# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no](https://agentprime.io/advisories/CVE-2026-94140.md)
  `CVE-2026-94140` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-322
- [Pillow: Argument Injection in Ghostscript call, potentially leading into RCE](https://agentprime.io/advisories/GHSA-w889-685w-c8fh.md)
  `GHSA-w889-685w-c8fh`, `BIT-pillow-2026-112900`, `CVE-2026-112900` · PyPI `pillow`: affected `>=2.6.0, <13.0.0`, fixed in `13.0.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Command injection
- [Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()](https://agentprime.io/advisories/CVE-2026-112408.md)
  `CVE-2026-112408` · CVE record: AWS Amazon SageMaker Python SDK · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-940
- [Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication](https://agentprime.io/advisories/CVE-2026-111811.md)
  `CVE-2026-111811` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Tenda BE3L Pro WifiBasicSet formWifiBasicSet buffer overflow](https://agentprime.io/advisories/CVE-2026-114268.md)
  `CVE-2026-114268` · CVE record: Tenda BE3L Pro · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption
- [Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out](https://agentprime.io/advisories/CVE-2026-111816.md)
  `CVE-2026-111816` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: HTTP request smuggling
- [Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling](https://agentprime.io/advisories/CVE-2025-31699.md)
  `CVE-2025-31699` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: HTTP request smuggling
- [Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration](https://agentprime.io/advisories/CVE-2026-111813.md)
  `CVE-2026-111813` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Command injection
- [Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life](https://agentprime.io/advisories/CVE-2026-105944.md)
  `CVE-2026-105944` · CVE record: Apache Software Foundation Apache Pulsar Manager · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role](https://agentprime.io/advisories/CVE-2026-105869.md)
  `CVE-2026-105869` · CVE record: Apache Software Foundation Apache Pulsar · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Weak cryptography or TLS
- [LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects](https://agentprime.io/advisories/CVE-2026-114493.md)
  `CVE-2026-114493` · CVE record: LocalAI LocalAI · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass](https://agentprime.io/advisories/CVE-2026-89035.md)
  `CVE-2026-89035` · CVE record: MikroTik RouterOS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-111183.md)
  `CVE-2026-111183` · CVE record: GStreamer GStreamer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption
- [Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76475.md)
  `CVE-2026-76475` · CVE record: Cisco Cisco Emergency Responder and 3 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Cisco Unified Communications Products Hardening Release: October 2026 - Improper Authentication Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76474.md)
  `CVE-2026-76474` · CVE record: Cisco Cisco Emergency Responder and 3 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Cisco Unified Communications Products Hardening Release: October 2026 - Improper control of a resource through its lifetime.](https://agentprime.io/advisories/CVE-2026-76473.md)
  `CVE-2026-76473` · CVE record: Cisco Cisco Emergency Responder and 3 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Other injection
- [Cisco Expressway Series Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-76466.md)
  `CVE-2026-76466` · CVE record: Cisco Cisco TelePresence Video Communication Server (VCS) Expressway · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Hard-coded credentials
- [Multiple Cisco Products Snort 3 Software Hardening Release: October 2026](https://agentprime.io/advisories/CVE-2026-20043.md)
  `CVE-2026-20043` · CVE record: Cisco Cisco Cyber Vision and 3 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption
- [Lagoon core ssh service vulnerable to remote code execution](https://agentprime.io/advisories/CVE-2026-113788.md)
  `CVE-2026-113788` · CVE record: uselagoon lagoon · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Command injection
- [WordPress WP Mailster plugin <= 1.9.1.0 - Arbitrary File Upload vulnerability](https://agentprime.io/advisories/CVE-2026-111832.md)
  `CVE-2026-111832` · CVE record: WP Mailster WP Mailster · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Unrestricted file upload
- [WordPress Mang Board WP plugin <= 2.4.4 - Arbitrary File Upload vulnerability](https://agentprime.io/advisories/CVE-2026-111834.md)
  `CVE-2026-111834` · CVE record: Kitae Park Mang Board WP · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Unrestricted file upload
- [WordPress Ajax Search Lite plugin <= 4.14.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-111852.md)
  `CVE-2026-111852` · CVE record: WPdreams Ajax Search Lite · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: SQL injection
- [RCE via stale global state](https://agentprime.io/advisories/CVE-2026-109619.md)
  `CVE-2026-109619` · CVE record: PHP Group PHP · CVSS 9.2 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 1.00 · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption, CWE-755, CWE-1325, CWE-1419
- [RCE via OOM corruption](https://agentprime.io/advisories/CVE-2026-109618.md)
  `CVE-2026-109618` · CVE record: PHP Group PHP · CVSS 9.2 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 1.00 · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption, CWE-755, CWE-1325, CWE-1419
- [PHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load](https://agentprime.io/advisories/CVE-2026-114403.md)
  `CVE-2026-114403` · CVE record: PHPOffice PHPPresentation · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Insecure deserialization
- [Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth](https://agentprime.io/advisories/CVE-2026-86249.md)
  `CVE-2026-86249` · CVE record: Apache Software Foundation Apache bRPC · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Apache bRPC: Missing Authentication for Streaming RPC Frames](https://agentprime.io/advisories/CVE-2026-78334.md)
  `CVE-2026-78334` · CVE record: Apache Software Foundation Apache bRPC · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Apache bRPC: Out-of-Bounds Write in Redis Command Parser](https://agentprime.io/advisories/CVE-2026-56388.md)
  `CVE-2026-56388` · CVE record: Apache Software Foundation Apache bRPC · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Denial of service, Memory corruption, CWE-252
- [Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests](https://agentprime.io/advisories/CVE-2026-48830.md)
  `CVE-2026-48830` · CVE record: Apache Software Foundation Apache bRPC · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC](https://agentprime.io/advisories/CVE-2026-59562.md)
  `CVE-2026-59562` · CVE record: Apache Software Foundation Apache IoTDB · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Apache IoTDB: Auth Bypass in pipeTransfer() interface](https://agentprime.io/advisories/CVE-2026-58663.md)
  `CVE-2026-58663` · CVE record: Apache Software Foundation Apache IoTDB · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass
- [Incorrect authorization in Acronis Cyber Infrastructure](https://agentprime.io/advisories/CVE-2026-87095.md)
  `CVE-2026-87095` · CVE record: Acronis Acronis Cyber Infrastructure · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in OpenStack Manila](https://agentprime.io/advisories/CVE-2026-71195.md)
  `CVE-2026-71195` · CVE record: OpenStack Manila · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow](https://agentprime.io/advisories/CVE-2026-113744.md)
  `CVE-2026-113744` · CVE record: Tenda AC19 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption
- [Best Practice Software Bp Premier before 1.14.1.1128 Hardcoded SQL Server Administrative Credential](https://agentprime.io/advisories/CVE-2026-114119.md)
  `CVE-2026-114119` · CVE record: Best Practice Software Bp Premier · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Hard-coded credentials
- [D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password](https://agentprime.io/advisories/CVE-2026-113736.md)
  `CVE-2026-113736` · CVE record: D-Link DHP-W610AV · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Hard-coded credentials, CWE-258
- [PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation (incomplete fix for CVE-2026-54512) \[CVE-2026-110879\]](https://agentprime.io/advisories/GHSA-m8xf-2cr7-77ph.md)
  `GHSA-m8xf-2cr7-77ph`, `CVE-2026-110879` · Maven `com.fasterxml.jackson.core:jackson-databind` and 1 more: affected `>=2.10.0, <=2.18.11 || >=2.19.0, <=2.21.7 || >=2.22.0, <=2.22.3`, fixed in `2.18.12`, `2.21.8`, `2.22.4` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Insecure deserialization
- [DataStage on Cloud Pak for Data Improper Authorization](https://agentprime.io/advisories/CVE-2026-81212.md)
  `CVE-2026-81212` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [IBM App Connect Enterprise is vulnerable to a credential exposure](https://agentprime.io/advisories/CVE-2026-92559.md)
  `CVE-2026-92559` · CVE record: IBM App Connect Enterprise · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-1327
- [Missing authentication in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91665.md)
  `CVE-2026-91665` · CVE record: Oracle Corporation Oracle Essbase · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91663.md)
  `CVE-2026-91663` · CVE record: Oracle Corporation Oracle Essbase · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91658.md)
  `CVE-2026-91658` · CVE record: Oracle Corporation Oracle Essbase · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91656.md)
  `CVE-2026-91656` · CVE record: Oracle Corporation Oracle Essbase · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91655.md)
  `CVE-2026-91655` · CVE record: Oracle Corporation Oracle Essbase · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91644.md)
  `CVE-2026-91644` · CVE record: Oracle Corporation Oracle Essbase · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91638.md)
  `CVE-2026-91638` · CVE record: Oracle Corporation Oracle Essbase · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91637.md)
  `CVE-2026-91637` · CVE record: Oracle Corporation Oracle Essbase · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle Agile Product Lifecycle Management for Process](https://agentprime.io/advisories/CVE-2026-91624.md)
  `CVE-2026-91624` · CVE record: Oracle Corporation Oracle Agile Product Lifecycle Management for Process · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle Agile Product Lifecycle Management for Process](https://agentprime.io/advisories/CVE-2026-91622.md)
  `CVE-2026-91622` · CVE record: Oracle Corporation Oracle Agile Product Lifecycle Management for Process · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle WebCenter Content](https://agentprime.io/advisories/CVE-2026-91495.md)
  `CVE-2026-91495` · CVE record: Oracle Corporation Oracle WebCenter Content · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Identity Manager Connector](https://agentprime.io/advisories/CVE-2026-91491.md)
  `CVE-2026-91491` · CVE record: Oracle Corporation Oracle Identity Manager Connector · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Identity Manager Connector](https://agentprime.io/advisories/CVE-2026-91490.md)
  `CVE-2026-91490` · CVE record: Oracle Corporation Oracle Identity Manager Connector · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation Oracle Identity Manager](https://agentprime.io/advisories/CVE-2026-91408.md)
  `CVE-2026-91408` · CVE record: Oracle Corporation Oracle Identity Manager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle Outside In Technology](https://agentprime.io/advisories/CVE-2026-91354.md)
  `CVE-2026-91354` · CVE record: Oracle Corporation Oracle Outside In Technology · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Outside In Technology](https://agentprime.io/advisories/CVE-2026-91341.md)
  `CVE-2026-91341` · CVE record: Oracle Corporation Oracle Outside In Technology · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle WebLogic Server](https://agentprime.io/advisories/CVE-2026-91323.md)
  `CVE-2026-91323` · CVE record: Oracle Corporation Oracle WebLogic Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Missing authentication in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91305.md)
  `CVE-2026-91305` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Orchestrator](https://agentprime.io/advisories/CVE-2026-91299.md)
  `CVE-2026-91299` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Orchestrator · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91265.md)
  `CVE-2026-91265` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass
- [Improper access control in Oracle Corporation Oracle SOA Suite](https://agentprime.io/advisories/CVE-2026-91251.md)
  `CVE-2026-91251` · CVE record: Oracle Corporation Oracle SOA Suite · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTEwLTIwVDIxOjI0OjUzLjkwNTAwMFoiLCJDVkUtMjAyNi05MTI1MSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTEwLTIxVDIxOjIyOjQ4LjU5MzAwMFoiLCJDVkUtMjAyNi05NDQyMyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTEwLTIxVDIxOjIyOjQ4LjU5MzAwMFoiLCJDVkUtMjAyNi05NDQyMyJd>. Everything for agents: <https://agentprime.io/llms.txt>.