# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Unauthenticated Sensitive Information Disclosure in the Command Line Interface of AOS-10](https://agentprime.io/advisories/CVE-2026-79871.md)
  `CVE-2026-79871` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure
- [Authentication Bypass leads to Unauthorized Access in AOS-8](https://agentprime.io/advisories/CVE-2026-79870.md)
  `CVE-2026-79870` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass Leading to Remote Code Execution in AOS-10](https://agentprime.io/advisories/CVE-2026-79869.md)
  `CVE-2026-79869` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass Vulnerabilities lead to Complete System Compromise in AOS-8](https://agentprime.io/advisories/CVE-2026-79868.md)
  `CVE-2026-79868` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Authentication Bypass Leading to Remote Code Execution in AOS-8](https://agentprime.io/advisories/CVE-2026-79867.md)
  `CVE-2026-79867` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Unauthenticated Adjacent Path Traversal Vulnerability leads to Filesystem Compromise in AOS-8](https://agentprime.io/advisories/CVE-2026-79866.md)
  `CVE-2026-79866` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [Unauthenticated Adjacent Memory Corruption Vulnerability leads to Remote Code Execution in AOS-10](https://agentprime.io/advisories/CVE-2026-79865.md)
  `CVE-2026-79865` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Memory corruption
- [Unauthenticated Adjacent Command Injection Vulnerability in AOS-10](https://agentprime.io/advisories/CVE-2026-79864.md)
  `CVE-2026-79864` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Command injection
- [Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-79863.md)
  `CVE-2026-79863` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Memory corruption
- [Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-79862.md)
  `CVE-2026-79862` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Memory corruption
- [Unauthenticated Command Injection Vulnerability in the PAPI Protocol of AOS-10](https://agentprime.io/advisories/CVE-2026-79861.md)
  `CVE-2026-79861` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Command injection
- [Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8](https://agentprime.io/advisories/CVE-2026-79860.md)
  `CVE-2026-79860` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Memory corruption
- [Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-8](https://agentprime.io/advisories/CVE-2026-79859.md)
  `CVE-2026-79859` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Memory corruption
- [Unauthenticated SQL Injection Vulnerability in the PAPI Protocol of AOS-8](https://agentprime.io/advisories/CVE-2026-79858.md)
  `CVE-2026-79858` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection
- [Unauthenticated Command Injection Vulnerability in AOS-8 PAPI Protocol](https://agentprime.io/advisories/CVE-2026-79857.md)
  `CVE-2026-79857` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Command injection
- [Unauthenticated Buffer Overflow Vulnerability leads to Authentication Bypass in AOS-8](https://agentprime.io/advisories/CVE-2026-79856.md)
  `CVE-2026-79856` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Memory corruption
- [Authentication Bypass in the SSH Daemon of AOS-8 leads to Complete System Compromise](https://agentprime.io/advisories/CVE-2026-79855.md)
  `CVE-2026-79855` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Unauthenticated SQL Injection Vulnerability leads to Remote Code Execution in AOS-10](https://agentprime.io/advisories/CVE-2026-79854.md)
  `CVE-2026-79854` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection
- [Unauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10](https://agentprime.io/advisories/CVE-2026-79853.md)
  `CVE-2026-79853` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure
- [Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface](https://agentprime.io/advisories/CVE-2026-79852.md)
  `CVE-2026-79852` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection
- [Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10](https://agentprime.io/advisories/CVE-2026-79851.md)
  `CVE-2026-79851` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Memory corruption
- [Authentication Bypass Leading to Remote Code Execution in AOS-8](https://agentprime.io/advisories/CVE-2026-79850.md)
  `CVE-2026-79850` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8](https://agentprime.io/advisories/CVE-2026-79849.md)
  `CVE-2026-79849` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection
- [Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8](https://agentprime.io/advisories/CVE-2026-79848.md)
  `CVE-2026-79848` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection
- [Unauthenticated Buffer Overflow Vulnerabilities leads to Remote Code Execution in AOS-10](https://agentprime.io/advisories/CVE-2026-79847.md)
  `CVE-2026-79847` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Memory corruption
- [Unauthenticated Command Injection Vulnerabilities in AOS-8](https://agentprime.io/advisories/CVE-2026-79846.md)
  `CVE-2026-79846` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Command injection
- [Authentication Bypass Leading to Remote Code Execution in AOS-10](https://agentprime.io/advisories/CVE-2026-79844.md)
  `CVE-2026-79844` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack](https://agentprime.io/advisories/CVE-2026-114611.md)
  `CVE-2026-114611` · CVE record: schorschii OCO-Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Weak cryptography or TLS
- [Pre-boot RCE in EDK II PXE driver](https://agentprime.io/advisories/CVE-2026-97631.md)
  `CVE-2026-97631` · CVE record: TianoCore EDK2 · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Memory corruption
- [Pillow multi-frame loaders can reuse stale native image storage after mode transitions](https://agentprime.io/advisories/GHSA-v9pv-5gc8-w2m6.md)
  `GHSA-v9pv-5gc8-w2m6`, `BIT-pillow-2026-96639`, `CVE-2026-96639`, `PYSEC-2026-4339` · PyPI `pillow`: affected `>=11.0.0, <13.0.0`, fixed in `13.0.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Memory corruption
- [Sentry-Javascript: Middleware Bypass when using Tunnel route](https://agentprime.io/advisories/GHSA-mchm-gjx6-7h55.md)
  `GHSA-mchm-gjx6-7h55`, `CVE-2026-114139` · npm `@sentry/nextjs`: affected `>=9.36.0, <9.47.2 || >=10.0.0-alpha.0, <10.75.2 || >=11.0.0-alpha.0, <11.0.0-rc.1`, fixed in `9.47.2`, `10.75.2`, `11.0.0-rc.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: CWE-693
- [Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52](https://agentprime.io/advisories/CVE-2026-102785.md)
  `CVE-2026-102785` · CVE record: yootheme.com YOOtheme Pro extension for Joomla · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Unrestricted file upload
- [mem0ai Databricks vector store vulnerable to SQL injection](https://agentprime.io/advisories/GHSA-7587-9684-52r6.md)
  `GHSA-7587-9684-52r6`, `CVE-2026-115324` · PyPI `mem0ai`: affected `>=0.1.117, <1.0.8`, fixed in `1.0.8` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection
- [WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2026-112832.md)
  `CVE-2026-112832` · CVE record: CozyThemes Rootblox · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: File inclusion
- [DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php](https://agentprime.io/advisories/CVE-2021-48016.md)
  `CVE-2021-48016` · CVE record: DedeCMS DedeCMS · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Code injection
- [FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer](https://agentprime.io/advisories/CVE-2021-48014.md)
  `CVE-2021-48014` · CVE record: FanRuan FineReport · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Path traversal
- [WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability](https://agentprime.io/advisories/CVE-2026-112241.md)
  `CVE-2026-112241` · CVE record: Brainstorm Force SureCart · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Authentication bypass
- [WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-112327.md)
  `CVE-2026-112327` · CVE record: TMS Amelia · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: SQL injection
- [NewType Infortech｜NT OneAPP - Improper Certificate Validation](https://agentprime.io/advisories/CVE-2026-114220.md)
  `CVE-2026-114220` · CVE record: NewType Infortech NT OneAPP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Weak cryptography or TLS
- [NewType Infortech｜NT OneAPP - Hard-coded Credentials](https://agentprime.io/advisories/CVE-2026-114219.md)
  `CVE-2026-114219` · CVE record: NewType Infortech NT OneAPP · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Hard-coded credentials
- [OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints](https://agentprime.io/advisories/CVE-2026-114661.md)
  `CVE-2026-114661` · CVE record: openremote openremote · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175](https://agentprime.io/advisories/CVE-2026-96355.md)
  `CVE-2026-96355` · CVE record: Drupal Webform · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Code injection
- [TOTOLINK A950RG product.so UploadCustomModule command injection](https://agentprime.io/advisories/CVE-2026-114575.md)
  `CVE-2026-114575` · CVE record: TOTOLINK A950RG · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Other injection, Command injection
- [Integer Overflow or Wraparound in GitLab](https://agentprime.io/advisories/CVE-2026-110264.md)
  `CVE-2026-110264` · CVE record: GitLab GitLab · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Memory corruption
- [Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing.](https://agentprime.io/advisories/CVE-2026-78846.md)
  `CVE-2026-78846` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Memory corruption
- [An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the \_loc…](https://agentprime.io/advisories/CVE-2025-65200.md)
  `CVE-2025-65200` · CVE record · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Files or Directories Accessible to External Parties in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76531.md)
  `CVE-2026-76531` · CVE record: Splunk Splunk SOAR · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure
- [Improper Protection of Alternate Path in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76529.md)
  `CVE-2026-76529` · CVE record: Splunk Splunk SOAR · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-424
- [Protection Mechanism Failure in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76528.md)
  `CVE-2026-76528` · CVE record: Splunk Splunk SOAR · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-693
- [Improper Check or Handling of Exceptional Conditions in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76527.md)
  `CVE-2026-76527` · CVE record: Splunk Splunk SOAR · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-703
- [Improper Control of a Resource Through its Lifetime in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76408.md)
  `CVE-2026-76408` · CVE record: Splunk Splunk SOAR · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-664
- [Improper Access Control in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76407.md)
  `CVE-2026-76407` · CVE record: Splunk Splunk SOAR · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Security Hardening in Splunk Enterprise - October 2026](https://agentprime.io/advisories/CVE-2026-76302.md)
  `CVE-2026-76302` · CVE record: Splunk Splunk Enterprise · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-707
- [Security Hardening in Splunk Enterprise - October 2026](https://agentprime.io/advisories/CVE-2026-76301.md)
  `CVE-2026-76301` · CVE record: Splunk Splunk Enterprise · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-693
- [Security Hardening in Splunk Enterprise - October 2026](https://agentprime.io/advisories/CVE-2026-76299.md)
  `CVE-2026-76299` · CVE record: Splunk Splunk Enterprise · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow](https://agentprime.io/advisories/CVE-2026-114383.md)
  `CVE-2026-114383` · CVE record: TOTOLINK EX200 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption
- [TOTOLINK EX200 lan.so cstecgi.cgi setStaticDhcpConfig stack-based overflow](https://agentprime.io/advisories/CVE-2026-114382.md)
  `CVE-2026-114382` · CVE record: TOTOLINK EX200 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption
- [Pillow: Heap buffer overflow in \_tiffWriteProc when saving TIFF to BytesIO](https://agentprime.io/advisories/GHSA-332p-7hrc-92wf.md)
  `GHSA-332p-7hrc-92wf`, `BIT-pillow-2026-112393`, `CVE-2026-112393` · PyPI `pillow`: affected `>=2.0.0, <13.0.0`, fixed in `13.0.0` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Memory corruption
- [Broken or risky cryptographic algorithm in Oracle Corporation Oracle Java SE and others](https://agentprime.io/advisories/CVE-2026-91403.md)
  `CVE-2026-91403` · CVE record: Oracle Corporation Oracle Java SE and 2 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Weak cryptography or TLS
- [Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts](https://agentprime.io/advisories/CVE-2026-94423.md)
  `CVE-2026-94423` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: CWE-322

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTEwLTIxVDIxOjIyOjQ4LjU5MzAwMFoiLCJDVkUtMjAyNi05NDQyMyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTEwLTIyVDE5OjA1OjM1LjM1MDAwMFoiLCJDVkUtMjAyNi03OTg3MiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTEwLTIyVDE5OjA1OjM1LjM1MDAwMFoiLCJDVkUtMjAyNi03OTg3MiJd>. Everything for agents: <https://agentprime.io/llms.txt>.