# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Improper input validation in Google Chrome](https://agentprime.io/advisories/CVE-2026-113261.md)
  `CVE-2026-113261` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-20
- [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-112992.md)
  `CVE-2026-112992` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure
- [Improper input validation in Google Chrome](https://agentprime.io/advisories/CVE-2026-113189.md)
  `CVE-2026-113189` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-20
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113014.md)
  `CVE-2026-113014` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper privilege management in Google Chrome](https://agentprime.io/advisories/CVE-2026-113283.md)
  `CVE-2026-113283` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Privilege escalation
- [Time-of-check time-of-use race condition in Google Chrome](https://agentprime.io/advisories/CVE-2026-113078.md)
  `CVE-2026-113078` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Race condition
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113211.md)
  `CVE-2026-113211` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113263.md)
  `CVE-2026-113263` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-113336.md)
  `CVE-2026-113336` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113222.md)
  `CVE-2026-113222` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-113020.md)
  `CVE-2026-113020` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Use of uninitialized resource in Google Chrome](https://agentprime.io/advisories/CVE-2026-113252.md)
  `CVE-2026-113252` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-113072.md)
  `CVE-2026-113072` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [@fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch](https://agentprime.io/advisories/CVE-2026-112712.md)
  `CVE-2026-112712` · CVE record: @fastify/middie @fastify/middie · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-436
- [Pillow: Heap buffer overflow in ImagingJpegDecode](https://agentprime.io/advisories/GHSA-8g5g-8vmr-9782.md)
  `GHSA-8g5g-8vmr-9782`, `BIT-pillow-2026-112403`, `CVE-2026-112403`, `PYSEC-2026-4332` · PyPI `pillow`: affected `<13.0.0`, fixed in `13.0.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php](https://agentprime.io/advisories/CVE-2016-20101.md)
  `CVE-2016-20101` · CVE record: Pedro Marcelo Issuu Panel · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: File inclusion
- [Authorization: Negotiate sent to foreign origin](https://agentprime.io/advisories/CVE-2026-94265.md)
  `CVE-2026-94265` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure
- [OS command injection in Totolink](https://agentprime.io/advisories/CVE-2026-35499.md)
  `CVE-2026-35499` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Command injection
- [OS command injection in Totolink](https://agentprime.io/advisories/CVE-2026-40627.md)
  `CVE-2026-40627` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Command injection
- [Stack-based buffer overflow in Totolink](https://agentprime.io/advisories/CVE-2026-28763.md)
  `CVE-2026-28763` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in Totolink](https://agentprime.io/advisories/CVE-2026-41223.md)
  `CVE-2026-41223` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [OS command injection in Totolink](https://agentprime.io/advisories/CVE-2026-33568.md)
  `CVE-2026-33568` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Command injection
- [Stack-based buffer overflow in Totolink](https://agentprime.io/advisories/CVE-2026-41222.md)
  `CVE-2026-41222` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in Totolink](https://agentprime.io/advisories/CVE-2026-40615.md)
  `CVE-2026-40615` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in Totolink](https://agentprime.io/advisories/CVE-2026-42020.md)
  `CVE-2026-42020` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in Totolink](https://agentprime.io/advisories/CVE-2026-42019.md)
  `CVE-2026-42019` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in Totolink](https://agentprime.io/advisories/CVE-2026-42024.md)
  `CVE-2026-42024` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in Totolink](https://agentprime.io/advisories/CVE-2026-42023.md)
  `CVE-2026-42023` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in Totolink](https://agentprime.io/advisories/CVE-2026-42022.md)
  `CVE-2026-42022` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in Totolink](https://agentprime.io/advisories/CVE-2026-42021.md)
  `CVE-2026-42021` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in Totolink](https://agentprime.io/advisories/CVE-2026-42026.md)
  `CVE-2026-42026` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in Totolink](https://agentprime.io/advisories/CVE-2026-42025.md)
  `CVE-2026-42025` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in Totolink](https://agentprime.io/advisories/CVE-2026-9660.md)
  `CVE-2026-9660` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in Totolink](https://agentprime.io/advisories/CVE-2026-9659.md)
  `CVE-2026-9659` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [OS command injection in Totolink](https://agentprime.io/advisories/CVE-2026-9814.md)
  `CVE-2026-9814` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Command injection
- [Stack-based buffer overflow in Totolink](https://agentprime.io/advisories/CVE-2026-9817.md)
  `CVE-2026-9817` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Path traversal in Totolink](https://agentprime.io/advisories/CVE-2026-9827.md)
  `CVE-2026-9827` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [Stack-based buffer overflow in Totolink](https://agentprime.io/advisories/CVE-2026-9869.md)
  `CVE-2026-9869` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [OS command injection in Totolink](https://agentprime.io/advisories/CVE-2026-10131.md)
  `CVE-2026-10131` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Command injection
- [Stack-based buffer overflow in Totolink](https://agentprime.io/advisories/CVE-2026-10132.md)
  `CVE-2026-10132` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in Totolink](https://agentprime.io/advisories/CVE-2026-10133.md)
  `CVE-2026-10133` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [OS command injection in Totolink](https://agentprime.io/advisories/CVE-2026-10135.md)
  `CVE-2026-10135` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Command injection
- [Heap-based buffer overflow in Totolink](https://agentprime.io/advisories/CVE-2026-10136.md)
  `CVE-2026-10136` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in Totolink](https://agentprime.io/advisories/CVE-2026-10137.md)
  `CVE-2026-10137` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [OS command injection in Totolink](https://agentprime.io/advisories/CVE-2026-10138.md)
  `CVE-2026-10138` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Command injection
- [Stack-based buffer overflow in Totolink](https://agentprime.io/advisories/CVE-2026-10139.md)
  `CVE-2026-10139` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [Improper signature verification in Totolink](https://agentprime.io/advisories/CVE-2026-10141.md)
  `CVE-2026-10141` · CVE record: totolink Totolink · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS
- [FTP wildcard write callback mixup](https://agentprime.io/advisories/CVE-2026-92388.md)
  `CVE-2026-92388` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Memory corruption
- [wolfSSL public-key pinning bypass](https://agentprime.io/advisories/CVE-2026-87866.md)
  `CVE-2026-87866` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS
- [cross-origin reuse of a Negotiate connection](https://agentprime.io/advisories/CVE-2026-87861.md)
  `CVE-2026-87861` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure
- [leaking host credentials to HTTP proxy](https://agentprime.io/advisories/CVE-2026-86414.md)
  `CVE-2026-86414` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure
- [Negotiate credentials sent to redirected origin](https://agentprime.io/advisories/CVE-2026-86413.md)
  `CVE-2026-86413` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure
- [Missing authorization in the WhatsApp channel in Kiro Crew](https://agentprime.io/advisories/CVE-2026-112380.md)
  `CVE-2026-112380` · CVE record: Amazon Kiro Crew · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [FTP connection reuse inherits client-certificate](https://agentprime.io/advisories/CVE-2026-86411.md)
  `CVE-2026-86411` · CVE record: curl curl · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-488
- [Stanza injection in XMPP chat](https://agentprime.io/advisories/CVE-2026-113867.md)
  `CVE-2026-113867` · CVE record: Mozilla Thunderbird · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-116
- [Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting](https://agentprime.io/advisories/CVE-2026-97406.md)
  `CVE-2026-97406` · CVE record: Xerj Console API · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Argo CD: A Kustomize Helm config home can run commands in the repo-server](https://agentprime.io/advisories/CVE-2026-113709.md)
  `CVE-2026-113709` · CVE record: argoproj argo-cd · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-829
- [Argo CD: A Kustomize remote ref can run commands in the repo-server](https://agentprime.io/advisories/CVE-2026-113708.md)
  `CVE-2026-113708` · CVE record: argoproj argo-cd · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Command injection
- [Argo CD: A Jsonnet import can read files from the repo-server](https://agentprime.io/advisories/CVE-2026-113672.md)
  `CVE-2026-113672` · CVE record: argoproj argo-cd · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Path traversal
- [Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler](https://agentprime.io/advisories/CVE-2026-113802.md)
  `CVE-2026-113802` · CVE record: Wavlink WL-WN530BE1-A · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Command injection

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTEwLTIwVDE3OjU5OjU1LjQwNzAwMFoiLCJDVkUtMjAyNi0xMTM4MDIiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTEwLTIwVDIxOjAyOjE3LjUwMzAwMFoiLCJDVkUtMjAyNi0xMTMxNzEiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTEwLTIwVDIxOjAyOjE3LjUwMzAwMFoiLCJDVkUtMjAyNi0xMTMxNzEiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.