Critical CVEs
3,394 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-14512 |
9.8 |
0.0097
|
61.8% | 2026-07-28 | IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authenticat | |
CVE-2026-69705 |
9.8 |
0.0097
|
61.8% | 2026-10-13 | Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over | |
CVE-2026-67614 |
9.3 |
0.0096
|
61.6% | 2026-08-13 | CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal | |
CVE-2026-57517 |
9.3 |
0.0096
|
61.6% | 2026-07-01 | Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allo | |
CVE-2026-67191 |
9.3 |
0.0096
|
61.6% | 2026-07-29 | Xlight FTP Server before 3.9.5 contains a pre-authentication heap buffer overflow vulnerab | |
CVE-2026-73487 |
9.0 |
0.0096
|
61.5% | 2026-08-13 | Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV and Airtab | |
CVE-2026-54120 |
9.9 |
0.0096
|
61.4% | 2026-07-23 | Improper input validation in Microsoft Surface allows an authorized attacker to execute co | |
CVE-2026-70024 |
9.8 |
0.0096
|
61.4% | 2026-10-13 | Stack-based buffer overflow in Windows Internet Information Services allows an unauthorize | |
CVE-2026-8634 |
9.3 |
0.0095
|
61.3% | 2026-05-14 | Crabbox prior to v0.12.0 contains an environment variable exposure vulnerability that allo | |
CVE-2026-57878 |
9.8 |
0.0095
|
61.3% | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in thttpd in GeoVision | |
CVE-2026-58115 |
10.0 |
0.0095
|
61.3% | 2026-08-11 | A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All | |
CVE-2026-69634 |
9.8 |
0.0095
|
61.1% | 2026-10-13 | Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute cod | |
CVE-2026-69639 |
9.8 |
0.0095
|
61.1% | 2026-10-13 | Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execut | |
CVE-2026-69883 |
9.8 |
0.0095
|
61.1% | 2026-10-13 | Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a net | |
CVE-2026-69886 |
9.8 |
0.0095
|
61.1% | 2026-10-13 | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to | |
CVE-2026-83523 |
9.8 |
0.0095
|
61.1% | 2026-10-13 | Heap-based buffer overflow in Windows Image Acquisition allows an unauthorized attacker to | |
CVE-2023-34844 |
9.8 |
0.0095
|
61.1% | 2023-06-29 | Play With Docker < 0.0.2 has an insecure CAP_SYS_ADMIN privileged mode causing the docker | |
CVE-2026-48331 |
10.0 |
0.0095
|
61.0% | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerabi | |
CVE-2026-48333 |
9.8 |
0.0095
|
61.0% | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that | |
CVE-2026-57879 |
9.8 |
0.0095
|
61.0% | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision G | |
CVE-2026-57880 |
9.8 |
0.0095
|
61.0% | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in ssvr in GeoVision G | |
CVE-2026-112403 |
9.2 |
0.0095
|
61.0% | 2026-10-19 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a ful | |
CVE-2026-12940 |
9.8 |
0.0094
|
61.0% | 2026-07-30 | IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execu | |
CVE-2026-48317 |
9.6 |
0.0094
|
60.9% | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Directives in Dy | |
CVE-2026-42097 |
9.3 |
0.0094
|
60.9% | 2026-05-19 | Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omi | |
CVE-2023-29542 |
9.8 |
0.0094
|
60.9% | 2023-06-19 | A newline in a filename could have been used to bypass the file extension security mechani | |
CVE-2026-57572 |
10.0 |
0.0094
|
60.8% | 2026-07-06 | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docke | |
CVE-2026-69400 |
9.6 |
0.0094
|
60.8% | 2026-08-20 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Lo | |
CVE-2026-96934 |
9.8 |
0.0094
|
60.8% | 2026-10-13 | Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over | |
CVE-2026-3960 |
9.8 |
0.0094
|
60.8% | 2026-04-23 | A critical remote code execution vulnerability exists in the unauthenticated REST API endp | |
CVE-2026-70188 |
9.1 |
0.0094
|
60.8% | 2026-10-13 | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NE | |
CVE-2026-13368 |
9.2 |
0.0094
|
60.7% | 2026-07-03 | WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability | |
CVE-2026-88092 |
9.4 |
0.0093
|
60.7% | 2026-10-13 | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NE | |
CVE-2026-35428 |
9.6 |
0.0093
|
60.6% | 2026-05-07 | Improper neutralization of special elements used in a command ('command injection') in Azu | |
CVE-2026-83748 |
9.8 |
0.0093
|
60.6% | 2026-10-13 | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to e | |
CVE-2026-68823 |
9.1 |
0.0093
|
60.6% | 2026-08-06 | Exposed dangerous method or function in Azure Confidential Ledger allows an authorized att | |
CVE-2023-34416 |
9.8 |
0.0093
|
60.5% | 2023-06-19 | Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Som | |
CVE-2026-20160 |
9.8 |
0.0093
|
60.5% | 2026-04-01 | A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unaut | |
CVE-2026-34106 |
9.3 |
0.0093
|
60.5% | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in su | |
CVE-2026-34107 |
9.3 |
0.0093
|
60.5% | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in tr | |
CVE-2026-34108 |
9.3 |
0.0093
|
60.5% | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in te | |
CVE-2026-34109 |
9.3 |
0.0093
|
60.5% | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in sp | |
CVE-2026-34110 |
9.3 |
0.0093
|
60.5% | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in co | |
CVE-2026-34111 |
9.3 |
0.0093
|
60.5% | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in sp | |
CVE-2026-34112 |
9.3 |
0.0093
|
60.5% | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in sp | |
CVE-2026-34113 |
9.3 |
0.0093
|
60.5% | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in sp | |
CVE-2026-34114 |
9.3 |
0.0093
|
60.5% | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in tr | |
CVE-2026-34115 |
9.3 |
0.0093
|
60.5% | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in tr | |
CVE-2026-34116 |
9.3 |
0.0093
|
60.5% | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in tr | |
CVE-2026-34117 |
9.3 |
0.0093
|
60.5% | 2026-07-01 | Guardian language-system passes the id GET parameter directly into a PHP exec() call in te |