# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Heap-based Buffer Overflow Vulnerability in JP1/Base](https://agentprime.io/advisories/CVE-2026-86574.md)
  `CVE-2026-86574` · CVE record: Hitachi JP1/Base · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2](https://agentprime.io/advisories/CVE-2026-102788.md)
  `CVE-2026-102788` · CVE record: balbooa.com Gridbox extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: SQL injection
- [Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2](https://agentprime.io/advisories/CVE-2026-102789.md)
  `CVE-2026-102789` · CVE record: balbooa.com Gridbox extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login](https://agentprime.io/advisories/CVE-2026-92885.md)
  `CVE-2026-92885` · CVE record: Qode Themes Qode Membership · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Authentication bypass
- [Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability](https://agentprime.io/advisories/CVE-2026-18450.md)
  `CVE-2026-18450` · CVE record: SMCI X12SPI · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Authentication bypass
- [Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution (RCE) via UPnP root descrip…](https://agentprime.io/advisories/CVE-2026-78845.md)
  `CVE-2026-78845` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Code injection
- [Kener 3.0.0 before 4.1.10 Authentication Bypass via Hardcoded Fallback JWT Secret](https://agentprime.io/advisories/CVE-2026-116747.md)
  `CVE-2026-116747` · CVE record: rajnandan1 kener · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Hard-coded credentials
- [TOTOLINK A950RG Device-Information CGI infostat.cgi sub_402340 stack-based overflow](https://agentprime.io/advisories/CVE-2026-116508.md)
  `CVE-2026-116508` · CVE record: TOTOLINK A950RG · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Memory corruption
- [TOTOLINK A950RG firewall.so apmib_set command injection](https://agentprime.io/advisories/CVE-2026-116506.md)
  `CVE-2026-116506` · CVE record: TOTOLINK A950RG · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection, Command injection
- [TOTOLINK A950RG device-information udhcpd.leases getDeviceInfo command injection](https://agentprime.io/advisories/CVE-2026-116505.md)
  `CVE-2026-116505` · CVE record: TOTOLINK A950RG · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection, Command injection
- [Out-of-bounds write in Apple macOS](https://agentprime.io/advisories/CVE-2026-112552.md)
  `CVE-2026-112552` · CVE record: Apple macOS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Memory corruption
- [Out-of-bounds write in Apple macOS](https://agentprime.io/advisories/CVE-2026-84539.md)
  `CVE-2026-84539` · CVE record: Apple macOS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Memory corruption
- [Use after free in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112514.md)
  `CVE-2026-112514` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Memory corruption
- [Buffer overflow in Apple macOS](https://agentprime.io/advisories/CVE-2026-112521.md)
  `CVE-2026-112521` · CVE record: Apple macOS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Memory corruption
- [Path traversal in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112690.md)
  `CVE-2026-112690` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Path traversal in Apple macOS](https://agentprime.io/advisories/CVE-2026-84633.md)
  `CVE-2026-84633` · CVE record: Apple macOS · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Out-of-bounds read in Apple macOS](https://agentprime.io/advisories/CVE-2026-112478.md)
  `CVE-2026-112478` · CVE record: Apple macOS · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Memory corruption
- [Improper access control in Apple macOS](https://agentprime.io/advisories/CVE-2026-112497.md)
  `CVE-2026-112497` · CVE record: Apple macOS · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Buffer overflow in Apple macOS](https://agentprime.io/advisories/CVE-2026-112526.md)
  `CVE-2026-112526` · CVE record: Apple macOS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Memory corruption
- [Buffer overflow in Apple macOS](https://agentprime.io/advisories/CVE-2026-112443.md)
  `CVE-2026-112443` · CVE record: Apple macOS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Memory corruption
- [Protection mechanism failure in Apple Safari and others](https://agentprime.io/advisories/CVE-2026-113897.md)
  `CVE-2026-113897` · CVE record: Apple Safari and 3 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-693
- [TOTOLINK A950RG Cloud Upgrade upgrade.so setCloudUpgradeFW command injection](https://agentprime.io/advisories/CVE-2026-116504.md)
  `CVE-2026-116504` · CVE record: TOTOLINK A950RG · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection, Command injection
- [Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules](https://agentprime.io/advisories/CVE-2026-110720.md)
  `CVE-2026-110720` · CVE record: HashiCorp Tooling · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [BUG-000187511 - ArcGIS Server has a security vulnerability.](https://agentprime.io/advisories/CVE-2026-10757.md)
  `CVE-2026-10757` · CVE record: Esri ArcGIS Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: SQL injection
- [Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset](https://agentprime.io/advisories/CVE-2026-102649.md)
  `CVE-2026-102649` · CVE record: padok-team burrito · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Authentication bypass, Broken access control
- [OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE](https://agentprime.io/advisories/CVE-2026-112346.md)
  `CVE-2026-112346` · CVE record: OpenHands OpenHands Software Agent SDK · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-1327
- [Improper Privilege Assignment in boneIO](https://agentprime.io/advisories/CVE-2026-77055.md)
  `CVE-2026-77055` · CVE record: boneIO black_debian_images · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Privilege escalation
- [Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write](https://agentprime.io/advisories/CVE-2026-93328.md)
  `CVE-2026-93328` · CVE record: Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal, Broken access control
- [Avocent ACS8000 wsserver command injection](https://agentprime.io/advisories/CVE-2026-65184.md)
  `CVE-2026-65184` · CVE record: Vertiv Avocent ACS8000 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Command injection
- [Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney](https://agentprime.io/advisories/EEF-CVE-2026-115693.md)
  `EEF-CVE-2026-115693`, `CVE-2026-115693` · Hex `hackney`: affected `>=1.24.0, <4.9.0`, fixed in `4.9.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Weak cryptography or TLS
- [Authentication bypass in Fortinet FortiSandbox and others](https://agentprime.io/advisories/CVE-2026-107656.md)
  `CVE-2026-107656` · CVE record: Fortinet FortiSandbox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Authentication bypass
- [Shared SSH Authentication Key in vSolution Matrix File Sharing](https://agentprime.io/advisories/CVE-2026-59107.md)
  `CVE-2026-59107` · CVE record: WolfVision Cynap Pro, Cynap Core Pro and 1 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-797
- [Unauthenticated RCE Vulnerability in WolfProt interface implementation](https://agentprime.io/advisories/CVE-2026-59106.md)
  `CVE-2026-59106` · CVE record: WolfVision Cynap Pure (Next Gen), Cynap Bridge and 3 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Command injection
- [danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints](https://agentprime.io/advisories/CVE-2026-116485.md)
  `CVE-2026-116485` · CVE record: huangxd- danmu_api · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Authentication bypass
- [MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code](https://agentprime.io/advisories/CVE-2026-116214.md)
  `CVE-2026-116214` · CVE record: maccmspro maccms10 and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-640
- [An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7.](https://agentprime.io/advisories/CVE-2026-115188.md)
  `CVE-2026-115188` · CVE record · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Code injection, Unrestricted file upload
- [Improper Authentication Vulnerability in CreditNirvana Collections Platform](https://agentprime.io/advisories/CVE-2026-110475.md)
  `CVE-2026-110475` · CVE record: CreditNirvana CreditNirvana Collections Platform (CollectionWorkz) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Authentication bypass
- [Oray Pugongying X5 Pro Dnsmasq crlf injection](https://agentprime.io/advisories/CVE-2026-116237.md)
  `CVE-2026-116237` · CVE record: Oray Pugongying X5 Pro · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection
- [Oray Pugongying X5 Pro L2TP Authentication crlf injection](https://agentprime.io/advisories/CVE-2026-116235.md)
  `CVE-2026-116235` · CVE record: Oray Pugongying X5 Pro · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection
- [Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection](https://agentprime.io/advisories/CVE-2026-116234.md)
  `CVE-2026-116234` · CVE record: Oray Pugongying X5 Pro · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection
- [Oray Pugongying X5 Pro Dnsmasq crlf injection](https://agentprime.io/advisories/CVE-2026-116233.md)
  `CVE-2026-116233` · CVE record: Oray Pugongying X5 Pro · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection
- [Oray Pugongying X5 Pro SNMP snmp_set crlf injection](https://agentprime.io/advisories/CVE-2026-116232.md)
  `CVE-2026-116232` · CVE record: Oray Pugongying X5 Pro · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection
- [Oray Pugongying X5 Pro Ser2net crlf injection](https://agentprime.io/advisories/CVE-2026-116231.md)
  `CVE-2026-116231` · CVE record: Oray Pugongying X5 Pro · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Other injection
- [Yoosee GM8135S Camera Secure Boot signature verification](https://agentprime.io/advisories/CVE-2026-116116.md)
  `CVE-2026-116116` · CVE record: Yoosee GM8135S Camera · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Weak cryptography or TLS, CWE-345
- [SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbitrary code via the Login Page](https://agentprime.io/advisories/CVE-2026-31158.md)
  `CVE-2026-31158` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: SQL injection
- [NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.](https://agentprime.io/advisories/CVE-2026-107092.md)
  `CVE-2026-107092` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal
- [Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections](https://agentprime.io/advisories/CVE-2026-115823.md)
  `CVE-2026-115823` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2026 · Tags: HTTP request smuggling
- [Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback](https://agentprime.io/advisories/CVE-2026-116199.md)
  `CVE-2026-116199` · CVE record: grokability snipe-it · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [Parse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses](https://agentprime.io/advisories/CVE-2026-116163.md)
  `CVE-2026-116163` · CVE record: parse-community parse-server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2026 · Tags: Authentication bypass
- [Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers](https://agentprime.io/advisories/CVE-2026-115214.md)
  `CVE-2026-115214` · CVE record: Unknown Datawiza Proxy Auth Plugin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2026 · Tags: Privilege escalation
- [Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection](https://agentprime.io/advisories/CVE-2026-115995.md)
  `CVE-2026-115995` · CVE record: Unitree Robotics Unitree Go2 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: Command injection
- [Broken or risky cryptographic algorithm in Oracle Corporation Oracle Java SE and others](https://agentprime.io/advisories/CVE-2026-114820.md)
  `CVE-2026-114820` · CVE record: Oracle Corporation Oracle Java SE and 2 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: Weak cryptography or TLS
- [Forged signed tokens let any registered user take over other users and organizations](https://agentprime.io/advisories/CVE-2026-115933.md)
  `CVE-2026-115933` · CVE record: GitroomHQ postiz-app · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: Authentication bypass, Broken access control, CWE-345
- [Distrust compromised intermediate certificates in ssl module](https://agentprime.io/advisories/CVE-2026-115557.md)
  `CVE-2026-115557` · CVE record: Python Software Foundation CPython · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: CWE-299
- [Path traversal in post media lets any registered user read server files](https://agentprime.io/advisories/CVE-2026-115932.md)
  `CVE-2026-115932` · CVE record: GitroomHQ postiz-app · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: Path traversal, Other injection
- [open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType](https://agentprime.io/advisories/CVE-2026-116014.md)
  `CVE-2026-116014` · CVE record: open62541 open62541 · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: Memory corruption
- [WordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-114196.md)
  `CVE-2026-114196` · CVE record: paytiumsupport Paytium · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: Insecure deserialization
- [WordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112866.md)
  `CVE-2026-112866` · CVE record: WPFactory Product Filter by WBW · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: SQL injection
- [WordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-94075.md)
  `CVE-2026-94075` · CVE record: Tribulant Software Newsletters · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: Insecure deserialization
- [WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-111402.md)
  `CVE-2026-111402` · CVE record: Tribulant Software Newsletters · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: SQL injection

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTEwLTI0VDA4OjAwOjEwLjk2MzAwMFoiLCJDVkUtMjAyNi0xMTE0MDIiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTEwLTI3VDA5OjM3OjEwLjIzOTAwMFoiLCJDVkUtMjAyNi04NjU3NSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTEwLTI3VDA5OjM3OjEwLjIzOTAwMFoiLCJDVkUtMjAyNi04NjU3NSJd>. Everything for agents: <https://agentprime.io/llms.txt>.