# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Improper privilege management in Oracle Corporation Oracle SOA Suite](https://agentprime.io/advisories/CVE-2026-91250.md)
  `CVE-2026-91250` · CVE record: Oracle Corporation Oracle SOA Suite · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Privilege escalation
- [Improper access control in Oracle Corporation Oracle Business Process Management Suite](https://agentprime.io/advisories/CVE-2026-91243.md)
  `CVE-2026-91243` · CVE record: Oracle Corporation Oracle Business Process Management Suite · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Business Intelligence Enterprise Edition](https://agentprime.io/advisories/CVE-2026-91241.md)
  `CVE-2026-91241` · CVE record: Oracle Corporation Oracle Business Intelligence Enterprise Edition · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle SOA Suite](https://agentprime.io/advisories/CVE-2026-91236.md)
  `CVE-2026-91236` · CVE record: Oracle Corporation Oracle SOA Suite · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle SOA Suite](https://agentprime.io/advisories/CVE-2026-91235.md)
  `CVE-2026-91235` · CVE record: Oracle Corporation Oracle SOA Suite · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle SOA Suite](https://agentprime.io/advisories/CVE-2026-91234.md)
  `CVE-2026-91234` · CVE record: Oracle Corporation Oracle SOA Suite · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle SOA Suite](https://agentprime.io/advisories/CVE-2026-91233.md)
  `CVE-2026-91233` · CVE record: Oracle Corporation Oracle SOA Suite · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle SOA Suite](https://agentprime.io/advisories/CVE-2026-91232.md)
  `CVE-2026-91232` · CVE record: Oracle Corporation Oracle SOA Suite · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle SOA Suite](https://agentprime.io/advisories/CVE-2026-91231.md)
  `CVE-2026-91231` · CVE record: Oracle Corporation Oracle SOA Suite · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle SOA Suite](https://agentprime.io/advisories/CVE-2026-91230.md)
  `CVE-2026-91230` · CVE record: Oracle Corporation Oracle SOA Suite · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle SOA Suite](https://agentprime.io/advisories/CVE-2026-91225.md)
  `CVE-2026-91225` · CVE record: Oracle Corporation Oracle SOA Suite · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle SOA Suite](https://agentprime.io/advisories/CVE-2026-91224.md)
  `CVE-2026-91224` · CVE record: Oracle Corporation Oracle SOA Suite · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper authentication in Oracle Corporation Oracle Business Process Management Suite](https://agentprime.io/advisories/CVE-2026-91222.md)
  `CVE-2026-91222` · CVE record: Oracle Corporation Oracle Business Process Management Suite · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle SOA Suite](https://agentprime.io/advisories/CVE-2026-91221.md)
  `CVE-2026-91221` · CVE record: Oracle Corporation Oracle SOA Suite · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle Business Process Management Suite](https://agentprime.io/advisories/CVE-2026-91220.md)
  `CVE-2026-91220` · CVE record: Oracle Corporation Oracle Business Process Management Suite · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle SOA Suite](https://agentprime.io/advisories/CVE-2026-91218.md)
  `CVE-2026-91218` · CVE record: Oracle Corporation Oracle SOA Suite · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle SOA Suite](https://agentprime.io/advisories/CVE-2026-91216.md)
  `CVE-2026-91216` · CVE record: Oracle Corporation Oracle SOA Suite · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle SOA Suite](https://agentprime.io/advisories/CVE-2026-91214.md)
  `CVE-2026-91214` · CVE record: Oracle Corporation Oracle SOA Suite · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Information disclosure in Oracle Corporation Oracle HTTP Server](https://agentprime.io/advisories/CVE-2026-87347.md)
  `CVE-2026-87347` · CVE record: Oracle Corporation Oracle HTTP Server · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure
- [Information disclosure in Oracle Corporation Oracle Access Manager](https://agentprime.io/advisories/CVE-2026-87337.md)
  `CVE-2026-87337` · CVE record: Oracle Corporation Oracle Access Manager · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure
- [Missing authentication in Oracle Corporation Oracle WebLogic Server](https://agentprime.io/advisories/CVE-2026-87302.md)
  `CVE-2026-87302` · CVE record: Oracle Corporation Oracle WebLogic Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Access Manager](https://agentprime.io/advisories/CVE-2026-87251.md)
  `CVE-2026-87251` · CVE record: Oracle Corporation Oracle Access Manager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle WebLogic Server](https://agentprime.io/advisories/CVE-2026-83399.md)
  `CVE-2026-83399` · CVE record: Oracle Corporation Oracle WebLogic Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Data Integrator](https://agentprime.io/advisories/CVE-2026-83397.md)
  `CVE-2026-83397` · CVE record: Oracle Corporation Oracle Data Integrator · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Data Integrator](https://agentprime.io/advisories/CVE-2026-83396.md)
  `CVE-2026-83396` · CVE record: Oracle Corporation Oracle Data Integrator · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Solaris](https://agentprime.io/advisories/CVE-2026-60432.md)
  `CVE-2026-60432` · CVE record: Oracle Corporation Oracle Solaris · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Workflow](https://agentprime.io/advisories/CVE-2026-101809.md)
  `CVE-2026-101809` · CVE record: Oracle Corporation Workflow · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle Product Workbench](https://agentprime.io/advisories/CVE-2026-101808.md)
  `CVE-2026-101808` · CVE record: Oracle Corporation Oracle Product Workbench · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Application Object Library](https://agentprime.io/advisories/CVE-2026-101767.md)
  `CVE-2026-101767` · CVE record: Oracle Corporation Oracle Application Object Library · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Communications Billing and Revenue Management](https://agentprime.io/advisories/CVE-2026-101765.md)
  `CVE-2026-101765` · CVE record: Oracle Corporation Oracle Communications Billing and Revenue Management · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Communications BRM - Elastic Charging Engine](https://agentprime.io/advisories/CVE-2026-101763.md)
  `CVE-2026-101763` · CVE record: Oracle Corporation Oracle Communications BRM - Elastic Charging Engine · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle Mobile Field Service](https://agentprime.io/advisories/CVE-2026-101634.md)
  `CVE-2026-101634` · CVE record: Oracle Corporation Oracle Mobile Field Service · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Helidon](https://agentprime.io/advisories/CVE-2026-101590.md)
  `CVE-2026-101590` · CVE record: Oracle Corporation Helidon · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Solaris](https://agentprime.io/advisories/CVE-2026-101537.md)
  `CVE-2026-101537` · CVE record: Oracle Corporation Oracle Solaris · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle Enterprise Manager for Oracle Database](https://agentprime.io/advisories/CVE-2026-101529.md)
  `CVE-2026-101529` · CVE record: Oracle Corporation Oracle Enterprise Manager for Oracle Database · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Enterprise Manager for Oracle Database](https://agentprime.io/advisories/CVE-2026-101528.md)
  `CVE-2026-101528` · CVE record: Oracle Corporation Oracle Enterprise Manager for Oracle Database · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle APEX](https://agentprime.io/advisories/CVE-2026-101521.md)
  `CVE-2026-101521` · CVE record: Oracle Corporation Oracle APEX · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle Trusted Answer Search](https://agentprime.io/advisories/CVE-2026-101503.md)
  `CVE-2026-101503` · CVE record: Oracle Corporation Oracle Trusted Answer Search · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Uncontrolled resource consumption in Oracle Corporation Oracle Trusted Answer Search](https://agentprime.io/advisories/CVE-2026-101501.md)
  `CVE-2026-101501` · CVE record: Oracle Corporation Oracle Trusted Answer Search · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Denial of service
- [Missing authentication in Oracle Corporation Oracle WebCenter Sites](https://agentprime.io/advisories/CVE-2026-101499.md)
  `CVE-2026-101499` · CVE record: Oracle Corporation Oracle WebCenter Sites · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Secure Backup](https://agentprime.io/advisories/CVE-2026-101484.md)
  `CVE-2026-101484` · CVE record: Oracle Corporation Oracle Secure Backup · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Siebel CRM Cloud Applications](https://agentprime.io/advisories/CVE-2026-101446.md)
  `CVE-2026-101446` · CVE record: Oracle Corporation Siebel CRM Cloud Applications · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101420.md)
  `CVE-2026-101420` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates](https://agentprime.io/advisories/CVE-2026-113812.md)
  `CVE-2026-113812` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Weak cryptography or TLS
- [Google Chrome: UI misrepresentation in WebAppInstalls in Google Chrome on on Android prior to…](https://agentprime.io/advisories/CVE-2026-113169.md)
  `CVE-2026-113169` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-451
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113116.md)
  `CVE-2026-113116` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113186.md)
  `CVE-2026-113186` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113023.md)
  `CVE-2026-113023` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-113300.md)
  `CVE-2026-113300` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure
- [Observable discrepancy in Google Chrome](https://agentprime.io/advisories/CVE-2026-113056.md)
  `CVE-2026-113056` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113089.md)
  `CVE-2026-113089` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113235.md)
  `CVE-2026-113235` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Execution with unnecessary privileges in Google Chrome](https://agentprime.io/advisories/CVE-2026-113342.md)
  `CVE-2026-113342` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Privilege escalation
- [Google Chrome: UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a…](https://agentprime.io/advisories/CVE-2026-113138.md)
  `CVE-2026-113138` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-451
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113270.md)
  `CVE-2026-113270` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect calculation in Google Chrome](https://agentprime.io/advisories/CVE-2026-113007.md)
  `CVE-2026-113007` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-682
- [Resource exposure in Google Chrome](https://agentprime.io/advisories/CVE-2026-113126.md)
  `CVE-2026-113126` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113084.md)
  `CVE-2026-113084` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Resource exposure in Google Chrome](https://agentprime.io/advisories/CVE-2026-113328.md)
  `CVE-2026-113328` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure
- [Google Chrome: UI misrepresentation in Prompts in Google Chrome on on Android prior to 156.0.8078.47…](https://agentprime.io/advisories/CVE-2026-113171.md)
  `CVE-2026-113171` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-451

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTEwLTIwVDIxOjAyOjE3LjUwMzAwMFoiLCJDVkUtMjAyNi0xMTMxNzEiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTEwLTIwVDIxOjI0OjUzLjkwNTAwMFoiLCJDVkUtMjAyNi05MTI1MSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTEwLTIwVDIxOjI0OjUzLjkwNTAwMFoiLCJDVkUtMjAyNi05MTI1MSJd>. Everything for agents: <https://agentprime.io/llms.txt>.