# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54860.md)
  `CVE-2026-54860` · CVE record: ThemeREX Ozisti · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54859.md)
  `CVE-2026-54859` · CVE record: ThemeREX Preservation · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54858.md)
  `CVE-2026-54858` · CVE record: ThemeREX Printy · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54857.md)
  `CVE-2026-54857` · CVE record: ThemeREX Quirky · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-54856.md)
  `CVE-2026-54856` · CVE record: ThemeREX RexCoin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-93680.md)
  `CVE-2026-93680` · CVE record: IBM Langflow OSS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-104339.md)
  `CVE-2026-104339` · CVE record: IBM Langflow OSS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Code injection
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-107327.md)
  `CVE-2026-107327` · CVE record: IBM Langflow OSS · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-107328.md)
  `CVE-2026-107328` · CVE record: IBM Langflow OSS · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Code injection
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-107329.md)
  `CVE-2026-107329` · CVE record: IBM Langflow OSS · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Code injection
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-110186.md)
  `CVE-2026-110186` · CVE record: IBM Langflow OSS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Code injection
- [Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection](https://agentprime.io/advisories/CVE-2026-119050.md)
  `CVE-2026-119050` · CVE record: agno-agi agno · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Code injection
- [OS command injection in Yamaha Corporation NWR100](https://agentprime.io/advisories/CVE-2026-97854.md)
  `CVE-2026-97854` · CVE record: Yamaha Corporation NWR100 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Command injection
- [WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-115964.md)
  `CVE-2026-115964` · CVE record: StylemixThemes Motors · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: SQL injection
- [Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames](https://agentprime.io/advisories/CVE-2026-114230.md)
  `CVE-2026-114230` · CVE record: Apache Software Foundation Apache Qpid Proton C · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-305
- [Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash](https://agentprime.io/advisories/CVE-2026-105042.md)
  `CVE-2026-105042` · CVE record: Apache Software Foundation Apache Qpid Proton C · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service
- [Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.](https://agentprime.io/advisories/CVE-2026-105031.md)
  `CVE-2026-105031` · CVE record: Apache Software Foundation Apache Qpid Proton C · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Weak cryptography or TLS
- [SQL Injection Vulnerability in Radius Xenia M2M Platform](https://agentprime.io/advisories/CVE-2026-114358.md)
  `CVE-2026-114358` · CVE record: Radius Synergies Radius Xenia M2M Platform · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: SQL injection
- [Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload](https://agentprime.io/advisories/CVE-2026-115245.md)
  `CVE-2026-115245` · CVE record: Unknown Chat AI with Dispatcher · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Unrestricted file upload
- [Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal](https://agentprime.io/advisories/CVE-2026-113617.md)
  `CVE-2026-113617` · CVE record: Unknown Automated Import Products to Cart · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset](https://agentprime.io/advisories/CVE-2026-113616.md)
  `CVE-2026-113616` · CVE record: Unknown LogixFast Auth · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Privilege escalation
- [Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection](https://agentprime.io/advisories/CVE-2026-103693.md)
  `CVE-2026-103693` · CVE record: Unknown Frontend Dashboard and 1 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token](https://agentprime.io/advisories/CVE-2026-109516.md)
  `CVE-2026-109516` · CVE record: guruteam Bot for Telegram on WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass
- [Improper authorization in Frangoteam](https://agentprime.io/advisories/CVE-2026-42922.md)
  `CVE-2026-42922` · CVE record: frangoteam Frangoteam · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Unrestricted Command Execution via system.execute](https://agentprime.io/advisories/CVE-2026-66088.md)
  `CVE-2026-66088` · CVE record: Apereo Foundation openEQUELLA · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Command injection, CWE-749
- [The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell.](https://agentprime.io/advisories/CVE-2026-79589.md)
  `CVE-2026-79589` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass
- [OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-upload_file-the-preserved-live-upload-file-witness-directly-reaches (ToolServer/ToolServerNode/main.py:46).](https://agentprime.io/advisories/CVE-2026-51912.md)
  `CVE-2026-51912` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:129).](https://agentprime.io/advisories/CVE-2026-51863.md)
  `CVE-2026-51863` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.](https://agentprime.io/advisories/CVE-2026-107060.md)
  `CVE-2026-107060` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state.](https://agentprime.io/advisories/CVE-2026-107058.md)
  `CVE-2026-107058` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass
- [An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.](https://agentprime.io/advisories/CVE-2026-107057.md)
  `CVE-2026-107057` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database…](https://agentprime.io/advisories/CVE-2026-107056.md)
  `CVE-2026-107056` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox.](https://agentprime.io/advisories/CVE-2026-107053.md)
  `CVE-2026-107053` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution.](https://agentprime.io/advisories/CVE-2026-107050.md)
  `CVE-2026-107050` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Code injection
- [An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request.](https://agentprime.io/advisories/CVE-2026-107048.md)
  `CVE-2026-107048` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's Nostr event database.](https://agentprime.io/advisories/CVE-2026-107045.md)
  `CVE-2026-107045` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism.](https://agentprime.io/advisories/CVE-2026-107043.md)
  `CVE-2026-107043` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.](https://agentprime.io/advisories/CVE-2026-107040.md)
  `CVE-2026-107040` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data.](https://agentprime.io/advisories/CVE-2026-107038.md)
  `CVE-2026-107038` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data.](https://agentprime.io/advisories/CVE-2026-107034.md)
  `CVE-2026-107034` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.](https://agentprime.io/advisories/CVE-2026-107032.md)
  `CVE-2026-107032` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.](https://agentprime.io/advisories/CVE-2026-107029.md)
  `CVE-2026-107029` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leading to manipulation of the shopping-list data.](https://agentprime.io/advisories/CVE-2026-107028.md)
  `CVE-2026-107028` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.](https://agentprime.io/advisories/CVE-2026-107027.md)
  `CVE-2026-107027` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire m…](https://agentprime.io/advisories/CVE-2026-107021.md)
  `CVE-2026-107021` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated actions.](https://agentprime.io/advisories/CVE-2026-107017.md)
  `CVE-2026-107017` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database.](https://agentprime.io/advisories/CVE-2026-107015.md)
  `CVE-2026-107015` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user's' note database.](https://agentprime.io/advisories/CVE-2026-107014.md)
  `CVE-2026-107014` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-926
- [D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor](https://agentprime.io/advisories/CVE-2026-118579.md)
  `CVE-2026-118579` · CVE record: D-Link DIR-505 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-912
- [AVideo-Encoder: unauthenticated command execution through streamer login trust](https://agentprime.io/advisories/CVE-2026-61567.md)
  `CVE-2026-61567` · CVE record: WWBN AVideo-Encoder · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection
- [AVideo-Encoder: unauthenticated installer PHP code injection](https://agentprime.io/advisories/CVE-2026-61564.md)
  `CVE-2026-61564` · CVE record: WWBN AVideo-Encoder · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Code injection
- [Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it](https://agentprime.io/advisories/GHSA-6jp4-8v48-cc5v.md)
  `GHSA-6jp4-8v48-cc5v`, `CVE-2026-117601` · PyPI `electrum`: affected `<4.8.3`, fixed in `4.8.3` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Weak cryptography or TLS
- [Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm \`br_table\` instruction](https://agentprime.io/advisories/GHSA-mghf-wjfp-p5xm.md)
  `GHSA-mghf-wjfp-p5xm`, `CVE-2026-115893`, `RUSTSEC-2026-0379` · crates.io `wasmtime`: affected `<36.0.19 || >=37.0.0, <48.0.7 || >=49.0.0, <49.0.4`, fixed in `36.0.19`, `48.0.7`, `49.0.4` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-691
- [Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs](https://agentprime.io/advisories/CVE-2026-118690.md)
  `CVE-2026-118690` · CVE record: SignalK signalk-server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass
- [zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE](https://agentprime.io/advisories/GHSA-m665-v7pm-7grj.md)
  `GHSA-m665-v7pm-7grj`, `CVE-2026-115905` · crates.io `zip`: affected `<9.0.5`, fixed in `9.0.5` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-20, CWE-436
- [Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability](https://agentprime.io/advisories/CVE-2026-76418.md)
  `CVE-2026-76418` · CVE record: Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and 1 more · CVSS 8.6 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-690
- [Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization](https://agentprime.io/advisories/CVE-2026-117574.md)
  `CVE-2026-117574` · CVE record: Red Hat Red Hat OpenShift AI (RHOAI) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS](https://agentprime.io/advisories/CVE-2026-63190.md)
  `CVE-2026-63190` · CVE record: fearlessgeekmedia FearlessCMS · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Path traversal, Cross-site scripting (XSS), Information disclosure, Authentication bypass
- [Path traversal in Sophos SG UTM](https://agentprime.io/advisories/CVE-2026-118633.md)
  `CVE-2026-118633` · CVE record: Sophos SG UTM · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Path traversal
- [HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk](https://agentprime.io/advisories/CVE-2026-116531.md)
  `CVE-2026-116531` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-130

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTEwLTI4VDE3OjE2OjQyLjA2NTAwMFoiLCJDVkUtMjAyNi0xMTY1MzEiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTEwLTI5VDE1OjI0OjA4LjY3NzAwMFoiLCJDVkUtMjAyNi02MTk5MSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTEwLTI5VDE1OjI0OjA4LjY3NzAwMFoiLCJDVkUtMjAyNi02MTk5MSJd>. Everything for agents: <https://agentprime.io/llms.txt>.