Critical CVEs
3,395 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-60113 |
9.3 |
0.0083
|
57.5% | 2026-07-29 | AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a | |
CVE-2025-49794 |
9.1 |
0.0083
|
57.6% | 2025-06-16 | A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath | |
CVE-2026-57308 |
9.8 |
0.0083
|
57.5% | 2026-07-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-50516 |
9.4 |
0.0083
|
57.5% | 2026-08-11 | Incorrect authorization in Microsoft Azure Kubernetes Service allows an authorized attacke | |
CVE-2026-64827 |
9.3 |
0.0083
|
57.5% | 2026-08-03 | Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, | |
CVE-2026-103780 |
9.8 |
0.0083
|
57.5% | 2026-10-28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 relea | |
CVE-2026-46454 |
9.8 |
0.0083
|
57.4% | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-comet | |
CVE-2026-61514 |
9.3 |
0.0083
|
57.3% | 2026-08-04 | Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulne | |
CVE-2026-70552 |
9.3 |
0.0083
|
57.3% | 2026-08-04 | MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX | |
CVE-2026-73602 |
9.0 |
0.0083
|
57.3% | 2026-08-13 | Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox | |
CVE-2026-47367 |
9.9 |
0.0083
|
57.3% | 2026-06-12 | A malicious actor with access to the network and low privileges could exploit an Improper | |
CVE-2026-90532 |
10.0 |
0.0083
|
57.3% | 2026-10-13 | Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that coul | |
CVE-2026-16634 |
9.8 |
0.0082
|
57.3% | 2026-07-24 | TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tom | |
CVE-2026-3490 |
10.0 |
0.0082
|
57.2% | 2026-06-17 | picklescan before 1.0.4 fails to block pkgutil.resolve_name, allowing attackers to bypass | |
CVE-2026-66915 |
10.0 |
0.0082
|
57.3% | 2026-08-10 | Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthentic | |
CVE-2026-66709 |
9.1 |
0.0082
|
57.2% | 2026-08-06 | Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions. | |
CVE-2026-50481 |
9.9 |
0.0082
|
57.2% | 2026-08-06 | Modification of assumed-immutable data (maid) in Azure Active Directory allows an authoriz | |
CVE-2026-69259 |
9.4 |
0.0082
|
57.2% | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. P | |
CVE-2026-10561 |
10.0 |
0.0082
|
57.2% | 2026-06-22 | IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of | |
CVE-2026-5788 |
9.8 |
0.0082
|
57.1% | 2026-05-07 | An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 | |
CVE-2026-70558 |
9.3 |
0.0082
|
57.1% | 2026-08-06 | Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path paramet | |
CVE-2026-50380 |
9.6 |
0.0082
|
57.1% | 2026-07-14 | Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code | |
CVE-2026-54990 |
9.8 |
0.0082
|
57.1% | 2026-07-14 | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to exe | |
CVE-2026-83869 |
9.8 |
0.0082
|
57.1% | 2026-10-13 | Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to ex | |
CVE-2026-45618 |
10.0 |
0.0082
|
57.1% | 2026-08-11 | LiquidJS is a Shopify/GitHub Pages compatible template engine. Prior to version 10.26.0, i | |
CVE-2026-79847 |
10.0 |
0.0082
|
57.1% | 2026-10-22 | Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthen | |
CVE-2026-102238 |
9.6 |
0.0082
|
57.0% | 2026-10-13 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual S | |
CVE-2026-24270 |
9.8 |
0.0081
|
56.9% | 2026-07-01 | NVIDIA AIStore framework contains a vulnerability where an attacker could bypass authentic | |
CVE-2026-70477 |
9.5 |
0.0081
|
56.9% | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. P | |
CVE-2023-24482 |
9.8 |
0.0081
|
56.9% | 2023-02-14 | A vulnerability has been identified in COMOS V10.2 (All versions), COMOS V10.3.3.1 (All ve | |
CVE-2024-11080 |
9.8 |
0.0081
|
56.9% | 2026-09-05 | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Una | |
CVE-2026-11756 |
10.0 |
0.0081
|
56.9% | 2026-07-28 | A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPE | |
CVE-2026-65883 |
10.0 |
0.0081
|
56.9% | 2026-07-29 | Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less | |
CVE-2026-17061 |
10.0 |
0.0081
|
56.9% | 2026-08-11 | A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from | |
CVE-2026-59940 |
9.8 |
0.0081
|
56.9% | 2026-08-18 | Seroval facilitates JS value stringification, including complex structures beyond JSON.str | |
CVE-2026-72508 |
9.9 |
0.0081
|
56.8% | 2026-08-12 | A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cl | |
CVE-2026-57571 |
9.6 |
0.0081
|
56.8% | 2026-07-06 | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the | |
CVE-2026-61486 |
9.8 |
0.0081
|
56.7% | 2026-08-05 | ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. | |
CVE-2026-35019 |
9.2 |
0.0081
|
56.7% | 2026-06-23 | NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication byp | |
CVE-2026-64608 |
9.8 |
0.0081
|
56.7% | 2026-07-21 | Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. Wh | |
CVE-2026-61484 |
9.8 |
0.0081
|
56.7% | 2026-08-05 | ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache | |
CVE-2026-58466 |
9.3 |
0.0080
|
56.7% | 2026-07-02 | AutoBangumi before 3.2.8 contains a hard-coded default credentials vulnerability that allo | |
CVE-2026-72592 |
9.8 |
0.0080
|
56.6% | 2026-08-10 | An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauth | |
CVE-2026-13716 |
9.1 |
0.0080
|
56.5% | 2026-08-11 | Path traversal in server import and admin file upload in Crafty Controller. Allows a remot | |
CVE-2026-17083 |
9.8 |
0.0080
|
56.6% | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due t | |
CVE-2026-16845 |
9.8 |
0.0080
|
56.6% | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb | |
CVE-2026-16862 |
9.8 |
0.0080
|
56.6% | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb | |
CVE-2026-16864 |
9.8 |
0.0080
|
56.6% | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb | |
CVE-2026-16872 |
9.8 |
0.0080
|
56.6% | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb | |
CVE-2026-16885 |
9.8 |
0.0080
|
56.6% | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb |