# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.18 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-42696.md)
  `CVE-2026-42696` · CVE record: Royal Plugins SiteVault – Backup, Restore, Migration \&amp; Cloning · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Code injection
- [WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-40800.md)
  `CVE-2026-40800` · CVE record: ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: SQL injection
- [WordPress AIWU plugin <= 1.5.9 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-39801.md)
  `CVE-2026-39801` · CVE record: Sergey AIWU · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Privilege escalation
- [Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates](https://agentprime.io/advisories/CVE-2026-108598.md)
  `CVE-2026-108598` · CVE record: floci-io floci · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Code injection
- [WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-106610.md)
  `CVE-2026-106610` · CVE record: miniOrange miniorange otp verification · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Privilege escalation
- [WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability](https://agentprime.io/advisories/CVE-2026-105892.md)
  `CVE-2026-105892` · CVE record: rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Path traversal
- [WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-105889.md)
  `CVE-2026-105889` · CVE record: Tickera Tickera · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: SQL injection
- [WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-104398.md)
  `CVE-2026-104398` · CVE record: VillaTheme AFFI – Affiliate Marketing for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates](https://agentprime.io/advisories/CVE-2026-108551.md)
  `CVE-2026-108551` · CVE record: ferdikoomen openapi-typescript-codegen · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Code injection
- [cc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender Spoofing](https://agentprime.io/advisories/CVE-2026-108549.md)
  `CVE-2026-108549` · CVE record: chenhg5 cc-connect · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Authentication bypass
- [ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument](https://agentprime.io/advisories/CVE-2026-107373.md)
  `CVE-2026-107373` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Memory corruption
- [ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target](https://agentprime.io/advisories/GHSA-4684-h2q9-2vcp.md)
  `GHSA-4684-h2q9-2vcp`, `RUSTSEC-2026-0369` · crates.io `zip`: affected `>=0.0.0-0, <9.0.0`, fixed in `9.0.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026
- [Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch](https://agentprime.io/advisories/CVE-2026-103635.md)
  `CVE-2026-103635` · CVE record: Apache Software Foundation Apache DataSketches · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Memory corruption
- [Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch](https://agentprime.io/advisories/CVE-2026-103513.md)
  `CVE-2026-103513` · CVE record: Apache Software Foundation Apache DataSketches · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Memory corruption
- [Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch](https://agentprime.io/advisories/CVE-2026-103501.md)
  `CVE-2026-103501` · CVE record: Apache Software Foundation Apache DataSketches · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Memory corruption, CWE-1284
- [WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback](https://agentprime.io/advisories/CVE-2026-104803.md)
  `CVE-2026-104803` · CVE record: whyun WPCOM Member · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Authentication bypass
- [WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62045.md)
  `CVE-2026-62045` · CVE record: ThemeREX Group Booklovers · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62046.md)
  `CVE-2026-62046` · CVE record: ThemeREX Group Gutentype · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93945.md)
  `CVE-2026-93945` · CVE record: Axiomthemes Balance · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93944.md)
  `CVE-2026-93944` · CVE record: ThemeREX Group Camelia · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93943.md)
  `CVE-2026-93943` · CVE record: ThemeREX Group Convex · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93942.md)
  `CVE-2026-93942` · CVE record: ThemeREX Group Dwell · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93941.md)
  `CVE-2026-93941` · CVE record: ThemeREX Group Edema · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93940.md)
  `CVE-2026-93940` · CVE record: ThemeREX Group Greeny · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93938.md)
  `CVE-2026-93938` · CVE record: ThemeREX Group Hogwords · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93937.md)
  `CVE-2026-93937` · CVE record: ThemeREX Group Hygia · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93936.md)
  `CVE-2026-93936` · CVE record: ThemeREX Group IPharm · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93935.md)
  `CVE-2026-93935` · CVE record: ThemeREX Group Let's Play · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93934.md)
  `CVE-2026-93934` · CVE record: ThemeREX Group Partiso · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93933.md)
  `CVE-2026-93933` · CVE record: ThemeREX Group Rosalinda · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93932.md)
  `CVE-2026-93932` · CVE record: ThemeREX Group Smart Casa · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93931.md)
  `CVE-2026-93931` · CVE record: ThemeREX Group Smash · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93930.md)
  `CVE-2026-93930` · CVE record: ThemeREX Group Tantra · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93929.md)
  `CVE-2026-93929` · CVE record: ThemeREX Group Travesia · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-93927.md)
  `CVE-2026-93927` · CVE record: Axiomthemes Veto · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Insecure deserialization
- [PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom\[fields\]\[\<data_name>\]\[n\]\[org\]' Parameter](https://agentprime.io/advisories/CVE-2026-104801.md)
  `CVE-2026-104801` · CVE record: themeisle PPOM – Product Addons & Custom Fields for WooCommerce · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Path traversal
- [Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field](https://agentprime.io/advisories/CVE-2026-97670.md)
  `CVE-2026-97670` · CVE record: themefusion Avada (Fusion) Builder · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Code injection
- [3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter](https://agentprime.io/advisories/CVE-2026-103889.md)
  `CVE-2026-103889` · CVE record: expivi 3D Product configurator for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Unrestricted file upload
- [Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload](https://agentprime.io/advisories/CVE-2026-94589.md)
  `CVE-2026-94589` · CVE record: htplugins Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Unrestricted file upload
- [Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler](https://agentprime.io/advisories/CVE-2026-104732.md)
  `CVE-2026-104732` · CVE record: inilerm Advanced IP Blocker · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Authentication bypass
- [Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter](https://agentprime.io/advisories/CVE-2026-107645.md)
  `CVE-2026-107645` · CVE record: creativethemeshq Blocksy Companion · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Oct 2026 · Tags: Privilege escalation
- [SQL injection in JetBrains Exposed](https://agentprime.io/advisories/CVE-2026-108474.md)
  `CVE-2026-108474` · CVE record: JetBrains Exposed · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: SQL injection
- [ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session](https://agentprime.io/advisories/CVE-2026-108269.md)
  `CVE-2026-108269` · CVE record: Privasys ra-tls-clients · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-346
- [enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session](https://agentprime.io/advisories/CVE-2026-108268.md)
  `CVE-2026-108268` · CVE record: Privasys enclave-os-virtual · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-346
- [Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session](https://agentprime.io/advisories/CVE-2026-108267.md)
  `CVE-2026-108267` · CVE record: Privasys go · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-346
- [Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session](https://agentprime.io/advisories/CVE-2026-108266.md)
  `CVE-2026-108266` · CVE record: Privasys rustls · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-346
- [TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment](https://agentprime.io/advisories/GHSA-x34j-47hf-4xg7.md)
  `GHSA-x34j-47hf-4xg7`, `CVE-2026-108261` · npm `tinacms` and 1 more: affected `<3.14.0`, fixed in `3.14.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Open redirect, CWE-346, CWE-441
- [enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session](https://agentprime.io/advisories/CVE-2026-108265.md)
  `CVE-2026-108265` · CVE record: Privasys enclave-os-mini · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-346
- [Contao: Cross-site scripting in the comments bundle](https://agentprime.io/advisories/GHSA-628f-v4f6-p37r.md)
  `GHSA-628f-v4f6-p37r`, `CVE-2026-107845`, `PKSA-c42s-m9fj-8jxw` · Packagist `contao/comments-bundle`: affected `>=4.0.0, <5.3.50 || >=5.4.0-RC1, <5.7.12`, fixed in `5.3.50`, `5.7.12` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)](https://agentprime.io/advisories/CVE-2026-108264.md)
  `CVE-2026-108264` · CVE record: wizarrrr wizarr · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Code injection
- [Astron Agent: Unsandboxed code-node leads to cross-tenant RCE](https://agentprime.io/advisories/CVE-2026-108263.md)
  `CVE-2026-108263` · CVE record: iflytek astron-agent · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Code injection, Authentication bypass, Broken access control, CWE-653
- [Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite](https://agentprime.io/advisories/GHSA-p393-cf76-4jmr.md)
  `GHSA-p393-cf76-4jmr`, `CVE-2026-107806`, `GO-2026-6741` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20260421071512-7864e378f5cf, <1.9.10-0.20260728074146-a467ed652591`, fixed in `1.9.10-0.20260728074146-a467ed652591` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Code injection
- [Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)](https://agentprime.io/advisories/GHSA-rj9j-8772-4h6c.md)
  `GHSA-rj9j-8772-4h6c`, `CVE-2026-68582`, `GO-2026-6749` · Go `code.vikunja.io/api`: affected `>=0.24.0, <2.4.0`, fixed in `2.4.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [x64dbg-MCP Server exposes debugger operations to unauthenticated network clients](https://agentprime.io/advisories/CVE-2026-107824.md)
  `CVE-2026-107824` · CVE record: duty1g x64dbg-mcp-server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)](https://agentprime.io/advisories/GHSA-fr26-jjhm-638c.md)
  `GHSA-fr26-jjhm-638c`, `CVE-2026-123815` · PyPI `pyload-ng`: affected `<=0.5.0b3.dev101`, no fixed version yet · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Path traversal, Unrestricted file upload
- [Pingvin Share X 0.19.0 before 1.22.0 Account Takeover via OAuth Email Linking](https://agentprime.io/advisories/CVE-2026-108157.md)
  `CVE-2026-108157` · CVE record: smp46 pingvin-share-x · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [Savannah lwIP SMTP client Classic Buffer Overflow](https://agentprime.io/advisories/CVE-2026-15340.md)
  `CVE-2026-15340` · CVE record: Savannah lwIP SMTP client · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Memory corruption
- [Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function](https://agentprime.io/advisories/CVE-2026-33367.md)
  `CVE-2026-33367` · CVE record: Red Lion Controls 700 Series · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass
- [Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format](https://agentprime.io/advisories/CVE-2026-28745.md)
  `CVE-2026-28745` · CVE record: Red Lion Controls 700 Series · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-257
- [PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code](https://agentprime.io/advisories/CVE-2026-108109.md)
  `CVE-2026-108109` · CVE record: hotspotbilling phpnuxbill · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTEwLTA5VDE0OjMzOjMyLjIwMTAwMFoiLCJDVkUtMjAyNi0xMDgxMDkiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTEwLTEwVDE5OjM1OjE2Ljc2ODAwMFoiLCJDVkUtMjAyNi00MjcxNiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTEwLTEwVDE5OjM1OjE2Ljc2ODAwMFoiLCJDVkUtMjAyNi00MjcxNiJd>. Everything for agents: <https://agentprime.io/llms.txt>.