# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter](https://agentprime.io/advisories/CVE-2026-89079.md)
  `CVE-2026-89079` · CVE record: jfarthing84 Theme My Login · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Privilege escalation
- [My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute](https://agentprime.io/advisories/CVE-2026-104798.md)
  `CVE-2026-104798` · CVE record: joedolson My Calendar – Accessible Event Manager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Privilege escalation
- [MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter](https://agentprime.io/advisories/CVE-2026-109515.md)
  `CVE-2026-109515` · CVE record: properfraction MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Privilege escalation
- [Mang Board - 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter](https://agentprime.io/advisories/CVE-2026-109219.md)
  `CVE-2026-109219` · CVE record: kitae-park Mang Board · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Unrestricted file upload
- [SQL injection in Wheels](https://agentprime.io/advisories/CVE-2026-111444.md)
  `CVE-2026-111444` · CVE record: Wheels Wheels · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.](https://agentprime.io/advisories/CVE-2026-95182.md)
  `CVE-2026-95182` · CVE record · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-426
- [Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 allows a remote attacker to execute arbitrary code via the UtilityManagerEx.exe component](https://agentprime.io/advisories/CVE-2026-26846.md)
  `CVE-2026-26846` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Memory corruption
- [Improper input validation in Google Chrome](https://agentprime.io/advisories/CVE-2026-110916.md)
  `CVE-2026-110916` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-20
- [MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force](https://agentprime.io/advisories/CVE-2026-111356.md)
  `CVE-2026-111356` · CVE record: magicblack MacCMS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console](https://agentprime.io/advisories/CVE-2026-111329.md)
  `CVE-2026-111329` · CVE record: juggleim JuggleIM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-1392
- [Archon 0.2.13 through 0.11.1 Missing Authentication via /api/\* Control API](https://agentprime.io/advisories/CVE-2026-111322.md)
  `CVE-2026-111322` · CVE record: coleam00 Archon · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [OpenHealth through 0.2.0 Missing Authentication via /api/health-data/\[id\] Route](https://agentprime.io/advisories/CVE-2026-111312.md)
  `CVE-2026-111312` · CVE record: OpenHealthForAll OpenHealth · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [BMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configuration](https://agentprime.io/advisories/CVE-2026-111283.md)
  `CVE-2026-111283` · CVE record: BMC Helix BMC Helix Network Management · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-305
- [Jooan JA-A12 Unauthenticated Root RCE via SetDiagMode Hard-Coded Credentials](https://agentprime.io/advisories/CVE-2026-111281.md)
  `CVE-2026-111281` · CVE record: Jooan JA-A12 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Hard-coded credentials
- [Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default](https://agentprime.io/advisories/CVE-2026-94134.md)
  `CVE-2026-94134` · CVE record: Apache Software Foundation Apache Airflow SSH provider and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-322
- [Ivanti Connect Secure: Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts…](https://agentprime.io/advisories/CVE-2026-111357.md)
  `CVE-2026-111357` · CVE record: Ivanti Connect Secure · CVSS 7.0 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-829
- [EnergizeLab Station Middleware Admin APIs Missing Role Checks](https://agentprime.io/advisories/CVE-2026-105039.md)
  `CVE-2026-105039` · CVE record: EnergizeLab station-middleware · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [EnergizeLab Eilik Unauthenticated AI Model Administration and Runtime Model Switching](https://agentprime.io/advisories/CVE-2026-105038.md)
  `CVE-2026-105038` · CVE record: EnergizeLab FastAPI AI inference server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [EnergizeLab Station Middleware Authenticated Path Traversal Arbitrary File Read](https://agentprime.io/advisories/CVE-2026-105037.md)
  `CVE-2026-105037` · CVE record: EnergizeLab station-middleware · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [EnergizeLab Eilik AI Skill Upload Unauthenticated Path Traversal Arbitrary File Write](https://agentprime.io/advisories/CVE-2026-105032.md)
  `CVE-2026-105032` · CVE record: EnergizeLab FastAPI AI inference server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal, Unrestricted file upload
- [Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support](https://agentprime.io/advisories/CVE-2026-102764.md)
  `CVE-2026-102764` · CVE record: BeyondTrust Remote Support · CVSS 9.3 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.78 · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses](https://agentprime.io/advisories/GHSA-qx66-fv34-fjm8.md)
  `GHSA-qx66-fv34-fjm8`, `CVE-2026-102989` · npm `@tanstack/react-start` and 3 more: affected `>=1.143.12, <1.168.60`, fixed in `1.168.60` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Podman: The \`podman run\` command can be instructed to disable almost all sandboxing by image annotation](https://agentprime.io/advisories/GHSA-2cvf-wqm6-wr9g.md)
  `GHSA-2cvf-wqm6-wr9g`, `CVE-2026-94603`, `GO-2026-6770` · Go `github.com/containers/podman/v4` and 2 more: affected `>=4.4.0, <5.8.8`, fixed in `5.8.8` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-693
- [KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication](https://agentprime.io/advisories/GHSA-637c-6jxx-4rwm.md)
  `GHSA-637c-6jxx-4rwm`, `CVE-2026-77524`, `GO-2026-6776` · Go `github.com/kedacore/keda` and 1 more: affected `<=1.5.0`, no fixed version yet · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Privilege escalation, Server-side request forgery (SSRF)
- [Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks](https://agentprime.io/advisories/GHSA-fmxq-cgp8-87wp.md)
  `GHSA-fmxq-cgp8-87wp`, `BIT-argo-cd-2026-77459`, `CVE-2026-77459`, `GO-2026-6784` · Go `github.com/argoproj/argo-cd/v2` and 1 more: affected `>=2.10.0, <=2.14.21`, no fixed version yet · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service](https://agentprime.io/advisories/GHSA-qj98-gp63-54xj.md)
  `GHSA-qj98-gp63-54xj`, `CVE-2026-102748` · Go `github.com/dgraph-io/dgraph/v25`: affected `<25.4.0`, fixed in `25.4.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Vitess vttablet /twopcz reflected XSS](https://agentprime.io/advisories/GHSA-v75v-6fpf-gvw8.md)
  `GHSA-v75v-6fpf-gvw8`, `CVE-2026-104252`, `GO-2026-6798` · Go `vitess.io/vitess`: affected `<0.23.5 || >=0.24.0, <0.24.2`, fixed in `0.23.5`, `0.24.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php](https://agentprime.io/advisories/CVE-2026-111214.md)
  `CVE-2026-111214` · CVE record: Netgate pfSense CE · CVSS 8.6 High · Critical (CVSS 7+ and EPSS) · EPSS 0.11 · Not analysed yet · Published 15 Oct 2026 · Tags: Command injection
- [OpenNMS REST authorization bypass via non-canonical HTTP method](https://agentprime.io/advisories/CVE-2026-111235.md)
  `CVE-2026-111235` · CVE record: The OpenNMS Group Meridian and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control, CWE-204
- [joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json](https://agentprime.io/advisories/CVE-2026-102946.md)
  `CVE-2026-102946` · CVE record: authlib joserfc · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass, Weak cryptography or TLS, CWE-345
- [runwasi: Forged Wasmtime precompiled OCI layer bypasses runwasi WASI sandbox](https://agentprime.io/advisories/CVE-2026-47218.md)
  `CVE-2026-47218` · CVE record: containerd runwasi · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Insecure deserialization
- [Tianji: Remote Code Execution via lodash template evaluate pattern in survey feed templates](https://agentprime.io/advisories/CVE-2026-55240.md)
  `CVE-2026-55240` · CVE record: msgbyte tianji · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Code injection
- [Pre-Authentication Admin Bypass and Remote Code Execution in Nutanix Prism Gateway inside AOS](https://agentprime.io/advisories/CVE-2026-84731.md)
  `CVE-2026-84731` · CVE record: Nutanix Acropolis Operating System (AOS) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass, CWE-302
- [Deserialization of untrusted data in the Gremlin graph-import path in Amazon Neptune](https://agentprime.io/advisories/CVE-2026-110812.md)
  `CVE-2026-110812` · CVE record: AWS Amazon Neptune Engine · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Insecure deserialization, Server-side request forgery (SSRF)
- [Wavlink WN530HG4B api.cgi heap-based overflow](https://agentprime.io/advisories/CVE-2026-110958.md)
  `CVE-2026-110958` · CVE record: Wavlink WN530HG4B · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Memory corruption
- [Template injection in WebPros SolusVM 2](https://agentprime.io/advisories/CVE-2026-105474.md)
  `CVE-2026-105474` · CVE record: WebPros SolusVM 2 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Code injection
- [OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer](https://agentprime.io/advisories/CVE-2026-57155.md)
  `CVE-2026-57155` · CVE record: opnsense core · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal, Command injection
- [Wavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injection](https://agentprime.io/advisories/CVE-2026-110957.md)
  `CVE-2026-110957` · CVE record: Wavlink WL-WN530BE2-A · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Command injection
- [EspoCRM: Authenticated RCE via Unsafe PHP Object Deserialization in MassAction/Export params](https://agentprime.io/advisories/CVE-2026-47168.md)
  `CVE-2026-47168` · CVE record: espocrm espocrm · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Insecure deserialization
- [Uncontrolled search path in Siemens Software Center](https://agentprime.io/advisories/CVE-2026-110936.md)
  `CVE-2026-110936` · CVE record: Siemens Siemens Software Center · CVSS 8.4 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-427
- [WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-109686.md)
  `CVE-2026-109686` · CVE record: Link Whisper INC Link Whisper Free · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Insecure deserialization
- [WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-109892.md)
  `CVE-2026-109892` · CVE record: Shabti Kaplan Frontend Admin by DynamiApps · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Privilege escalation
- [WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-109688.md)
  `CVE-2026-109688` · CVE record: Link Whisper INC Link Whisper Free · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: SQL injection
- [ipv4: validate checksum_start before completing checksum](https://agentprime.io/advisories/CVE-2026-99999.md)
  `CVE-2026-99999` · CVE record: Linux Linux · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-20
- [WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-109698.md)
  `CVE-2026-109698` · CVE record: Kitae Park Mang Board WP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: SQL injection
- [ipv4: free inet_opt and ireq_opt after an RCU grace period](https://agentprime.io/advisories/CVE-2026-98432.md)
  `CVE-2026-98432` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026
- [WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-109694.md)
  `CVE-2026-109694` · CVE record: WP ManageNinja LLC Fluent CRM · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Privilege escalation
- [WordPress Amelia plugin <= 2.4.10 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-108497.md)
  `CVE-2026-108497` · CVE record: TMS Amelia · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: SQL injection
- [Jetty EthereumAuthenticator unanchored login-path matching bypasses authentication and role constraints](https://agentprime.io/advisories/GHSA-6m7j-pjmp-crgq.md)
  `GHSA-6m7j-pjmp-crgq`, `CVE-2026-19863` · Maven `org.eclipse.jetty:jetty-ethereum` and 1 more: affected `>=12.1.0, <=12.1.12`, fixed in `12.1.13` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Unauthenticated remote code execution vulnerability](https://agentprime.io/advisories/CVE-2026-50619.md)
  `CVE-2026-50619` · CVE record: QNAP Systems Inc. Qsirch · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Path traversal
- [Pre-Authentication Command Injection](https://agentprime.io/advisories/CVE-2026-47786.md)
  `CVE-2026-47786` · CVE record: QNAP Systems Inc. HybridDesk Station · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Command injection
- [Import Symlink Following Remote Code Execution Vulnerability in QuMagie](https://agentprime.io/advisories/CVE-2026-50612.md)
  `CVE-2026-50612` · CVE record: QNAP Systems Inc. QuMagie · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-61
- [Pre-Authentication Multiple Critical Vulnerabilities in QNAP sMedioDTCPServer](https://agentprime.io/advisories/CVE-2026-34006.md)
  `CVE-2026-34006` · CVE record: QNAP Systems Inc. sMedio DTCP MOVE · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass
- [Authentication bypass in Stela by Diaple Networking](https://agentprime.io/advisories/CVE-2026-101287.md)
  `CVE-2026-101287` · CVE record: Diaple Stela · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-565
- [An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64](https://agentprime.io/advisories/CVE-2026-16438.md)
  `CVE-2026-16438` · CVE record: Mitsubishi Electric Corporation GENESIS64 and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Privilege escalation
- [An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz](https://agentprime.io/advisories/CVE-2026-16436.md)
  `CVE-2026-16436` · CVE record: Mitsubishi Electric Corporation GENESIS and 4 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-640
- [Deserialization of untrusted data in Eclipse Foundation Eclipse Vert.x](https://agentprime.io/advisories/CVE-2026-102469.md)
  `CVE-2026-102469` · CVE record: Eclipse Foundation Eclipse Vert.x · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Insecure deserialization
- [Multiple jail filesystem root escapes](https://agentprime.io/advisories/CVE-2026-101306.md)
  `CVE-2026-101306` · CVE record: FreeBSD FreeBSD · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-273, CWE-281
- [User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Registration Handler](https://agentprime.io/advisories/CVE-2026-109145.md)
  `CVE-2026-109145` · CVE record: Unknown User Rights Access Manager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Privilege escalation
- [10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter](https://agentprime.io/advisories/CVE-2026-108587.md)
  `CVE-2026-108587` · CVE record: 10web 10Web Booster – Website speed optimization, Cache & Page Speed optimizer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Unrestricted file upload

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTEwLTE1VDA0OjI2OjUwLjY5NzAwMFoiLCJDVkUtMjAyNi0xMDg1ODciXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTEwLTE2VDA1OjMwOjI1LjA0MzAwMFoiLCJDVkUtMjAyNi0xMDM3NjgiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTEwLTE2VDA1OjMwOjI1LjA0MzAwMFoiLCJDVkUtMjAyNi0xMDM3NjgiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.