# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId](https://agentprime.io/advisories/CVE-2026-105772.md)
  `CVE-2026-105772` · CVE record: Google ADK TypeScript (@google/adk) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [aaPanel File Manager common.py ExecShell os command injection](https://agentprime.io/advisories/CVE-2026-113506.md)
  `CVE-2026-113506` · CVE record: aaPanel · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Command injection
- [SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing](https://agentprime.io/advisories/CVE-2026-113703.md)
  `CVE-2026-113703` · CVE record: giuseppe99barchetta SuggestArr · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass via Empty LDAP Password](https://agentprime.io/advisories/CVE-2026-113682.md)
  `CVE-2026-113682` · CVE record: networknt light-4j · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron](https://agentprime.io/advisories/CVE-2026-113678.md)
  `CVE-2026-113678` · CVE record: froxlor froxlor · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin](https://agentprime.io/advisories/CVE-2026-113613.md)
  `CVE-2026-113613` · CVE record: FlexGet FlexGet · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [Apache CouchDB: Admin credentials leading to code execution as operating system user](https://agentprime.io/advisories/CVE-2026-86471.md)
  `CVE-2026-86471` · CVE record: Apache Software Foundation Apache CouchDB · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Command injection
- [Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509](https://agentprime.io/advisories/CVE-2026-93475.md)
  `CVE-2026-93475` · CVE record: Eclipse Foundation Eclipse ThreadX - NetX Duo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption, CWE-1284
- [Apache Tomcat: AJP response mix-up](https://agentprime.io/advisories/CVE-2026-103119.md)
  `CVE-2026-103119` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-127
- [Apache Tomcat: HTTP/2 request/response mix-up after error during async processing](https://agentprime.io/advisories/CVE-2026-101356.md)
  `CVE-2026-101356` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Race condition
- [Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms](https://agentprime.io/advisories/CVE-2026-101296.md)
  `CVE-2026-101296` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Incorrect boundary conditions in the SVG component](https://agentprime.io/advisories/CVE-2026-113399.md)
  `CVE-2026-113399` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection](https://agentprime.io/advisories/CVE-2026-113391.md)
  `CVE-2026-113391` · CVE record: DrayTek Vigor2960 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Other injection, Command injection
- [Eclipse ioFog operator WebSocket accepts an unverified JWT](https://agentprime.io/advisories/CVE-2026-113620.md)
  `CVE-2026-113620` · CVE record: Eclipse Foundation Eclipse ioFog · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS
- [DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection](https://agentprime.io/advisories/CVE-2026-113390.md)
  `CVE-2026-113390` · CVE record: DrayTek Vigor2960 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Command injection
- [DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection](https://agentprime.io/advisories/CVE-2026-113389.md)
  `CVE-2026-113389` · CVE record: DrayTek Vigor2960 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Other injection, Command injection
- [Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation](https://agentprime.io/advisories/CVE-2026-105312.md)
  `CVE-2026-105312` · CVE record: Red Hat StreamsHub Console for Apache Kafka® and 2 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Privilege escalation
- [Unblu Spark Authorization Bypass in Configuration Cascade Operations](https://agentprime.io/advisories/CVE-2026-9589.md)
  `CVE-2026-9589` · CVE record: Unblu inc. Unblu Spark · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Weak password recovery in Advantech ADAM-3600](https://agentprime.io/advisories/CVE-2026-43845.md)
  `CVE-2026-43845` · CVE record: Advantech ADAM-3600 · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-640
- [Improper authentication in Advantech ADAM-3600](https://agentprime.io/advisories/CVE-2026-43844.md)
  `CVE-2026-43844` · CVE record: Advantech ADAM-3600 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Stack-based buffer overflow in Advantech ADAM-3600](https://agentprime.io/advisories/CVE-2026-43838.md)
  `CVE-2026-43838` · CVE record: Advantech ADAM-3600 · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Command injection in Advantech ADAM-3600](https://agentprime.io/advisories/CVE-2026-43836.md)
  `CVE-2026-43836` · CVE record: Advantech ADAM-3600 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Command injection
- [Improper check for unusual conditions in Signal RingRTC](https://agentprime.io/advisories/CVE-2026-113380.md)
  `CVE-2026-113380` · CVE record: Signal RingRTC · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-754
- [Improper authentication in Apple macOS](https://agentprime.io/advisories/CVE-2026-86868.md)
  `CVE-2026-86868` · CVE record: Apple macOS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access](https://agentprime.io/advisories/CVE-2026-77936.md)
  `CVE-2026-77936` · CVE record: letta-ai letta · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-1188
- [DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment](https://agentprime.io/advisories/CVE-2026-77933.md)
  `CVE-2026-77933` · CVE record: eosphoros-ai DB-GPT · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-1392
- [DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent](https://agentprime.io/advisories/CVE-2026-77932.md)
  `CVE-2026-77932` · CVE record: eosphoros-ai DB-GPT · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [EvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-Agents](https://agentprime.io/advisories/CVE-2026-77930.md)
  `CVE-2026-77930` · CVE record: EvoScientist EvoScientist · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint](https://agentprime.io/advisories/CVE-2026-75128.md)
  `CVE-2026-75128` · CVE record: chatchat-space Langchain-Chatchat · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection](https://agentprime.io/advisories/CVE-2026-109444.md)
  `CVE-2026-109444` · CVE record: Tracer-Cloud opensre · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell](https://agentprime.io/advisories/CVE-2026-109442.md)
  `CVE-2026-109442` · CVE record: cas-bigdatalab piflow · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [H3C Magic NX15 RPC esps write code injection](https://agentprime.io/advisories/CVE-2026-112371.md)
  `CVE-2026-112371` · CVE record: H3C Magic NX15 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Other injection, Code injection
- [H3C Magic NX15 usrlist sub_416874 os command injection](https://agentprime.io/advisories/CVE-2026-112370.md)
  `CVE-2026-112370` · CVE record: H3C Magic NX15 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Command injection
- [Grav 2.0.15 before 2.2.2 Arbitrary Static Method Call via Flex Form replace-name@](https://agentprime.io/advisories/CVE-2026-112780.md)
  `CVE-2026-112780` · CVE record: getgrav grav · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-749
- [Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass](https://agentprime.io/advisories/CVE-2026-112779.md)
  `CVE-2026-112779` · CVE record: getgrav grav-plugin-api · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Denial of service
- [Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations](https://agentprime.io/advisories/CVE-2026-112776.md)
  `CVE-2026-112776` · CVE record: craftcms cms · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend](https://agentprime.io/advisories/CVE-2026-109437.md)
  `CVE-2026-109437` · CVE record: CognicellAI Cognition · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass, CWE-1188
- [Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag](https://agentprime.io/advisories/CVE-2026-110685.md)
  `CVE-2026-110685` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Denial of service
- [CCC Attestation SIG attested-tls-poc through commit 731ca82 Attestation Relay Attack](https://agentprime.io/advisories/CVE-2026-112377.md)
  `CVE-2026-112377` · CVE record: CCC-Attestation attested-tls-poc · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-346
- [Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass](https://agentprime.io/advisories/GHSA-f8c7-rwf9-fmgm.md)
  `GHSA-f8c7-rwf9-fmgm`, `CVE-2026-111057` · PyPI `mercury`: affected `>=3.0.0, <3.2.4`, fixed in `3.2.4` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control, CWE-185
- [Mercury: Unauthenticated Remote Code Execution via /api/kernels](https://agentprime.io/advisories/GHSA-rv4m-xm3f-3ccq.md)
  `GHSA-rv4m-xm3f-3ccq`, `CVE-2026-111058` · PyPI `mercury`: affected `<3.2.6`, fixed in `3.2.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Eptura Archibus Workflow Rule Enables Unauthenticated Arbitrary File Upload Leading to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-107188.md)
  `CVE-2026-107188` · CVE record: Eptura Archibus · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Unrestricted file upload
- [Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code](https://agentprime.io/advisories/CVE-2026-111862.md)
  `CVE-2026-111862` · CVE record: RankMath Rank Math SEO PRO · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-506
- [Camunda Expression Injection via orQueries RCE](https://agentprime.io/advisories/CVE-2026-109432.md)
  `CVE-2026-109432` · CVE record: Camunda Camunda 7 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Command injection, Code injection
- [FlyCms through commit edfdf724 Default Super Administrator Credentials](https://agentprime.io/advisories/CVE-2026-112296.md)
  `CVE-2026-112296` · CVE record: sunkaifei FlyCms · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: CWE-1392
- [CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules](https://agentprime.io/advisories/CVE-2026-112292.md)
  `CVE-2026-112292` · CVE record: operacle checkcle · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Bit-packing in Cranelift compiler causes silent overflow and miscompilation](https://agentprime.io/advisories/GHSA-897f-g5gm-fmxm.md)
  `GHSA-897f-g5gm-fmxm`, `CVE-2026-115889`, `RUSTSEC-2026-0380` · crates.io `wasmtime`: affected `>=0.0.0-0, <36.0.19 || >=37.0.0, <43.0.0`, fixed in `36.0.19`, `43.0.0` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Memory corruption, CWE-197
- [Apache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSON](https://agentprime.io/advisories/CVE-2026-71253.md)
  `CVE-2026-71253` · CVE record: Apache Software Foundation Apache Johnzon · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Code injection
- [Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)](https://agentprime.io/advisories/CVE-2026-78162.md)
  `CVE-2026-78162` · CVE record: Apache Software Foundation Apache Camel · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Insecure deserialization
- [Apache Answer: Reaction API authorization bypass for restricted content](https://agentprime.io/advisories/CVE-2026-90910.md)
  `CVE-2026-90910` · CVE record: Apache Software Foundation Apache Answer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation](https://agentprime.io/advisories/CVE-2026-79624.md)
  `CVE-2026-79624` · CVE record: Apache Software Foundation Apache Answer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [Apache Kylin: unauthenticated broadcast API and polymorphic deserialization](https://agentprime.io/advisories/CVE-2026-108771.md)
  `CVE-2026-108771` · CVE record: Apache Software Foundation Apache Kylin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass
- [WordPress HivePress plugin <= 1.7.32 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-110887.md)
  `CVE-2026-110887` · CVE record: HivePress HivePress · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Code injection
- [WordPress MapSVG plugin <= 8.16.1 - Arbitrary File Upload vulnerability](https://agentprime.io/advisories/CVE-2026-111406.md)
  `CVE-2026-111406` · CVE record: PT Norther Lights Production MapSVG · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Unrestricted file upload
- [Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)](https://agentprime.io/advisories/CVE-2026-103091.md)
  `CVE-2026-103091` · CVE record: Google SAM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, Authentication bypass, Broken access control, CWE-1188
- [Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)](https://agentprime.io/advisories/CVE-2026-102503.md)
  `CVE-2026-102503` · CVE record: Google SAM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass, Broken access control
- [GV-ASManager Web Server Command Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-108983.md)
  `CVE-2026-108983` · CVE record: GeoVision Inc. GV-ASManager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Command injection
- [SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_detail.php via the parameter fileID.](https://agentprime.io/advisories/CVE-2026-107083.md)
  `CVE-2026-107083` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: SQL injection
- [SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.php, admin/AJAX_check_id.php, admin/AJAX_vocabolary_control.…](https://agentprime.io/advisories/CVE-2026-107081.md)
  `CVE-2026-107081` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: SQL injection
- [Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution](https://agentprime.io/advisories/CVE-2024-4457.md)
  `CVE-2024-4457` · CVE record: WSO2 WSO2 Enterprise Integrator and 4 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Oct 2026 · Tags: Command injection

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTEwLTE4VDE4OjA1OjM0LjA1MDAwMFoiLCJDVkUtMjAyNC00NDU3Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTEwLTIwVDE3OjU5OjU1LjQwNzAwMFoiLCJDVkUtMjAyNi0xMTM4MDIiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTEwLTIwVDE3OjU5OjU1LjQwNzAwMFoiLCJDVkUtMjAyNi0xMTM4MDIiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.