# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [asVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation](https://agentprime.io/advisories/CVE-2026-110956.md)
  `CVE-2026-110956` · CVE record: Unknown asVereinbase · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: Authentication bypass
- [Prime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace](https://agentprime.io/advisories/CVE-2026-115806.md)
  `CVE-2026-115806` · CVE record: codexonics Prime Mover – Backup and Migration · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: Insecure deserialization
- [Arbitrary file read and backend crash through unrestricted provider method calls](https://agentprime.io/advisories/CVE-2026-115931.md)
  `CVE-2026-115931` · CVE record: GitroomHQ postiz-app · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal, Code injection
- [Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution](https://agentprime.io/advisories/GHSA-5x8w-8jj5-q52h.md)
  `GHSA-5x8w-8jj5-q52h`, `BIT-pillow-2026-112398`, `CVE-2026-112398`, `PYSEC-2026-4330` · PyPI `pillow`: affected `<13.0.0`, fixed in `13.0.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Memory corruption
- [Laravel TokenGuard authentication bypass through non-string API credentials](https://agentprime.io/advisories/GHSA-f9x3-7vq9-cph6.md)
  `GHSA-f9x3-7vq9-cph6`, `CVE-2026-114509`, `PKSA-b41t-wbzk-9q51` · Packagist `laravel/framework`: affected `<12.68.0 || >=13.0.0, <13.29.0`, fixed in `12.68.0`, `13.29.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, CWE-1287
- [Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls](https://agentprime.io/advisories/GHSA-cxf3-9h37-7rr8.md)
  `GHSA-cxf3-9h37-7rr8`, `CVE-2026-118264`, `GO-2026-6839` · Go `github.com/labstack/echo/v4` and 1 more: affected `>=4.0.0, <4.16.1`, fixed in `4.16.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: HTTP request smuggling, Broken access control
- [Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server](https://agentprime.io/advisories/CVE-2026-115812.md)
  `CVE-2026-115812` · CVE record: AWS multi-model-server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal
- [obsidian-tc tokens can access arbitrary configured vaults](https://agentprime.io/advisories/GHSA-84c9-qqpq-2pq5.md)
  `GHSA-84c9-qqpq-2pq5`, `CVE-2026-77366` · npm `obsidian-tc`: affected `<1.3.1`, fixed in `1.3.1` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Conda Organization Infrastructure: Pwn Request in update workflow allows PR-controlled template rendering with SYNC_TOKEN](https://agentprime.io/advisories/CVE-2026-53942.md)
  `CVE-2026-53942` · CVE record: conda infrastructure · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Code injection
- [Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS](https://agentprime.io/advisories/CVE-2026-55486.md)
  `CVE-2026-55486` · CVE record: intranda goobi-viewer-core · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site scripting (XSS), Other injection, Code injection
- [Path traversal via HTTP \`Content-Disposition\` header in ExternalFilesDownloader enables remote code execution in Goobi viewer](https://agentprime.io/advisories/CVE-2026-46652.md)
  `CVE-2026-46652` · CVE record: intranda goobi-viewer-core · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal
- [Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer](https://agentprime.io/advisories/CVE-2026-46651.md)
  `CVE-2026-46651` · CVE record: intranda goobi-viewer-core · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, Information disclosure, Server-side request forgery (SSRF)
- [odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)](https://agentprime.io/advisories/CVE-2026-53921.md)
  `CVE-2026-53921` · CVE record: openwrt odhcpd · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Memory corruption
- [WordPress Hostme v2 theme <= 7.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112848.md)
  `CVE-2026-112848` · CVE record: AivahThemes Hostme v2 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization
- [WordPress Holistic Center theme <= 1.2.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112854.md)
  `CVE-2026-112854` · CVE record: axiomthemes Holistic Center · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization
- [WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112847.md)
  `CVE-2026-112847` · CVE record: ThemeREX ZenSoul · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization
- [WordPress Save Life theme <= 1.2.14 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112846.md)
  `CVE-2026-112846` · CVE record: ThemeREX Group Save Life · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization
- [WordPress HotLock theme <= 1.3.9 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112851.md)
  `CVE-2026-112851` · CVE record: ThemeREX Group HotLock · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization
- [WordPress Hallelujah theme <= 1.1.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112853.md)
  `CVE-2026-112853` · CVE record: axiomthemes Hallelujah · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization
- [WordPress Vagabonds theme <= 1.3.10 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112856.md)
  `CVE-2026-112856` · CVE record: ThemeREX Group Vagabonds · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization
- [WordPress Reprizo theme <= 1.0.8 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112857.md)
  `CVE-2026-112857` · CVE record: axiomthemes Reprizo · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization
- [WordPress Rhodos theme <= 1.3.3 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112858.md)
  `CVE-2026-112858` · CVE record: axiomthemes Rhodos · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization
- [WordPress Little Birdies theme <= 1.3.16 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112859.md)
  `CVE-2026-112859` · CVE record: ThemeREX Group Little Birdies · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization
- [WordPress Redy theme <= 1.3.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112855.md)
  `CVE-2026-112855` · CVE record: axiomthemes Redy · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization
- [net/mlx5e: Prevent stale XSK buffer release on refill retry](https://agentprime.io/advisories/CVE-2026-99079.md)
  `CVE-2026-99079` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026
- [net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry](https://agentprime.io/advisories/CVE-2026-99078.md)
  `CVE-2026-99078` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026
- [btrfs: fix xattr replace when multiple xattrs are packed in the same item](https://agentprime.io/advisories/CVE-2026-98959.md)
  `CVE-2026-98959` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026
- [AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server](https://agentprime.io/advisories/CVE-2026-115727.md)
  `CVE-2026-115727` · CVE record: Fosowl AgenticSeek · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-489
- [WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers](https://agentprime.io/advisories/GHSA-6vww-5m28-f26v.md)
  `GHSA-6vww-5m28-f26v`, `CVE-2026-107685`, `EEF-CVE-2026-107685` · Hex `req_llm`: affected `>=1.9.0, <1.29.0`, fixed in `1.29.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Weak cryptography or TLS
- [bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop](https://agentprime.io/advisories/CVE-2026-25784.md)
  `CVE-2026-25784` · CVE record: Hallo Welt! GmbH BlueSpice · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Privilege escalation, CWE-1188
- [Local Privilege Escalation in CGM CLININET](https://agentprime.io/advisories/CVE-2025-30054.md)
  `CVE-2025-30054` · CVE record: CGM CGM CLININET · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Remote Code Execution in CGM CLININET](https://agentprime.io/advisories/CVE-2025-30050.md)
  `CVE-2025-30050` · CVE record: CGM CGM CLININET · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Code injection
- [Remote Code Execution via Java Deserialization in CGM CLININET](https://agentprime.io/advisories/CVE-2025-30047.md)
  `CVE-2025-30047` · CVE record: CGM CGM CLININET · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization
- [Remote Code Execution in CGM CLININET](https://agentprime.io/advisories/CVE-2025-30046.md)
  `CVE-2025-30046` · CVE record: CGM CGM CLININET · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Privilege escalation
- [WordPress Participants Database plugin <= 2.7.8.5 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112860.md)
  `CVE-2026-112860` · CVE record: xnau webdesign Participants Database · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: SQL injection
- [WordPress Participants Database plugin <= 2.7.8.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112862.md)
  `CVE-2026-112862` · CVE record: xnau webdesign Participants Database · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Insecure deserialization
- [Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-63244.md)
  `CVE-2026-63244` · CVE record: WizLearn Technologies Pte. Ltd. Learning Management System · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass
- [Firmware verification vulnerability](https://agentprime.io/advisories/CVE-2026-55981.md)
  `CVE-2026-55981` · CVE record: Creative Labs Creative Sound Blaster Katana V2, V2X, SE · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-494
- [Advanced Custom Fields: Extended < 0.9.2.8 - Unauthenticated RCE via Front-End Post Update Action](https://agentprime.io/advisories/CVE-2026-94267.md)
  `CVE-2026-94267` · CVE record: Unknown Advanced Custom Fields: Extended and 1 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Code injection
- [Part-DB: Authenticated RCE via .phar attachment upload served from public/media](https://agentprime.io/advisories/CVE-2026-54630.md)
  `CVE-2026-54630` · CVE record: Part-DB Part-DB-server · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Unrestricted file upload
- [Command Execution via Admin Console Input in Okta Access Gateway](https://agentprime.io/advisories/CVE-2026-115547.md)
  `CVE-2026-115547` · CVE record: Okta Okta Access Gateway · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Code injection, CWE-20
- [Authentication Bypass Leading to Server-Side Command Execution](https://agentprime.io/advisories/CVE-2026-19677.md)
  `CVE-2026-19677` · CVE record: onPhase onPhase Forms · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass
- [Kiloview E3 NDI Encoder OS Command Injection](https://agentprime.io/advisories/CVE-2026-110243.md)
  `CVE-2026-110243` · CVE record: Kiloview E3 Firmware · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Command injection
- [Kiloview E3 NDI Encoder OS Command Injection](https://agentprime.io/advisories/CVE-2026-107861.md)
  `CVE-2026-107861` · CVE record: Kiloview E3 Firmware · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Command injection
- [Kiloview E3 NDI Encoder OS Command Injection](https://agentprime.io/advisories/CVE-2026-109122.md)
  `CVE-2026-109122` · CVE record: Kiloview E3 Firmware · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Command injection
- [VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-110063.md)
  `CVE-2026-110063` · CVE record: Microsoft VM Inspector for Azure Virtual Machines · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-83938.md)
  `CVE-2026-83938` · CVE record: Microsoft Azure Kubernetes Configuration Service · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [AAD App Proxy Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-97785.md)
  `CVE-2026-97785` · CVE record: Microsoft Microsoft Entra application proxy · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Azure Pipelines Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-105014.md)
  `CVE-2026-105014` · CVE record: Microsoft Azure Pipelines · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Command injection
- [InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information](https://agentprime.io/advisories/CVE-2026-111594.md)
  `CVE-2026-111594` · CVE record: InterSystems IRIS for Health · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Weak cryptography or TLS
- [Security Advisory 0199](https://agentprime.io/advisories/CVE-2026-114625.md)
  `CVE-2026-114625` · CVE record: Arista Networks VeloCloud Orchestrator · CVSS 9.4 Critical · Critical (KEV, CVSS 9+) · In CISA KEV · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection
- [Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream](https://agentprime.io/advisories/CVE-2026-115377.md)
  `CVE-2026-115377` · CVE record: lxc incus · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 Path Traversal via Instance Backup Dependent Volumes](https://agentprime.io/advisories/CVE-2026-115375.md)
  `CVE-2026-115375` · CVE record: lxc incus · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options](https://agentprime.io/advisories/CVE-2026-115372.md)
  `CVE-2026-115372` · CVE record: lxc incus · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Command injection
- [Mistune before 3.3.0 Path Traversal via include Directive](https://agentprime.io/advisories/CVE-2026-115353.md)
  `CVE-2026-115353` · CVE record: lepture mistune · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [Unauthenticated Adjacent Sensitive Information Disclosure in AOS-10 Wi-Fi Frame Processing](https://agentprime.io/advisories/CVE-2026-79876.md)
  `CVE-2026-79876` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure
- [Authentication Bypass in the PAPI Protocol of AOS-8 Allows Unauthorized Administrative Access](https://agentprime.io/advisories/CVE-2026-79875.md)
  `CVE-2026-79875` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass in the API allows Administrative Access of AOS-10](https://agentprime.io/advisories/CVE-2026-79874.md)
  `CVE-2026-79874` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Unauthenticated Adjacent Authentication Bypasses in the PAPI Protocol of AOS-10 Leads to Unauthorized Administrative Access](https://agentprime.io/advisories/CVE-2026-79873.md)
  `CVE-2026-79873` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Unauthenticated Buffer Overflow Vulnerability allows Remote Code Execution in AOS-10 and AOS-8](https://agentprime.io/advisories/CVE-2026-79872.md)
  `CVE-2026-79872` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Memory corruption

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTEwLTIyVDE5OjA1OjM1LjM1MDAwMFoiLCJDVkUtMjAyNi03OTg3MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTEwLTI0VDA4OjAwOjEwLjk2MzAwMFoiLCJDVkUtMjAyNi0xMTE0MDIiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTEwLTI0VDA4OjAwOjEwLjk2MzAwMFoiLCJDVkUtMjAyNi0xMTE0MDIiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.