# Critical Advisories: what needs attention now.

A record is critical when any one of these three is true. It’s our own rule, applied the same way to every record, and each record says which of the three it meets. Withdrawn and retracted records are never critical.

- **KEV:** It’s in CISA’s KEV catalogue. CISA lists it as known to be exploited. Any record in the catalogue is critical, whatever its score.
- **CVSS 9+:** Its CVSS score is 9.0 or more. The base score from the record’s chosen CVSS: the CNA’s own first, then GitHub’s or OSV’s, then an ADP’s such as CISA’s.
- **CVSS 7+ and EPSS:** CVSS 7.0 or more, and EPSS 0.1 or more. A high score and at least a 10% estimated chance, from FIRST’s EPSS, of exploitation in the next 30 days.

Being critical doesn’t mean your app is affected; it means it’s worth checking now. Check a lockfile at <https://agentprime.io/check/>, or with the MCP tools `check_lockfile` and `check_packages`. RSS: <https://agentprime.io/advisories/critical/rss.xml>

## Records, newest first (an older page)

- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-121035.md)
  `CVE-2026-121035` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Memory corruption
- [Use after free in Google Chrome](https://agentprime.io/advisories/CVE-2026-121246.md)
  `CVE-2026-121246` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Memory corruption
- [Buffer overflow in Google Chrome](https://agentprime.io/advisories/CVE-2026-121229.md)
  `CVE-2026-121229` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Memory corruption
- [Heap-based buffer overflow in Google Chrome](https://agentprime.io/advisories/CVE-2026-121156.md)
  `CVE-2026-121156` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Memory corruption
- [Report Deserialization Code Execution](https://agentprime.io/advisories/CVE-2026-115731.md)
  `CVE-2026-115731` · CVE record: Perforce Puppet Enterprise · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Code injection, Insecure deserialization
- [Certificate Name Authorization Bypass](https://agentprime.io/advisories/CVE-2026-115732.md)
  `CVE-2026-115732` · CVE record: Perforce Puppet Enterprise · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control, CWE-697
- [node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound \`DefaultRolePermissions](https://agentprime.io/advisories/CVE-2026-95860.md)
  `CVE-2026-95860` · CVE record: node-opcua node-opcua · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control, CWE-636, CWE-1188
- [Use of Hardcoded Credentials in HPE Networking Fabric Composer Could Allow Adjacent Arbitrary Code Execution](https://agentprime.io/advisories/CVE-2026-95733.md)
  `CVE-2026-95733` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026
- [Authentication Bypass in HPE Networking Fabric Composer allows Arbitrary Code Execution](https://agentprime.io/advisories/CVE-2026-95732.md)
  `CVE-2026-95732` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026
- [Unauthenticated Hardcoded Password Vulnerabilities in HPE Networking Fabric Composer Command-Line Interface allow Unauthorized Administrative Access](https://agentprime.io/advisories/CVE-2026-95731.md)
  `CVE-2026-95731` · CVE record: Hewlett Packard Enterprise (HPE) Fabric Composer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026
- [fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator](https://agentprime.io/advisories/CVE-2026-63471.md)
  `CVE-2026-63471` · CVE record: koxudaxi fastapi-code-generator · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Code injection, CWE-116
- [fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict](https://agentprime.io/advisories/CVE-2026-63469.md)
  `CVE-2026-63469` · CVE record: koxudaxi fastapi-code-generator · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Code injection, CWE-116
- [fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring](https://agentprime.io/advisories/CVE-2026-63470.md)
  `CVE-2026-63470` · CVE record: koxudaxi fastapi-code-generator · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Code injection, CWE-116
- [Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall](https://agentprime.io/advisories/CVE-2026-112917.md)
  `CVE-2026-112917` · CVE record: Docker Docker Desktop · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-424
- [Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered \`.constructor\` member access](https://agentprime.io/advisories/GHSA-33r5-xmm8-v6x5.md)
  `GHSA-33r5-xmm8-v6x5`, `CVE-2026-44267` · npm `@enspirit/elo`: affected `<1.0.1`, fixed in `1.0.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Cross-site scripting (XSS), Code injection, CWE-693
- [Elo Ruby backend has Remote Code Execution via unescaped \`#{...}\` interpolation in emitted string literals and subtype-constraint labels](https://agentprime.io/advisories/GHSA-7w38-ggh5-v542.md)
  `GHSA-7w38-ggh5-v542`, `CVE-2026-44266` · npm `@enspirit/elo`: affected `<1.0.1`, fixed in `1.0.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Code injection, CWE-116
- [An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.](https://agentprime.io/advisories/CVE-2026-109593.md)
  `CVE-2026-109593` · CVE record: SonicWall Global Management System (GMS) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-636
- [SolarWinds Dameware Command Injection Vulnerability](https://agentprime.io/advisories/CVE-2026-28336.md)
  `CVE-2026-28336` · CVE record: SolarWinds Dameware · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-20
- [Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injection](https://agentprime.io/advisories/CVE-2026-121260.md)
  `CVE-2026-121260` · CVE record: Ziroom ZHOME A0101 · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Other injection, Code injection
- [Ivanti Connect Secure: Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and…](https://agentprime.io/advisories/CVE-2026-118527.md)
  `CVE-2026-118527` · CVE record: Ivanti Connect Secure · CVSS 4.3 Medium · Critical (KEV) · In CISA KEV · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-340
- [FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate](https://agentprime.io/advisories/CVE-2026-121392.md)
  `CVE-2026-121392` · CVE record: FreeRDP FreeRDP · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Weak cryptography or TLS
- [Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures](https://agentprime.io/advisories/CVE-2026-89292.md)
  `CVE-2026-89292` · CVE record: Eclipse Foundation Eclipse Mnestix · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Hard-coded credentials, Server-side request forgery (SSRF)
- [Default Administrator Password Change Not Enforced in Axxon One Web Client](https://agentprime.io/advisories/CVE-2026-121022.md)
  `CVE-2026-121022` · CVE record: AxxonSoft Axxon One · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-1393
- [Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)](https://agentprime.io/advisories/CVE-2026-4052.md)
  `CVE-2026-4052` · CVE record: WSO2 WSO2 API Manager and 2 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Improper Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-13594.md)
  `CVE-2026-13594` · CVE record: Zohocorp Log360 and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type](https://agentprime.io/advisories/CVE-2026-120534.md)
  `CVE-2026-120534` · CVE record: ACF Extended Advanced Custom Fields: Extended PRO · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Unrestricted file upload
- [BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler](https://agentprime.io/advisories/CVE-2026-120518.md)
  `CVE-2026-120518` · CVE record: kalengi BuddyPress XProfile Custom Image Field · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal
- [A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive.](https://agentprime.io/advisories/CVE-2026-38600.md)
  `CVE-2026-38600` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal
- [An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted filename to the /sync endpoint.](https://agentprime.io/advisories/CVE-2026-38595.md)
  `CVE-2026-38595` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Path traversal, Command injection
- [s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter](https://agentprime.io/advisories/CVE-2026-86596.md)
  `CVE-2026-86596` · CVE record: clavaque s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Code injection
- [Authentication bypass in Secure Access Servers](https://agentprime.io/advisories/CVE-2026-116769.md)
  `CVE-2026-116769` · CVE record: Absolute Security Secure Access · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026
- [CSRF in Secure Access Server v14.60](https://agentprime.io/advisories/CVE-2026-97718.md)
  `CVE-2026-97718` · CVE record: Absolute Security Secure Access · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026
- [Double free in Google Android](https://agentprime.io/advisories/CVE-2026-58968.md)
  `CVE-2026-58968` · CVE record: Google Android · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption
- [Use after free in Google Android](https://agentprime.io/advisories/CVE-2026-58936.md)
  `CVE-2026-58936` · CVE record: Google Android · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption
- [Use after free in Google Android](https://agentprime.io/advisories/CVE-2026-58876.md)
  `CVE-2026-58876` · CVE record: Google Android · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption
- [Out-of-bounds write in Google Android](https://agentprime.io/advisories/CVE-2026-58868.md)
  `CVE-2026-58868` · CVE record: Google Android · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption
- [Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field](https://agentprime.io/advisories/CVE-2026-102435.md)
  `CVE-2026-102435` · CVE record: themefic Ultra Addons for Contact Form 7 · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Insecure deserialization
- [Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8](https://agentprime.io/advisories/CVE-2026-105606.md)
  `CVE-2026-105606` · CVE record: joomlaboat.com Custom Tables extension for Joomla · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Unrestricted file upload
- [Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3](https://agentprime.io/advisories/CVE-2026-105604.md)
  `CVE-2026-105604` · CVE record: dj-extensions.com DJ-Classifieds extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: SQL injection
- [Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3](https://agentprime.io/advisories/CVE-2026-105603.md)
  `CVE-2026-105603` · CVE record: dj-extensions.com DJ-Classifieds extension for Joomla · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Unrestricted file upload
- [Template injection in the publishing component of awslabs Virtual Engineering Workbench](https://agentprime.io/advisories/CVE-2026-119085.md)
  `CVE-2026-119085` · CVE record: AWS virtual-engineering-workbench · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Code injection
- [Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy](https://agentprime.io/advisories/CVE-2026-88811.md)
  `CVE-2026-88811` · CVE record: SUSE Rancher · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Information disclosure
- [Privilege escalation to cluster-admin on the Rancher local cluster through Fleet's agent management controller](https://agentprime.io/advisories/CVE-2026-94290.md)
  `CVE-2026-94290` · CVE record: SUSE Rancher · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Privilege escalation
- [python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key](https://agentprime.io/advisories/CVE-2026-120459.md)
  `CVE-2026-120459` · CVE record: mpdavis python-jose · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Weak cryptography or TLS
- [HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code](https://agentprime.io/advisories/CVE-2026-120447.md)
  `CVE-2026-120447` · CVE record: bufanyun HotGo · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Authentication bypass
- [ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass](https://agentprime.io/advisories/CVE-2026-120442.md)
  `CVE-2026-120442` · CVE record: xianhc ape-volo-admin · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-1394
- [Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway](https://agentprime.io/advisories/CVE-2026-116606.md)
  `CVE-2026-116606` · CVE record: Barracuda Networks Barracuda Email Security Gateway (ESG) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Authentication bypass
- [@fastify/http-proxy vulnerable to prefix escape via decoded route parameters](https://agentprime.io/advisories/CVE-2026-120213.md)
  `CVE-2026-120213` · CVE record: @fastify/http-proxy @fastify/http-proxy · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Path traversal, CWE-436
- [Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions](https://agentprime.io/advisories/CVE-2025-11969.md)
  `CVE-2025-11969` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection](https://agentprime.io/advisories/CVE-2026-120345.md)
  `CVE-2026-120345` · CVE record: WAVLINK WN551X3-A · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Command injection
- [WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection](https://agentprime.io/advisories/CVE-2026-120344.md)
  `CVE-2026-120344` · CVE record: WAVLINK WN551X3-A · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Command injection
- [Termix-SSH Termix transferToHost path traversal](https://agentprime.io/advisories/CVE-2026-120322.md)
  `CVE-2026-120322` · CVE record: Termix-SSH Termix · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Path traversal
- [Linksys E8450 portal.cgi strcpy stack-based overflow](https://agentprime.io/advisories/CVE-2026-120283.md)
  `CVE-2026-120283` · CVE record: Linksys E8450 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption
- [WAVLINK WN536AX6-A protocol.csp host_black os command injection](https://agentprime.io/advisories/CVE-2026-120282.md)
  `CVE-2026-120282` · CVE record: WAVLINK WN536AX6-A · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Command injection
- [WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow](https://agentprime.io/advisories/CVE-2026-120281.md)
  `CVE-2026-120281` · CVE record: WAVLINK WN536AX6-A · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption
- [WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection](https://agentprime.io/advisories/CVE-2026-120280.md)
  `CVE-2026-120280` · CVE record: WAVLINK WN536AX6-A · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Command injection
- [WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection](https://agentprime.io/advisories/CVE-2026-120279.md)
  `CVE-2026-120279` · CVE record: WAVLINK WN536AX6-A · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Command injection
- [A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_registrar_pcscf module.](https://agentprime.io/advisories/CVE-2026-106803.md)
  `CVE-2026-106803` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption
- [WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection](https://agentprime.io/advisories/CVE-2026-120277.md)
  `CVE-2026-120277` · CVE record: WAVLINK WN536AX6-A · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection
- [WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection](https://agentprime.io/advisories/CVE-2026-120276.md)
  `CVE-2026-120276` · CVE record: WAVLINK WN536AX6-A · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Command injection

Newest: <https://agentprime.io/advisories/critical.md>
Older: <https://agentprime.io/advisories/critical.md?cursor=WyIyMDI2LTExLTAxVDIzOjE1OjEyLjMzNTAwMFoiLCJDVkUtMjAyNi0xMjAyNzYiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?critical=true&cursor=WyIyMDI2LTExLTAzVDIwOjQyOjIyLjI1MTAwMFoiLCJDVkUtMjAyNi0xMjEyNDciXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/critical/?cursor=WyIyMDI2LTExLTAzVDIwOjQyOjIyLjI1MTAwMFoiLCJDVkUtMjAyNi0xMjEyNDciXQ>. Everything for agents: <https://agentprime.io/llms.txt>.