Critical CVEs
3,395 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-6847 |
9.3 |
0.0088
|
59.0% | 2026-07-13 | Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication | |
CVE-2026-63294 |
9.9 |
0.0088
|
59.0% | 2026-08-12 | A link following vulnerability in LXD allows an attacker to achieve root command execution | |
CVE-2026-54733 |
9.3 |
0.0088
|
58.9% | 2026-07-16 | The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure A | |
CVE-2026-8481 |
9.9 |
0.0088
|
58.9% | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerabili | |
CVE-2026-73268 |
9.9 |
0.0088
|
58.9% | 2026-08-12 | A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). | |
CVE-2026-84015 |
9.8 |
0.0087
|
58.8% | 2026-10-13 | Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows a | |
CVE-2026-106629 |
9.3 |
0.0087
|
58.8% | 2026-10-13 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability | |
CVE-2026-106630 |
9.3 |
0.0087
|
58.8% | 2026-10-13 | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability | |
CVE-2026-53805 |
9.3 |
0.0087
|
58.8% | 2026-06-17 | NVIDIA Spatial Intelligence Lab's (SIL) GEN3C contains an unauthenticated remote code exec | |
CVE-2026-8043 |
9.6 |
0.0087
|
58.7% | 2026-05-12 | External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote | |
CVE-2026-96113 |
9.8 |
0.0087
|
58.7% | 2026-10-13 | Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code o | |
CVE-2026-97815 |
9.8 |
0.0087
|
58.7% | 2026-10-13 | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to e | |
CVE-2026-40484 |
9.1 |
0.0087
|
58.6% | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the data | |
CVE-2026-65687 |
9.3 |
0.0087
|
58.6% | 2026-07-23 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validat | |
CVE-2026-65688 |
9.3 |
0.0087
|
58.6% | 2026-07-23 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validat | |
CVE-2026-65689 |
9.3 |
0.0087
|
58.6% | 2026-07-23 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validat | |
CVE-2026-38165 |
9.8 |
0.0087
|
58.6% | 2026-08-17 | A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine conf | |
CVE-2026-58630 |
10.0 |
0.0086
|
58.6% | 2026-07-24 | Improper access control in Azure App Service allows an unauthorized attacker to elevate pr | |
CVE-2026-62916 |
9.1 |
0.0086
|
58.6% | 2026-09-03 | Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an u | |
CVE-2026-70332 |
9.6 |
0.0086
|
58.5% | 2026-08-06 | Improper neutralization of input during web page generation ('cross-site scripting') in Mi | |
CVE-2026-48561 |
9.6 |
0.0086
|
58.5% | 2026-07-14 | Improper neutralization of special elements used in a command ('command injection') in Cop | |
CVE-2026-55008 |
9.6 |
0.0086
|
58.5% | 2026-07-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Mi | |
CVE-2026-49827 |
9.8 |
0.0086
|
58.5% | 2026-08-13 | WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. | |
CVE-2026-66309 |
9.1 |
0.0086
|
58.5% | 2026-08-20 | Improper access control in Azure SQL Database allows an authorized attacker to elevate pri | |
CVE-2026-10109 |
9.8 |
0.0086
|
58.4% | 2026-06-30 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code exec | |
CVE-2026-57624 |
10.0 |
0.0086
|
58.4% | 2026-07-02 | Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions. | |
CVE-2026-65553 |
10.0 |
0.0086
|
58.4% | 2026-08-06 | Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 | |
CVE-2026-16956 |
9.8 |
0.0086
|
58.4% | 2026-08-12 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary | |
CVE-2026-27544 |
10.0 |
0.0086
|
58.4% | 2026-08-13 | Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions. | |
CVE-2026-73343 |
10.0 |
0.0086
|
58.4% | 2026-08-18 | Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions. | |
CVE-2026-16882 |
9.8 |
0.0086
|
58.4% | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb | |
CVE-2026-48449 |
9.8 |
0.0086
|
58.4% | 2026-07-30 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that | |
CVE-2026-75827 |
9.3 |
0.0086
|
58.4% | 2026-08-18 | Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic | |
CVE-2026-71878 |
9.2 |
0.0086
|
58.4% | 2026-08-18 | Missing authentication in initial setup functionality left exposed after initial setup is | |
CVE-2026-71879 |
9.1 |
0.0086
|
58.4% | 2026-08-18 | Missing authentication in initial setup functionality left exposed until first reboot in G | |
CVE-2026-58231 |
10.0 |
0.0086
|
58.3% | 2026-08-11 | SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication cl | |
CVE-2026-40076 |
9.4 |
0.0085
|
58.2% | 2026-05-06 | OpenMRS Core is an open source electronic medical record system platform. In versions 2.7. | |
CVE-2026-107656 |
9.8 |
0.0085
|
58.1% | 2026-10-26 | An authentication bypass using an alternate path or channel vulnerability in Fortinet Fort | |
CVE-2026-12118 |
9.8 |
0.0085
|
58.0% | 2026-07-30 | IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote at | |
CVE-2026-44128 |
9.3 |
0.0085
|
58.0% | 2026-05-08 | SEPPmail Secure Email Gateway before version 15.0.2.1 allows unauthenticated remote code e | |
CVE-2026-13019 |
9.8 |
0.0085
|
58.0% | 2026-07-07 | Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a m | |
CVE-2026-67594 |
9.3 |
0.0085
|
58.0% | 2026-07-30 | Spikster through commit e1cdf8c contains a missing authentication vulnerability that allow | |
CVE-2026-75627 |
9.3 |
0.0084
|
57.9% | 2026-08-18 | Bastillion fails to properly validate request URI paths in its controller dispatcher, allo | |
CVE-2026-9135 |
9.9 |
0.0084
|
57.8% | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918 | |
CVE-2026-33819 |
9.8 |
0.0084
|
57.8% | 2026-04-23 | Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to exe | |
CVE-2026-69110 |
9.3 |
0.0084
|
57.8% | 2026-08-04 | OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows u | |
CVE-2026-42584 |
9.1 |
0.0084
|
57.7% | 2026-05-13 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Fina | |
CVE-2026-14453 |
9.6 |
0.0084
|
57.7% | 2026-07-13 | This vulnerability is a critical Server-Side Template Injection (SSTI) in Centreon's centr | |
CVE-2026-113672 |
9.9 |
0.0084
|
57.7% | 2026-10-20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 0.9.0 until | |
CVE-2026-9192 |
9.8 |
0.0083
|
57.6% | 2026-08-05 | An authentication bypass vulnerability in the ODBC App Server of Progress MarkLogic Server |