# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Adobe Connect | Improper Control of Generation of Code ('Code Injection') (CWE-94)](https://agentprime.io/advisories/CVE-2026-48360.md)
  `CVE-2026-48360` · CVE record: Adobe Adobe Connect Desktop App and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Code injection
- [eMudhra Compromised Certificate vulnerability impacts HCL Domino Server](https://agentprime.io/advisories/CVE-2026-108014.md)
  `CVE-2026-108014` · CVE record: HCLSoftware Domino Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Weak cryptography or TLS
- [A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.](https://agentprime.io/advisories/CVE-2026-108142.md)
  `CVE-2026-108142` · CVE record: Veeam Backup and Replication · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-636
- [SQL injection in Veeam Backup for Microsoft 365](https://agentprime.io/advisories/CVE-2026-106076.md)
  `CVE-2026-106076` · CVE record: Veeam Backup for Microsoft 365 · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: SQL injection
- [WordPress Newsletters plugin <= 4.18.2 - Cross Site Request Forgery (CSRF) vulnerability](https://agentprime.io/advisories/CVE-2026-116863.md)
  `CVE-2026-116863` · CVE record: Tribulant Software Newsletters · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution](https://agentprime.io/advisories/CVE-2026-112709.md)
  `CVE-2026-112709` · CVE record: WatchGuard Fireware OS · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution](https://agentprime.io/advisories/CVE-2026-103593.md)
  `CVE-2026-103593` · CVE record: WatchGuard Fireware OS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Fireware OS Heap Buffer Overflow in AD Authentication Service Allows Pre-Authentication Remote Code Execution](https://agentprime.io/advisories/CVE-2026-112710.md)
  `CVE-2026-112710` · CVE record: WatchGuard Fireware OS · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution](https://agentprime.io/advisories/CVE-2026-93857.md)
  `CVE-2026-93857` · CVE record: WatchGuard Fireware OS · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Fireware OS Pre-Authentication Integer Overflow in Access Portal Allows Out-of-Bounds Write](https://agentprime.io/advisories/CVE-2026-93866.md)
  `CVE-2026-93866` · CVE record: WatchGuard Fireware OS · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption, Authentication bypass
- [Fireware OS Stack Buffer Overflow in WireGuard Configuration Allows Remote Code Execution](https://agentprime.io/advisories/CVE-2026-103594.md)
  `CVE-2026-103594` · CVE record: WatchGuard Fireware OS · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption, CWE-1284
- [Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection](https://agentprime.io/advisories/CVE-2026-93865.md)
  `CVE-2026-93865` · CVE record: WatchGuard Fireware OS · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Command injection, Authentication bypass, Broken access control
- [vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution](https://agentprime.io/advisories/GHSA-h3rc-6mm3-gc2m.md)
  `GHSA-h3rc-6mm3-gc2m`, `CVE-2026-114053` · PyPI `vllm`: affected `>=0.7.3, <0.31.0`, fixed in `0.31.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Code injection, CWE-829
- [better-auth: OAuth Proxy lets an attacker sign in as another user](https://agentprime.io/advisories/GHSA-r4xp-prcw-77qf.md)
  `GHSA-r4xp-prcw-77qf`, `CVE-2026-110864` · npm `better-auth`: affected `>=1.5.0-beta.12, <1.7.7`, fixed in `1.7.7` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Authentication bypass, CWE-345
- [better-auth: OAuth state can be used as a Magic Link to sign in as another user](https://agentprime.io/advisories/GHSA-965c-763c-88jm.md)
  `GHSA-965c-763c-88jm`, `CVE-2026-110862`, `CVE-2026-114607` · npm `better-auth`: affected `>=1.4.0-beta.18, <1.7.7`, fixed in `1.7.7` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Authentication bypass
- [GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution](https://agentprime.io/advisories/GHSA-f9j4-qggq-h239.md)
  `GHSA-f9j4-qggq-h239`, `CVE-2026-110858` · PyPI `gitpython`: affected `>=3.1.30, <3.2.0`, fixed in `3.2.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Command injection
- [LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key](https://agentprime.io/advisories/GHSA-7hp6-4w63-5g45.md)
  `GHSA-7hp6-4w63-5g45`, `CVE-2026-114612` · PyPI `litellm`: affected `>=1.91.0, <1.100.4 || >=1.101.0, <1.101.3 || >=1.102.0, <1.102.2 || >=1.103.0, <1.103.1 || >=1.104.0rc1, <1.104.0rc2`, fixed in `1.100.4`, `1.101.3`, `1.102.2`, `1.103.1`, `1.104.0rc2` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Privilege escalation, CWE-345, CWE-441
- [Authlib: empty signatures validation in JWS JSON deserialization](https://agentprime.io/advisories/GHSA-6v38-4h7w-rj9h.md)
  `GHSA-6v38-4h7w-rj9h`, `CVE-2026-96760` · PyPI `authlib`: affected `<1.9.0`, fixed in `1.9.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Weak cryptography or TLS, CWE-20, CWE-358, CWE-670
- [Frame poisoning in the Layout component](https://agentprime.io/advisories/CVE-2026-118027.md)
  `CVE-2026-118027` · CVE record: Mozilla Firefox · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-451
- [Sandbox escape due to use-after-free in the Widget component](https://agentprime.io/advisories/CVE-2026-117997.md)
  `CVE-2026-117997` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component](https://agentprime.io/advisories/CVE-2026-117990.md)
  `CVE-2026-117990` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component](https://agentprime.io/advisories/CVE-2026-117988.md)
  `CVE-2026-117988` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Sandbox escape due to use-after-free in the Graphics component](https://agentprime.io/advisories/CVE-2026-117985.md)
  `CVE-2026-117985` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Invalid pointer in the JavaScript Engine: JIT component](https://agentprime.io/advisories/CVE-2026-117982.md)
  `CVE-2026-117982` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Privilege escalation in the Toolkit component](https://agentprime.io/advisories/CVE-2026-117981.md)
  `CVE-2026-117981` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Privilege escalation
- [Use-after-free in the Graphics component](https://agentprime.io/advisories/CVE-2026-117980.md)
  `CVE-2026-117980` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Sandbox escape due to use-after-free in the Print Preview component](https://agentprime.io/advisories/CVE-2026-117971.md)
  `CVE-2026-117971` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component](https://agentprime.io/advisories/CVE-2026-117962.md)
  `CVE-2026-117962` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the JavaScript Engine component](https://agentprime.io/advisories/CVE-2026-117946.md)
  `CVE-2026-117946` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the XML component](https://agentprime.io/advisories/CVE-2026-117945.md)
  `CVE-2026-117945` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: HTML Parser component](https://agentprime.io/advisories/CVE-2026-117920.md)
  `CVE-2026-117920` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Invalid pointer in the Graphics: WebRender component](https://agentprime.io/advisories/CVE-2026-117917.md)
  `CVE-2026-117917` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Sandbox escape in the DOM: Networking component](https://agentprime.io/advisories/CVE-2026-117868.md)
  `CVE-2026-117868` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-693
- [Privilege escalation due to incorrect boundary conditions in the Networking component](https://agentprime.io/advisories/CVE-2026-117862.md)
  `CVE-2026-117862` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Sandbox escape in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-117861.md)
  `CVE-2026-117861` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-693
- [MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)](https://agentprime.io/advisories/GHSA-6hp3-vr39-rqw8.md)
  `GHSA-6hp3-vr39-rqw8`, `CVE-2026-48705` · PyPI `monai`: affected `<1.6.1`, fixed in `1.6.1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-20, CWE-682
- [dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS](https://agentprime.io/advisories/GHSA-px68-xx5g-48q5.md)
  `GHSA-px68-xx5g-48q5`, `CVE-2026-46350` · npm `dcmjs`: affected `<0.52.0`, fixed in `0.52.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-20, CWE-1284
- [Electrum before 4.7.2 Nostr Wallet Connect Plugin Daily Spending Limit Bypass](https://agentprime.io/advisories/CVE-2026-117603.md)
  `CVE-2026-117603` · CVE record: spesmilo electrum · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Race condition
- [nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret](https://agentprime.io/advisories/CVE-2026-117564.md)
  `CVE-2026-117564` · CVE record: buqiyuan nest-admin · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Hard-coded credentials
- [Missing authentication in NVIDIA NeMo Agent Toolkit](https://agentprime.io/advisories/CVE-2026-65145.md)
  `CVE-2026-65145` · CVE record: NVIDIA NeMo Agent Toolkit · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Authentication bypass
- [Eclipse ioFog Operator disables TLS certificate verification when sending Controller and OIDC credentials](https://agentprime.io/advisories/CVE-2026-115216.md)
  `CVE-2026-115216` · CVE record: Eclipse Foundation Eclipse ioFog · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Weak cryptography or TLS
- [@fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets](https://agentprime.io/advisories/CVE-2026-112362.md)
  `CVE-2026-112362` · CVE record: @fastify/express @fastify/express · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-436
- [REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin](https://agentprime.io/advisories/CVE-2026-117532.md)
  `CVE-2026-117532` · CVE record: redaxo core · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass by Spoofing Vulnerability in HiRDB](https://agentprime.io/advisories/CVE-2026-82117.md)
  `CVE-2026-82117` · CVE record: Hitachi HiRDB Server Version 10 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Authentication bypass
- [Missing Authentication for Critical Function Vulnerability in HiRDB](https://agentprime.io/advisories/CVE-2026-82116.md)
  `CVE-2026-82116` · CVE record: Hitachi HiRDB Server Version 10 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Authentication bypass
- [Stack-based Buffer Overflow Vulnerability in HiRDB](https://agentprime.io/advisories/CVE-2026-82118.md)
  `CVE-2026-82118` · CVE record: Hitachi HiRDB Server Version 10 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Heap-based Buffer Overflow Vulnerability in HiRDB](https://agentprime.io/advisories/CVE-2026-82120.md)
  `CVE-2026-82120` · CVE record: Hitachi HiRDB Server Version 10 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [OS Command Injection Vulnerability in HiRDB](https://agentprime.io/advisories/CVE-2026-82119.md)
  `CVE-2026-82119` · CVE record: Hitachi HiRDB Server Version 10 and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Command injection
- [Stack-based Buffer Overflow Vulnerability in HiRDB](https://agentprime.io/advisories/CVE-2026-82122.md)
  `CVE-2026-82122` · CVE record: Hitachi HiRDB Server Version 10 and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3](https://agentprime.io/advisories/CVE-2026-76939.md)
  `CVE-2026-76939` · CVE record: Hitachi JP1/Automatic Job Management System 3 - Manager and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3](https://agentprime.io/advisories/CVE-2026-76936.md)
  `CVE-2026-76936` · CVE record: Hitachi JP1/Automatic Job Management System 3 - Manager · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3](https://agentprime.io/advisories/CVE-2026-76937.md)
  `CVE-2026-76937` · CVE record: Hitachi JP1/Automatic Job Management System 3 - Manager · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3](https://agentprime.io/advisories/CVE-2026-76938.md)
  `CVE-2026-76938` · CVE record: Hitachi JP1/Automatic Job Management System 3 - Manager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Authentication bypass
- [Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3](https://agentprime.io/advisories/CVE-2026-76935.md)
  `CVE-2026-76935` · CVE record: Hitachi JP1/Automatic Job Management System 3 - Manager · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3](https://agentprime.io/advisories/CVE-2026-76934.md)
  `CVE-2026-76934` · CVE record: Hitachi JP1/Automatic Job Management System 3 - Manager and 2 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3](https://agentprime.io/advisories/CVE-2026-76932.md)
  `CVE-2026-76932` · CVE record: Hitachi JP1/Automatic Job Management System 3 - Manager and 2 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3](https://agentprime.io/advisories/CVE-2026-76933.md)
  `CVE-2026-76933` · CVE record: Hitachi JP1/Automatic Job Management System 3 - Manager and 2 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Out-of-bounds Write Vulnerability in JP1 Products](https://agentprime.io/advisories/CVE-2026-86577.md)
  `CVE-2026-86577` · CVE record: Hitachi JP1/Integrated Management 3 - Manager and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Heap-based Buffer Overflow Vulnerability in JP1 Products](https://agentprime.io/advisories/CVE-2026-86576.md)
  `CVE-2026-86576` · CVE record: Hitachi JP1/Integrated Management 3 - Manager and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Stack-based Buffer Overflow Vulnerability in JP1 Products](https://agentprime.io/advisories/CVE-2026-86575.md)
  `CVE-2026-86575` · CVE record: Hitachi JP1/Integrated Management 3 - Manager and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTEwLTI3VDA5OjM3OjEwLjIzOTAwMFoiLCJDVkUtMjAyNi04NjU3NSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTEwLTI3VDE2OjQ4OjM3LjEzODAwMFoiLCJDVkUtMjAyNi0xMTQ1OTUiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTEwLTI3VDE2OjQ4OjM3LjEzODAwMFoiLCJDVkUtMjAyNi0xMTQ1OTUiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.