# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [tcp: prevent collapsing skbs across boundary in rtx queue](https://agentprime.io/advisories/CVE-2026-98549.md)
  `CVE-2026-98549` · CVE record: Linux Linux · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Oct 2026
- [sctp: discard the rest of the packet on a stale-cookie error](https://agentprime.io/advisories/CVE-2026-98548.md)
  `CVE-2026-98548` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Oct 2026
- [net: openvswitch: conntrack: fix helper UAF due to extensions realloc](https://agentprime.io/advisories/CVE-2026-98490.md)
  `CVE-2026-98490` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Oct 2026
- [RISC-V: KVM: Synchronize hrtimer callback during teardown](https://agentprime.io/advisories/CVE-2026-98464.md)
  `CVE-2026-98464` · CVE record: Linux Linux · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Oct 2026
- [WhoDB 0.104.0 before 0.135.0 Arbitrary File Read/Write via DuckDB Query Editor](https://agentprime.io/advisories/CVE-2026-112005.md)
  `CVE-2026-112005` · CVE record: clidey whodb · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Oct 2026 · Tags: Path traversal
- [Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway](https://agentprime.io/advisories/CVE-2026-111998.md)
  `CVE-2026-111998` · CVE record: vanus-labs vanus · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Oct 2026 · Tags: CWE-1392
- [WordPress Conversational Forms for ChatBot plugin <= 1.5.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-110886.md)
  `CVE-2026-110886` · CVE record: QuantumCloud Conversational Forms for ChatBot · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Oct 2026 · Tags: Insecure deserialization
- [WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-109894.md)
  `CVE-2026-109894` · CVE record: Arraytics Booktics · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Oct 2026 · Tags: SQL injection
- [WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-110372.md)
  `CVE-2026-110372` · CVE record: Brainstorm Force OttoKit · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Oct 2026 · Tags: Privilege escalation
- [phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection](https://agentprime.io/advisories/CVE-2026-111911.md)
  `CVE-2026-111911` · CVE record: thorsten phpMyFAQ · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2026 · Tags: Authentication bypass
- [LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter](https://agentprime.io/advisories/CVE-2026-104736.md)
  `CVE-2026-104736` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2026 · Tags: Insecure deserialization
- [Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter](https://agentprime.io/advisories/CVE-2026-110653.md)
  `CVE-2026-110653` · CVE record: latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2026 · Tags: Authentication bypass
- [Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.](https://agentprime.io/advisories/CVE-2026-111823.md)
  `CVE-2026-111823` · CVE record: Mage mage-ai · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-390
- [Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse](https://agentprime.io/advisories/CVE-2026-110759.md)
  `CVE-2026-110759` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-1286
- [Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine](https://agentprime.io/advisories/CVE-2026-110757.md)
  `CVE-2026-110757` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-116
- [Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print](https://agentprime.io/advisories/CVE-2026-110756.md)
  `CVE-2026-110756` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-116
- [Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline](https://agentprime.io/advisories/CVE-2026-110753.md)
  `CVE-2026-110753` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Memory corruption, CWE-911
- [LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport](https://agentprime.io/advisories/GHSA-w5f2-9q9c-ff4h.md)
  `GHSA-w5f2-9q9c-ff4h`, `CVE-2026-105192` · PyPI `lmcache`: affected `>=0.3.9, <0.5.6`, fixed in `0.5.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass, Insecure deserialization
- [Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution](https://agentprime.io/advisories/GHSA-h4mw-j7qp-8mwm.md)
  `GHSA-h4mw-j7qp-8mwm`, `CVE-2026-96620` · PyPI `claude-agent-sdk`: affected `<0.2.121`, fixed in `0.2.121` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Command injection, CWE-20
- [Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)](https://agentprime.io/advisories/CVE-2026-108709.md)
  `CVE-2026-108709` · CVE record: Apache Software Foundation Apache Kylin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)](https://agentprime.io/advisories/CVE-2026-102608.md)
  `CVE-2026-102608` · CVE record: ZoneMinder zoneminder · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Command injection
- [Apache Kylin: Unauthenticated Metastore Cleanup](https://agentprime.io/advisories/CVE-2026-68573.md)
  `CVE-2026-68573` · CVE record: Apache Software Foundation Apache Kylin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [Openwave Messaging (Ireland) Limited Webtop Media Transcoder: Openwave Webtop Media Transcoder does not enforce administrator-defined file type…](https://agentprime.io/advisories/CVE-2026-111793.md)
  `CVE-2026-111793` · CVE record: Openwave Messaging (Ireland) Limited Webtop Media Transcoder · CVSS 4.3 Medium · Critical (KEV) · In CISA KEV · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-669
- [Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()](https://agentprime.io/advisories/CVE-2026-111711.md)
  `CVE-2026-111711` · CVE record: Netcore NR256CN · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Memory corruption
- [WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup](https://agentprime.io/advisories/CVE-2026-111708.md)
  `CVE-2026-111708` · CVE record: canove whaticket-community · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Privilege escalation
- [LangChat through commit 2a6285a Missing Authentication on REST API Controllers](https://agentprime.io/advisories/CVE-2026-111704.md)
  `CVE-2026-111704` · CVE record: LangChat langchat · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials](https://agentprime.io/advisories/CVE-2026-111693.md)
  `CVE-2026-111693` · CVE record: databufflabs databuff · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-1392
- [DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret](https://agentprime.io/advisories/CVE-2026-111692.md)
  `CVE-2026-111692` · CVE record: databufflabs databuff · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Hard-coded credentials
- [WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header](https://agentprime.io/advisories/CVE-2026-111691.md)
  `CVE-2026-111691` · CVE record: wimoor-erp wimoor · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass](https://agentprime.io/advisories/CVE-2026-111690.md)
  `CVE-2026-111690` · CVE record: suyuan32 simple-admin-core · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Hard-coded credentials
- [WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint](https://agentprime.io/advisories/CVE-2026-111687.md)
  `CVE-2026-111687` · CVE record: rachelos we-mp-rss · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Code injection
- [Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover](https://agentprime.io/advisories/CVE-2026-111675.md)
  `CVE-2026-111675` · CVE record: xiaochong0302 course-tencent-cloud · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints](https://agentprime.io/advisories/CVE-2026-111673.md)
  `CVE-2026-111673` · CVE record: Thecosy IceCMS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation](https://agentprime.io/advisories/CVE-2026-111663.md)
  `CVE-2026-111663` · CVE record: chaskiq chaskiq · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback](https://agentprime.io/advisories/CVE-2026-111643.md)
  `CVE-2026-111643` · CVE record: l429609201 misaka_danmu_server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints](https://agentprime.io/advisories/CVE-2026-111641.md)
  `CVE-2026-111641` · CVE record: fastapiadmin FastapiAdmin · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret](https://agentprime.io/advisories/CVE-2026-111636.md)
  `CVE-2026-111636` · CVE record: OpenBMB StaffDeck · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Hard-coded credentials
- [Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers](https://agentprime.io/advisories/CVE-2026-111626.md)
  `CVE-2026-111626` · CVE record: Webreaper Damselfly · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling](https://agentprime.io/advisories/CVE-2026-102551.md)
  `CVE-2026-102551` · CVE record: FreeRTOS FreeRTOS-Plus-TCP · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-940
- [Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel](https://agentprime.io/advisories/CVE-2026-109588.md)
  `CVE-2026-109588` · CVE record: FreeRTOS FreeRTOS-Kernel · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Memory corruption, CWE-197
- [Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel](https://agentprime.io/advisories/CVE-2026-109587.md)
  `CVE-2026-109587` · CVE record: FreeRTOS FreeRTOS-Kernel · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [RIOT: DHCPv6 client \_parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read](https://agentprime.io/advisories/CVE-2026-49868.md)
  `CVE-2026-49868` · CVE record: RIOT-OS RIOT · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Memory corruption
- [RIOT: Remote Stack Buffer Overflow in ATWINC15x0 driver via unsanitized SSID](https://agentprime.io/advisories/CVE-2026-102693.md)
  `CVE-2026-102693` · CVE record: RIOT-OS RIOT · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Memory corruption
- [RIOT: Potential integer overflow in nanocoap Block2 handling leading to out-of-bounds memory access](https://agentprime.io/advisories/CVE-2026-102692.md)
  `CVE-2026-102692` · CVE record: RIOT-OS RIOT · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Memory corruption
- [MariaDB: Use-after-free with a large number of SYS_REFCURSOR's](https://agentprime.io/advisories/CVE-2026-85748.md)
  `CVE-2026-85748` · CVE record: MariaDB server · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Memory corruption
- [MariaDB: Out-of-bound buffer write on in \`ST_AsText\` of nested GeometryCollections](https://agentprime.io/advisories/CVE-2026-85746.md)
  `CVE-2026-85746` · CVE record: MariaDB server · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Memory corruption
- [MariaDB: Numerous issues caused by historical #mysql50# tablename encoding bypass.](https://agentprime.io/advisories/CVE-2026-92262.md)
  `CVE-2026-92262` · CVE record: MariaDB server · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-706
- [Dockhand: Unauthenticated container exec via WebSocket upgrade](https://agentprime.io/advisories/CVE-2026-57169.md)
  `CVE-2026-57169` · CVE record: Finsys dockhand · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass, Broken access control
- [countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context](https://agentprime.io/advisories/CVE-2026-44977.md)
  `CVE-2026-44977` · CVE record: Countly countly-server · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [J4Care dcm4che Missing Authentication for Critical Function](https://agentprime.io/advisories/CVE-2026-105279.md)
  `CVE-2026-105279` · CVE record: J4Care dcm4chee-arc-light · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass
- [Guangzhou Juan IoT Technology EseeCloud Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-107617.md)
  `CVE-2026-107617` · CVE record: Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Hard-coded credentials
- [Improper Encoding or Escaping of Output in Crafty Controller](https://agentprime.io/advisories/CVE-2026-18516.md)
  `CVE-2026-18516` · CVE record: Arcadia Technology, LLC Crafty Controller · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: CWE-116
- [Apache Kylin: Missing authentication on certain cache API endpoints](https://agentprime.io/advisories/CVE-2026-64959.md)
  `CVE-2026-64959` · CVE record: Apache Software Foundation Apache Kylin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection, Authentication bypass
- [Apache Kylin: Redis unsafe Java deserialization](https://agentprime.io/advisories/CVE-2026-64610.md)
  `CVE-2026-64610` · CVE record: Apache Software Foundation Apache Kylin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Insecure deserialization
- [Apache Kylin: Missing authorization and path-confinement on system meta dump](https://agentprime.io/advisories/CVE-2026-63619.md)
  `CVE-2026-63619` · CVE record: Apache Software Foundation Apache Kylin · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter](https://agentprime.io/advisories/CVE-2026-111391.md)
  `CVE-2026-111391` · CVE record: sgl-project sglang · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Code injection
- [SQL injection in TSG Profleet](https://agentprime.io/advisories/CVE-2026-111472.md)
  `CVE-2026-111472` · CVE record: TSG Profleet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-94169.md)
  `CVE-2026-94169` · CVE record: Theme-one The Grid · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Code injection
- [WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94388.md)
  `CVE-2026-94388` · CVE record: halfdata Green Popups · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: SQL injection
- [Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter](https://agentprime.io/advisories/CVE-2026-104730.md)
  `CVE-2026-104730` · CVE record: sunshinephotocart Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Insecure deserialization

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTEwLTE2VDA2OjQxOjA2LjEzMTAwMFoiLCJDVkUtMjAyNi0xMDQ3MzAiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTEwLTE4VDE4OjA1OjM0LjA1MDAwMFoiLCJDVkUtMjAyNC00NDU3Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTEwLTE4VDE4OjA1OjM0LjA1MDAwMFoiLCJDVkUtMjAyNC00NDU3Il0>. Everything for agents: <https://agentprime.io/llms.txt>.