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection
- [Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter](https://agentprime.io/advisories/CVE-2026-97657.md)
  `CVE-2026-97657` · CVE record: Tyche Softwares Abandoned Cart Pro for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_value](https://agentprime.io/advisories/CVE-2026-97668.md)
  `CVE-2026-97668` · CVE record: Tyche Softwares Abandoned Cart Pro for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection
- [Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter](https://agentprime.io/advisories/CVE-2026-110002.md)
  `CVE-2026-110002` · CVE record: snazzyplugins Snazzy Social Media Feed · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Unrestricted file upload
- [Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning](https://agentprime.io/advisories/CVE-2026-110392.md)
  `CVE-2026-110392` · CVE record: Samsung Open Source QA-Board · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection
- [Click to Chat <= 4.44 - Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder](https://agentprime.io/advisories/CVE-2026-92097.md)
  `CVE-2026-92097` · CVE record: holithemes Click to Chat – HoliThemes · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Code injection
- [Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url](https://agentprime.io/advisories/CVE-2026-93388.md)
  `CVE-2026-93388` · CVE record: printcart Printcart Store – Web to Print Product Designer for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Unrestricted file upload
- [Legacy Update ActiveX control accepts unauthorized hosting origins](https://agentprime.io/advisories/CVE-2026-97381.md)
  `CVE-2026-97381` · CVE record: LegacyUpdate LegacyUpdate · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-346, CWE-393
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-110142.md)
  `CVE-2026-110142` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-110144.md)
  `CVE-2026-110144` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-110159.md)
  `CVE-2026-110159` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-110165.md)
  `CVE-2026-110165` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-110161.md)
  `CVE-2026-110161` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-110136.md)
  `CVE-2026-110136` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-110149.md)
  `CVE-2026-110149` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption
- [Heap-based buffer overflow in Google Chrome](https://agentprime.io/advisories/CVE-2026-110152.md)
  `CVE-2026-110152` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption
- [Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability](https://agentprime.io/advisories/GHSA-rv87-ccxw-8ggf.md)
  `GHSA-rv87-ccxw-8ggf`, `BIT-aspnet-core-2026-88092`, `CVE-2026-88092` · NuGet `Microsoft.AspNetCore.App.Runtime.linux-arm` and 10 more: affected `>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2`, fixed in `8.0.32`, `9.0.21`, `10.0.13`, `11.0.0-rc.2` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: HTTP request smuggling
- [Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability](https://agentprime.io/advisories/GHSA-fpq8-4vhr-rcxx.md)
  `GHSA-fpq8-4vhr-rcxx`, `CVE-2026-70188` · NuGet `Microsoft.AspNetCore.App.Runtime.linux-arm` and 10 more: affected `>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2`, fixed in `8.0.32`, `9.0.21`, `10.0.13`, `11.0.0-rc.2` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: HTTP request smuggling
- [ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)](https://agentprime.io/advisories/CVE-2026-106622.md)
  `CVE-2026-106622` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [ColdFusion | Improper Input Validation (CWE-20)](https://agentprime.io/advisories/CVE-2026-106619.md)
  `CVE-2026-106619` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-20
- [ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)](https://agentprime.io/advisories/CVE-2026-106624.md)
  `CVE-2026-106624` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Code injection
- [ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)](https://agentprime.io/advisories/CVE-2026-106621.md)
  `CVE-2026-106621` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Code injection
- [ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)](https://agentprime.io/advisories/CVE-2026-90530.md)
  `CVE-2026-90530` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Path traversal
- [ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94)](https://agentprime.io/advisories/CVE-2026-105903.md)
  `CVE-2026-105903` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Code injection
- [ColdFusion | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-75994.md)
  `CVE-2026-75994` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [ColdFusion | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-106620.md)
  `CVE-2026-106620` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [ColdFusion | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-106612.md)
  `CVE-2026-106612` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)](https://agentprime.io/advisories/CVE-2026-105899.md)
  `CVE-2026-105899` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Unrestricted file upload
- [Xorbits Xoscar 0.11.2 Unauthenticated Deserialization RCE via Actor Pool](https://agentprime.io/advisories/CVE-2026-49950.md)
  `CVE-2026-49950` · CVE record: xorbitsai xoscar · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Insecure deserialization
- [IBM WebSphere Application Server Liberty is affected by an authentication bypass](https://agentprime.io/advisories/CVE-2026-93909.md)
  `CVE-2026-93909` · CVE record: IBM WebSphere Application Server - Liberty · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Authentication bypass
- [IBM WebSphere Application Server Liberty Improper Access Control](https://agentprime.io/advisories/CVE-2026-93895.md)
  `CVE-2026-93895` · CVE record: IBM WebSphere Application Server - Liberty · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability](https://agentprime.io/advisories/GHSA-5gjq-3f94-rcf7.md)
  `GHSA-5gjq-3f94-rcf7`, `CVE-2026-105016` · NuGet `Microsoft.Native.Quic.MsQuic.Schannel`: affected `>=2.5.11-ci.156755675, <2.5.11-ci.159417053`, fixed in `2.5.11-ci.159417053` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption
- [Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage](https://agentprime.io/advisories/CVE-2026-63160.md)
  `CVE-2026-63160` · CVE record: Omnispace Agora Project · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Hard-coded credentials
- [Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover](https://agentprime.io/advisories/CVE-2026-63159.md)
  `CVE-2026-63159` · CVE record: Omnispace Agora Project · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-640
- [Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies](https://agentprime.io/advisories/CVE-2026-63158.md)
  `CVE-2026-63158` · CVE record: Omnispace Agora Project · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: CWE-836
- [Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()](https://agentprime.io/advisories/CVE-2026-63149.md)
  `CVE-2026-63149` · CVE record: Omnispace Agora Project · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Weak cryptography or TLS
- [Adobe Experience Manager | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-90532.md)
  `CVE-2026-90532` · CVE record: Adobe Adobe Experience Manager as a Cloud Service and 2 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTEwLTEzVDE5OjM5OjAxLjQ3MTAwMFoiLCJDVkUtMjAyNi05MDUzMiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTEwLTE0VDE0OjE3OjExLjI0OTAwMFoiLCJDVkUtMjAyNi0xMTA2NDAiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTEwLTE0VDE0OjE3OjExLjI0OTAwMFoiLCJDVkUtMjAyNi0xMTA2NDAiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.