# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection](https://agentprime.io/advisories/CVE-2026-120240.md)
  `CVE-2026-120240` · CVE record: WAVLINK WN553X1-B · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection
- [WAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection](https://agentprime.io/advisories/CVE-2026-120239.md)
  `CVE-2026-120239` · CVE record: WAVLINK WN553X1-B · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection
- [WAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injection](https://agentprime.io/advisories/CVE-2026-120238.md)
  `CVE-2026-120238` · CVE record: WAVLINK WN553X1-B · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection
- [Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials](https://agentprime.io/advisories/CVE-2026-74759.md)
  `CVE-2026-74759` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Server-side request forgery (SSRF)
- [WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-62048.md)
  `CVE-2026-62048` · CVE record: Liquid Web / StellarWP BookIt · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: SQL injection
- [Prefab UI Pyodide sandbox escape to host RCE](https://agentprime.io/advisories/CVE-2026-120338.md)
  `CVE-2026-120338` · CVE record: PrefectHQ prefab-ui · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Code injection, Privilege escalation, CWE-693
- [Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruption](https://agentprime.io/advisories/CVE-2026-120232.md)
  `CVE-2026-120232` · CVE record: Horizon DataSys Reboot Restore Standard · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Memory corruption
- [WAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection](https://agentprime.io/advisories/CVE-2026-120231.md)
  `CVE-2026-120231` · CVE record: WAVLINK WN553X1-B · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection
- [WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection](https://agentprime.io/advisories/CVE-2026-120230.md)
  `CVE-2026-120230` · CVE record: WAVLINK WN701AE · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection
- [WAVLINK WN553X1-B ioos sub_416B50 os command injection](https://agentprime.io/advisories/CVE-2026-120229.md)
  `CVE-2026-120229` · CVE record: WAVLINK WN553X1-B · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection
- [WAVLINK WN553X1-B ioos Service sub_416D88 os command injection](https://agentprime.io/advisories/CVE-2026-120228.md)
  `CVE-2026-120228` · CVE record: WAVLINK WN553X1-B · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection
- [Beta9 host filesystem exposure via volume path traversal](https://agentprime.io/advisories/CVE-2026-120308.md)
  `CVE-2026-120308` · CVE record: beam-cloud Beta9 gateway and 1 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Path traversal, Information disclosure
- [Beta9 container escape via unvalidated sandbox file paths](https://agentprime.io/advisories/CVE-2026-120307.md)
  `CVE-2026-120307` · CVE record: beam-cloud Beta9 worker · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Path traversal
- [Beta9 build sandbox escape via chroot-only isolation](https://agentprime.io/advisories/CVE-2026-120306.md)
  `CVE-2026-120306` · CVE record: beam-cloud Beta9 worker · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Privilege escalation, CWE-653
- [WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection](https://agentprime.io/advisories/CVE-2026-120227.md)
  `CVE-2026-120227` · CVE record: WAVLINK WN701AE · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection
- [Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversal](https://agentprime.io/advisories/CVE-2026-120225.md)
  `CVE-2026-120225` · CVE record: Oray Pugongying X5 Pro · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Path traversal
- [Oray Pugongying X5 Pro API Authorization run_async_task improper authorization](https://agentprime.io/advisories/CVE-2026-120224.md)
  `CVE-2026-120224` · CVE record: Oray Pugongying X5 Pro · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Privilege escalation, Broken access control
- [Gitea public-only package token access to private OCI blobs](https://agentprime.io/advisories/CVE-2026-117685.md)
  `CVE-2026-117685` · CVE record: Gitea Gitea · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Gitea public-only token bypass through Actions runner registration](https://agentprime.io/advisories/CVE-2026-116289.md)
  `CVE-2026-116289` · CVE record: Gitea Gitea · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Gitea OAuth2 account auto-linking takeover through the sign-up form](https://agentprime.io/advisories/CVE-2026-120263.md)
  `CVE-2026-120263` · CVE record: Gitea Gitea · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Authentication bypass, Broken access control
- [WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection](https://agentprime.io/advisories/CVE-2026-120198.md)
  `CVE-2026-120198` · CVE record: WAVLINK WL-WN530BE1-A · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Other injection, Command injection
- [WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection](https://agentprime.io/advisories/CVE-2026-120197.md)
  `CVE-2026-120197` · CVE record: WAVLINK WL-WN530HG4B · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection
- [WAVLINK WN579X3-D wapi.cgi port_forward os command injection](https://agentprime.io/advisories/CVE-2026-120196.md)
  `CVE-2026-120196` · CVE record: WAVLINK WN579X3-D · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection
- [WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection](https://agentprime.io/advisories/CVE-2026-120195.md)
  `CVE-2026-120195` · CVE record: WAVLINK WL-WN579A3-A · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection
- [D-Link DIR-505 TFTP Upload Filename tftpd mp_upload_file stack-based overflow](https://agentprime.io/advisories/CVE-2026-120189.md)
  `CVE-2026-120189` · CVE record: D-Link DIR-505 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Memory corruption
- [Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder](https://agentprime.io/advisories/CVE-2026-118636.md)
  `CVE-2026-118636` · CVE record: Apache Software Foundation Apache MINA · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2026 · Tags: Insecure deserialization
- [AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token](https://agentprime.io/advisories/CVE-2026-120209.md)
  `CVE-2026-120209` · CVE record: anji-plus AJ-Report · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2026 · Tags: Hard-coded credentials
- [Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header](https://agentprime.io/advisories/CVE-2026-120201.md)
  `CVE-2026-120201` · CVE record: dromara Jpom · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2026 · Tags: Other injection
- [WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages](https://agentprime.io/advisories/CVE-2026-78191.md)
  `CVE-2026-78191` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2026 · Tags: CWE-777
- [WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback](https://agentprime.io/advisories/CVE-2026-78189.md)
  `CVE-2026-78189` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2026 · Tags: Path traversal
- [Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter](https://agentprime.io/advisories/CVE-2026-103882.md)
  `CVE-2026-103882` · CVE record: acadlix Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2026 · Tags: Path traversal
- [SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data](https://agentprime.io/advisories/CVE-2026-118235.md)
  `CVE-2026-118235` · CVE record: wpazleen SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2026 · Tags: Unrestricted file upload
- [Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection](https://agentprime.io/advisories/CVE-2026-116512.md)
  `CVE-2026-116512` · CVE record: wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2026 · Tags: Unrestricted file upload
- [Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter](https://agentprime.io/advisories/CVE-2026-119096.md)
  `CVE-2026-119096` · CVE record: uncannyowl Uncanny Toolkit for LearnDash · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2026 · Tags: Authentication bypass
- [WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action](https://agentprime.io/advisories/CVE-2026-116557.md)
  `CVE-2026-116557` · CVE record: murgroland WP Booking System – Booking Calendar · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2026 · Tags: Broken access control
- [PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field](https://agentprime.io/advisories/CVE-2026-109220.md)
  `CVE-2026-109220` · CVE record: addonsorg PDF Invoice for WooCommerce + Drag and Drop Template Builder · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2026 · Tags: Insecure deserialization
- [Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters](https://agentprime.io/advisories/CVE-2026-89270.md)
  `CVE-2026-89270` · CVE record: popupbuilder Popup Builder – Create highly converting, mobile friendly marketing popups. · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2026 · Tags: Broken access control
- [WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution](https://agentprime.io/advisories/CVE-2026-119977.md)
  `CVE-2026-119977` · CVE record: WordPress Foundation WordPress · CVSS 8.1 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 31 Oct 2026 · Tags: Race condition
- [Unverified Sign in with Apple callback parameter can override verified ID token claims](https://agentprime.io/advisories/GHSA-9fr5-g44g-9526.md)
  `GHSA-9fr5-g44g-9526`, `CVE-2026-117656`, `EEF-CVE-2026-117656` · Hex `assent`: affected `>=0.1.25, <0.3.2`, fixed in `0.3.2` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass, CWE-349
- [Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution](https://agentprime.io/advisories/GHSA-4xm8-rg9h-jhq2.md)
  `GHSA-4xm8-rg9h-jhq2` · npm `@signalk/resources-provider` and 1 more: affected `>=1.0.0, <1.5.3`, fixed in `1.5.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Path traversal
- [imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution](https://agentprime.io/advisories/GHSA-hff9-5pqw-6w9f.md)
  `GHSA-hff9-5pqw-6w9f`, `GO-2026-6897` · Go `github.com/imgproxy/imgproxy` and 2 more: affected `>=4.0.0, <4.0.16`, fixed in `4.0.16` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Memory corruption
- [TAKO AI Agent for Okta: Unauthenticated first-run administrator takeover](https://agentprime.io/advisories/CVE-2026-63377.md)
  `CVE-2026-63377` · CVE record: fctr-id okta-ai-agent · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [MoLing: unauthenticated SSE and wildcard CORS expose tool sessions](https://agentprime.io/advisories/CVE-2026-62863.md)
  `CVE-2026-62863` · CVE record: gojue moling · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass, CWE-942
- [ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection](https://agentprime.io/advisories/CVE-2026-62849.md)
  `CVE-2026-62849` · CVE record: mqttsnet thinglinks · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks](https://agentprime.io/advisories/CVE-2026-62853.md)
  `CVE-2026-62853` · CVE record: mqttsnet thinglinks · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection, Code injection
- [ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary](https://agentprime.io/advisories/GHSA-7gw2-hphm-c5px.md)
  `GHSA-7gw2-hphm-c5px`, `CVE-2026-117666`, `EEF-CVE-2026-117666` · Hex `ssl_verify_fun`: affected `>=1.0.1, <1.1.8`, fixed in `1.1.8` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Weak cryptography or TLS
- [HoneySQL unchecked entity names can lead to SQL injection results](https://agentprime.io/advisories/CVE-2026-61620.md)
  `CVE-2026-61620` · CVE record: seancorfield honeysql · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier](https://agentprime.io/advisories/CVE-2026-116241.md)
  `CVE-2026-116241` · CVE record: pgadmin.org pgAdmin 4 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Command injection, CWE-115
- [pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks](https://agentprime.io/advisories/CVE-2026-116238.md)
  `CVE-2026-116238` · CVE record: pgadmin.org pgAdmin 4 · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Force](https://agentprime.io/advisories/CVE-2026-115829.md)
  `CVE-2026-115829` · CVE record: Delinea Secret Server (On-Prem) · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass
- [Secret Server device validation error](https://agentprime.io/advisories/CVE-2026-115828.md)
  `CVE-2026-115828` · CVE record: Delinea Secret Server (On-Prem) · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Kargo: Privilege escalation via Project RBAC management in the Kargo API](https://agentprime.io/advisories/CVE-2026-61850.md)
  `CVE-2026-61850` · CVE record: akuity kargo · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Privilege escalation
- [PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)](https://agentprime.io/advisories/CVE-2026-55598.md)
  `CVE-2026-55598` · CVE record: madeofpendletonwool PinePods · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Server-side request forgery (SSRF)
- [Unauthenticated Stack Buffer Overflow in Sentinel Keys Server](https://agentprime.io/advisories/CVE-2026-78403.md)
  `CVE-2026-78403` · CVE record: Thalesgroup Sentinel Keys Server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Memory corruption, Broken access control
- [WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability](https://agentprime.io/advisories/CVE-2026-116852.md)
  `CVE-2026-116852` · CVE record: Marketing Fire Widget Options · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Code injection
- [WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-116386.md)
  `CVE-2026-116386` · CVE record: Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Privilege escalation
- [WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-90888.md)
  `CVE-2026-90888` · CVE record: leadsnap LeadSnap · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization
- [WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39738.md)
  `CVE-2026-39738` · CVE record: Aman FunnelKit Automations · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization
- [WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability](https://agentprime.io/advisories/CVE-2026-39732.md)
  `CVE-2026-39732` · CVE record: Ivijan-Stefan Stipic Transliterator · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: SQL injection
- [WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability](https://agentprime.io/advisories/CVE-2026-119526.md)
  `CVE-2026-119526` · CVE record: ThemeREX Royal Event · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Insecure deserialization

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTEwLTMwVDE4OjMwOjMxLjE1MzAwMFoiLCJDVkUtMjAyNi0xMTk1MjYiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTExLTAxVDIzOjE1OjEyLjMzNTAwMFoiLCJDVkUtMjAyNi0xMjAyNzYiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTExLTAxVDIzOjE1OjEyLjMzNTAwMFoiLCJDVkUtMjAyNi0xMjAyNzYiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.