# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them](https://agentprime.io/advisories/CVE-2026-116135.md)
  `CVE-2026-116135` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-178
- [Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation](https://agentprime.io/advisories/CVE-2026-111496.md)
  `CVE-2026-111496` · CVE record: Apache Software Foundation Apache Kafka · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Memory corruption, Denial of service
- [Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing](https://agentprime.io/advisories/CVE-2026-111115.md)
  `CVE-2026-111115` · CVE record: Apache Software Foundation Apache Kafka · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026
- [Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers](https://agentprime.io/advisories/CVE-2026-111108.md)
  `CVE-2026-111108` · CVE record: Apache Software Foundation Apache Kafka · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Denial of service
- [Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured](https://agentprime.io/advisories/CVE-2026-110985.md)
  `CVE-2026-110985` · CVE record: Apache Software Foundation Apache Kafka · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Weak cryptography or TLS, CWE-345, CWE-636, CWE-1287
- [Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed](https://agentprime.io/advisories/CVE-2026-103409.md)
  `CVE-2026-103409` · CVE record: Juniper Networks Session Smart Router · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.](https://agentprime.io/advisories/CVE-2026-103406.md)
  `CVE-2026-103406` · CVE record: Juniper Networks Session Smart Conductor · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection
- [WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-115968.md)
  `CVE-2026-115968` · CVE record: Ultimate Member Ultimate Member · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Insecure deserialization
- [Path Traversal in Wing WFTP Server leading to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-105420.md)
  `CVE-2026-105420` · CVE record: Wing Soft Technology Wing FTP Server · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Path traversal
- [WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-111411.md)
  `CVE-2026-111411` · CVE record: Aman FunnelKit Automations · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-115607.md)
  `CVE-2026-115607` · CVE record: Crowd Favorite DXP ToolKit · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [Topluyo Desktop for Linux has an OS Command Injection issue](https://agentprime.io/advisories/CVE-2026-115904.md)
  `CVE-2026-115904` · CVE record: topluyo App · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection
- [HCL BigFix AEX is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-67074.md)
  `CVE-2026-67074` · CVE record: HCL Software BigFix AEX · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection, Code injection
- [Unauthenticated Command Injection via kubeconfig Username in che-machine-exec](https://agentprime.io/advisories/CVE-2026-114278.md)
  `CVE-2026-114278` · CVE record: Eclipse Foundation Eclipse Che · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection
- [scsi: libiscsi: Reject a negative task index from parse_pdu_itt](https://agentprime.io/advisories/CVE-2026-99154.md)
  `CVE-2026-99154` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026
- [scsi: libiscsi: Validate the ITT reflected in a Reject PDU](https://agentprime.io/advisories/CVE-2026-99153.md)
  `CVE-2026-99153` · CVE record: Linux Linux · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026
- [SQL injection in Dell PowerProtect Data Domain Management Center](https://agentprime.io/advisories/CVE-2026-103792.md)
  `CVE-2026-103792` · CVE record: Dell PowerProtect Data Domain Management Center · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [Missing authorization in Dell PowerProtect Data Domain Management Center](https://agentprime.io/advisories/CVE-2026-103799.md)
  `CVE-2026-103799` · CVE record: Dell PowerProtect Data Domain Management Center · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Missing Authentication for Critical Function in Tactis' NoviGest Desktop App](https://agentprime.io/advisories/CVE-2026-112197.md)
  `CVE-2026-112197` · CVE record: Tactis NoviGest Desktop App · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [Stack-based buffer overflow in Dell PowerProtect Data Domain](https://agentprime.io/advisories/CVE-2026-103780.md)
  `CVE-2026-103780` · CVE record: Dell PowerProtect Data Domain · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Memory corruption
- [Hard-coded cryptographic key in Dell PowerProtect Data Domain](https://agentprime.io/advisories/CVE-2026-86384.md)
  `CVE-2026-86384` · CVE record: Dell PowerProtect Data Domain · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Hard-coded credentials
- [SQL injection (SQLi) in the user authentication module of Futurum Software](https://agentprime.io/advisories/CVE-2026-14571.md)
  `CVE-2026-14571` · CVE record: Futurum Software Futurum Software User Authentication Module · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: SQL injection
- [Missing authorization in Dell PowerProtect Data Domain](https://agentprime.io/advisories/CVE-2026-86397.md)
  `CVE-2026-86397` · CVE record: Dell PowerProtect Data Domain · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Improper authentication in Dell PowerProtect Data Domain](https://agentprime.io/advisories/CVE-2026-86400.md)
  `CVE-2026-86400` · CVE record: Dell PowerProtect Data Domain · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [Authentication bypass by spoofing in Dell PowerProtect Data Domain Management Center](https://agentprime.io/advisories/CVE-2026-90717.md)
  `CVE-2026-90717` · CVE record: Dell PowerProtect Data Domain Management Center · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass](https://agentprime.io/advisories/CVE-2026-109218.md)
  `CVE-2026-109218` · CVE record: kleor Contact Manager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Unrestricted file upload
- [Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload](https://agentprime.io/advisories/CVE-2026-103688.md)
  `CVE-2026-103688` · CVE record: Unknown Checkout Files Upload for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Unrestricted file upload
- [Code injection in EagleCloud Aquila on-premises version](https://agentprime.io/advisories/CVE-2026-104383.md)
  `CVE-2026-104383` · CVE record: EagleCloud Aquila · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Code injection
- [Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler](https://agentprime.io/advisories/CVE-2026-84999.md)
  `CVE-2026-84999` · CVE record: Pie Register Pie Register Premium · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Unrestricted file upload
- [llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()](https://agentprime.io/advisories/CVE-2026-118375.md)
  `CVE-2026-118375` · CVE record: ggml-org llama.cpp · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Memory corruption
- [Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter](https://agentprime.io/advisories/CVE-2026-106013.md)
  `CVE-2026-106013` · CVE record: artbees Jupiter X Core · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)](https://agentprime.io/advisories/CVE-2026-110879.md)
  `CVE-2026-110879` · CVE record: FasterXML jackson-databind · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Insecure deserialization
- [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-118312.md)
  `CVE-2026-118312` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Information disclosure
- [Google Chrome: Incorrect reference resolution in UI in Google Chrome on on Android prior to…](https://agentprime.io/advisories/CVE-2026-118309.md)
  `CVE-2026-118309` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-706
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-118308.md)
  `CVE-2026-118308` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-118310.md)
  `CVE-2026-118310` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-118342.md)
  `CVE-2026-118342` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-118316.md)
  `CVE-2026-118316` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-118332.md)
  `CVE-2026-118332` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-118355.md)
  `CVE-2026-118355` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-118321.md)
  `CVE-2026-118321` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Integer overflow in Google Chrome](https://agentprime.io/advisories/CVE-2026-118340.md)
  `CVE-2026-118340` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Type confusion in Google Chrome](https://agentprime.io/advisories/CVE-2026-118305.md)
  `CVE-2026-118305` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-118306.md)
  `CVE-2026-118306` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption
- [GRR vulnerable to Remote Code Execution Via PHP Code Injection](https://agentprime.io/advisories/CVE-2026-58256.md)
  `CVE-2026-58256` · CVE record: JeromeDevome GRR · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Code injection
- [MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules](https://agentprime.io/advisories/GHSA-26p8-2jq9-3vq9.md)
  `GHSA-26p8-2jq9-3vq9`, `CVE-2026-116692` · PyPI `mlflow`: affected `>=3.12.0rc0, <3.17.0`, fixed in `3.17.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Code injection
- [Sunhillo SureLine Authentication Bypass via Session Cookie](https://agentprime.io/advisories/CVE-2026-112352.md)
  `CVE-2026-112352` · CVE record: Sunhillo Corporation SureLine · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: CWE-565
- [Calendar discovery accepted local file and remote network share locations](https://agentprime.io/advisories/CVE-2026-118177.md)
  `CVE-2026-118177` · CVE record: Mozilla Thunderbird · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Open redirect
- [CVE-2026-118170](https://agentprime.io/advisories/CVE-2026-118170.md)
  `CVE-2026-118170` · CVE record: Strapi Strapi Open Source and Enterprise Headless CMS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [CVE-2026-118131](https://agentprime.io/advisories/CVE-2026-118131.md)
  `CVE-2026-118131` · CVE record: GnuPG GnuPG · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control, CWE-379, CWE-427
- [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)](https://agentprime.io/advisories/CVE-2026-104353.md)
  `CVE-2026-104353` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Command injection
- [Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-105780.md)
  `CVE-2026-105780` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-105489.md)
  `CVE-2026-105489` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: SQL injection
- [Adobe Campaign Classic (ACC) | Cross-site Scripting (Reflected XSS) (CWE-79)](https://agentprime.io/advisories/CVE-2026-104350.md)
  `CVE-2026-104350` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-105781.md)
  `CVE-2026-105781` · CVE record: Adobe Adobe Campaign Classic · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: SQL injection
- [Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)](https://agentprime.io/advisories/CVE-2026-104351.md)
  `CVE-2026-104351` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Code injection
- [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-104354.md)
  `CVE-2026-104354` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: SQL injection
- [Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)](https://agentprime.io/advisories/CVE-2026-105779.md)
  `CVE-2026-105779` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: SQL injection
- [eMudhra Compromised Certificate vulnerability impacts HCL Notes Client](https://agentprime.io/advisories/CVE-2026-108015.md)
  `CVE-2026-108015` · CVE record: HCLSoftware Notes Client · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Weak cryptography or TLS
- [Integer overflow or wraparound in EPICS Base](https://agentprime.io/advisories/CVE-2026-114595.md)
  `CVE-2026-114595` · CVE record: The EPICS Community EPICS Base · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Memory corruption

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTEwLTI3VDE2OjQ4OjM3LjEzODAwMFoiLCJDVkUtMjAyNi0xMTQ1OTUiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTEwLTI4VDE3OjE2OjQyLjA2NTAwMFoiLCJDVkUtMjAyNi0xMTY1MzEiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTEwLTI4VDE3OjE2OjQyLjA2NTAwMFoiLCJDVkUtMjAyNi0xMTY1MzEiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.