# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)](https://agentprime.io/advisories/CVE-2026-61738.md)
  `CVE-2026-61738` · CVE record: socfortress CoPilot · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal, Unrestricted file upload
- [ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin](https://agentprime.io/advisories/CVE-2026-61737.md)
  `CVE-2026-61737` · CVE record: huajian123 ng-antd-admin · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Hard-coded credentials
- [SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount](https://agentprime.io/advisories/CVE-2026-61730.md)
  `CVE-2026-61730` · CVE record: socfortress CoPilot · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure, Authentication bypass, Hard-coded credentials
- [SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection](https://agentprime.io/advisories/CVE-2026-61729.md)
  `CVE-2026-61729` · CVE record: socfortress CoPilot · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass, Hard-coded credentials
- [SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover](https://agentprime.io/advisories/CVE-2026-61728.md)
  `CVE-2026-61728` · CVE record: socfortress CoPilot · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site scripting (XSS), Information disclosure
- [Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft](https://agentprime.io/advisories/CVE-2026-112905.md)
  `CVE-2026-112905` · CVE record: givanz Vvveb · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover](https://agentprime.io/advisories/CVE-2026-110799.md)
  `CVE-2026-110799` · CVE record: givanz Vvveb · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key](https://agentprime.io/advisories/CVE-2026-119660.md)
  `CVE-2026-119660` · CVE record: yincongcyincong MuseBot · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-1394
- [OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery](https://agentprime.io/advisories/CVE-2026-119597.md)
  `CVE-2026-119597` · CVE record: AIDotNet OpenDeepWiki · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Hard-coded credentials
- [CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name](https://agentprime.io/advisories/CVE-2026-118994.md)
  `CVE-2026-118994` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Other injection
- [CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator](https://agentprime.io/advisories/CVE-2026-118995.md)
  `CVE-2026-118995` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-625
- [Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection](https://agentprime.io/advisories/CVE-2026-116127.md)
  `CVE-2026-116127` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: HTTP request smuggling
- [HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request](https://agentprime.io/advisories/CVE-2026-116130.md)
  `CVE-2026-116130` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-626
- [vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking](https://agentprime.io/advisories/CVE-2026-119568.md)
  `CVE-2026-119568` · CVE record: vsftpd vsftpd · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-940
- [CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation](https://agentprime.io/advisories/CVE-2026-119419.md)
  `CVE-2026-119419` · CVE record: cakephp cakephp · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()](https://agentprime.io/advisories/CVE-2026-119418.md)
  `CVE-2026-119418` · CVE record: cakephp cakephp · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [Unauthenticated RCE vulnerability against ClickHouse Server](https://agentprime.io/advisories/CVE-2026-116366.md)
  `CVE-2026-116366` · CVE record: ClickHouse ClickHouse and 1 more · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Memory corruption
- [Dahua Intelligent Connection Center command injection](https://agentprime.io/advisories/CVE-2025-31704.md)
  `CVE-2025-31704` · CVE record: Dahua Intelligent Connection Center · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection
- [Apache Fineract: SQL injection vulnerability in Search API](https://agentprime.io/advisories/CVE-2026-64618.md)
  `CVE-2026-64618` · CVE record: Apache Software Foundation Apache Fineract · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [API permission bypass via logic bug](https://agentprime.io/advisories/CVE-2026-82104.md)
  `CVE-2026-82104` · CVE record: Teltonika Networks RUT and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field](https://agentprime.io/advisories/CVE-2026-103039.md)
  `CVE-2026-103039` · CVE record: Gravity Forms Gravity Forms · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization
- [Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192](https://agentprime.io/advisories/CVE-2026-107249.md)
  `CVE-2026-107249` · CVE record: Drupal Block AJAX · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Ffmpeg Image Toolkit - Highly critical - Remote Code Execution - SA-CONTRIB-2026-220](https://agentprime.io/advisories/CVE-2026-114523.md)
  `CVE-2026-114523` · CVE record: Drupal Ffmpeg Image Toolkit · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection
- [GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB](https://agentprime.io/advisories/CVE-2026-74912.md)
  `CVE-2026-74912` · CVE record: Imagination Technologies Graphics DDK · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-823
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-119263.md)
  `CVE-2026-119263` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Memory corruption
- [Heap-based buffer overflow in Google Chrome](https://agentprime.io/advisories/CVE-2026-119261.md)
  `CVE-2026-119261` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Memory corruption
- [An issue was discovered in Keyfactor EJBCA 9.](https://agentprime.io/advisories/CVE-2025-49602.md)
  `CVE-2025-49602` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Deserialization of untrusted data in Veeam Management Pack for Microsoft System Center](https://agentprime.io/advisories/CVE-2023-22793.md)
  `CVE-2023-22793` · CVE record: Veeam Management Pack for Microsoft System Center · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt](https://agentprime.io/advisories/CVE-2026-115943.md)
  `CVE-2026-115943` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Code injection
- [SOCFortress CoPilot: Stored case-report template injection permits backend code execution](https://agentprime.io/advisories/CVE-2026-61707.md)
  `CVE-2026-61707` · CVE record: socfortress CoPilot · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Code injection, Broken access control
- [Docat has Arbitrary File Upload exists in Upload API](https://agentprime.io/advisories/CVE-2026-61645.md)
  `CVE-2026-61645` · CVE record: docat-org docat · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Unrestricted file upload
- [Sandbox Escape via Table Rotation in ServiceNow AI Platform](https://agentprime.io/advisories/CVE-2026-103093.md)
  `CVE-2026-103093` · CVE record: ServiceNow ServiceNow AI Platform · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Botan: Integer overflow when reporting block size in FFI can cause memory corruption](https://agentprime.io/advisories/CVE-2026-118769.md)
  `CVE-2026-118769` · CVE record: randombit botan · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Memory corruption, CWE-681
- [Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN](https://agentprime.io/advisories/CVE-2026-118762.md)
  `CVE-2026-118762` · CVE record: monkeytypegame monkeytype · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-829
- [Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload](https://agentprime.io/advisories/CVE-2026-119145.md)
  `CVE-2026-119145` · CVE record: frappe frappe · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal
- [ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie](https://agentprime.io/advisories/CVE-2026-119128.md)
  `CVE-2026-119128` · CVE record: zitadel zitadel · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-565
- [OS Command Injection in Progress WS_FTP Server](https://agentprime.io/advisories/CVE-2026-90868.md)
  `CVE-2026-90868` · CVE record: Progress Software WS_FTP Server · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Command injection
- [Virtual Folder Path Confinement Bypass in Progress WS_FTP Server](https://agentprime.io/advisories/CVE-2026-90866.md)
  `CVE-2026-90866` · CVE record: Progress Software WS_FTP Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal, Unrestricted file upload
- [Command Injection via FTP Notification Variables in Progress WS_FTP Server](https://agentprime.io/advisories/CVE-2026-90865.md)
  `CVE-2026-90865` · CVE record: Progress Software WS_FTP Server · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Command injection
- [Host Administrator Path Containment Bypass in Progress WS_FTP Server](https://agentprime.io/advisories/CVE-2026-90864.md)
  `CVE-2026-90864` · CVE record: Progress Software WS_FTP Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Path traversal, Unrestricted file upload
- [Privilege Escalation via Missing Authorization in WS_FTP Manager](https://agentprime.io/advisories/CVE-2026-90863.md)
  `CVE-2026-90863` · CVE record: Progress Software WS_FTP Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Improper Authentication in Progress WS_FTP Server](https://agentprime.io/advisories/CVE-2026-84295.md)
  `CVE-2026-84295` · CVE record: Progress Software WS_FTP Server · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Authentication bypass, Hard-coded credentials
- [Out-of-bounds write when parsing AR Vendor Block requests](https://agentprime.io/advisories/CVE-2026-111732.md)
  `CVE-2026-111732` · CVE record: RT-Labs P-Net · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Memory corruption
- [Logon bypass (trust of attacker-controlled completed-methods list)](https://agentprime.io/advisories/CVE-2026-112256.md)
  `CVE-2026-112256` · CVE record: OpenText Advanced Authentication Server · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-349
- [WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62131.md)
  `CVE-2026-62131` · CVE record: Zoho Flow Zoho Flow · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62018.md)
  `CVE-2026-62018` · CVE record: ThemeREX Gunslinger · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62017.md)
  `CVE-2026-62017` · CVE record: ThemeREX Good Homes · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62016.md)
  `CVE-2026-62016` · CVE record: ThemeREX Gamic · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62015.md)
  `CVE-2026-62015` · CVE record: ThemeREX Gamezone · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62014.md)
  `CVE-2026-62014` · CVE record: ThemeREX EmojiNation · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62013.md)
  `CVE-2026-62013` · CVE record: ThemeREX Edge Decor · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62012.md)
  `CVE-2026-62012` · CVE record: ThemeREX Coinpress · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62011.md)
  `CVE-2026-62011` · CVE record: ThemeREX Bonbon · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62010.md)
  `CVE-2026-62010` · CVE record: ThemeREX Avventure · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62009.md)
  `CVE-2026-62009` · CVE record: ThemeREX Filmax · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62008.md)
  `CVE-2026-62008` · CVE record: ThemeREX Orpheus · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62006.md)
  `CVE-2026-62006` · CVE record: ThemeREX Nuts · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62005.md)
  `CVE-2026-62005` · CVE record: ThemeREX Muzicon · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62004.md)
  `CVE-2026-62004` · CVE record: ThemeREX Motorix · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization
- [WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62003.md)
  `CVE-2026-62003` · CVE record: ThemeREX Mission · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Insecure deserialization

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTEwLTI5VDE1OjI0OjE1LjUzMzAwMFoiLCJDVkUtMjAyNi02MjAwMyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTEwLTMwVDE0OjU2OjM5LjM4MzAwMFoiLCJDVkUtMjAyNi05MzMyNyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTEwLTMwVDE0OjU2OjM5LjM4MzAwMFoiLCJDVkUtMjAyNi05MzMyNyJd>. Everything for agents: <https://agentprime.io/llms.txt>.