Critical CVEs
3,400 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-16894 |
9.8 |
0.0080
|
56.6% | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb | |
CVE-2026-16913 |
9.8 |
0.0080
|
56.6% | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb | |
CVE-2026-17040 |
9.8 |
0.0080
|
56.6% | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb | |
CVE-2026-17122 |
9.8 |
0.0080
|
56.6% | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb | |
CVE-2026-17141 |
9.8 |
0.0080
|
56.6% | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb | |
CVE-2026-17152 |
9.8 |
0.0080
|
56.6% | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb | |
CVE-2026-17157 |
9.8 |
0.0080
|
56.6% | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb | |
CVE-2026-34048 |
9.9 |
0.0080
|
56.4% | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-64878 |
9.4 |
0.0080
|
56.4% | 2026-07-21 | Unvalidated input in asset filter parameters allows shell metacharacters to escape command | |
CVE-2026-63508 |
10.0 |
0.0080
|
56.4% | 2026-08-06 | Missing authentication for critical function in Microsoft Planetary Computer Pro allows an | |
CVE-2026-65667 |
10.0 |
0.0080
|
56.4% | 2026-08-06 | Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privil | |
CVE-2026-69502 |
10.0 |
0.0080
|
56.4% | 2026-08-21 | Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker t | |
CVE-2026-69555 |
10.0 |
0.0080
|
56.4% | 2026-08-20 | Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges | |
CVE-2026-69865 |
10.0 |
0.0080
|
56.4% | 2026-09-17 | Authorization bypass through user-controlled key in Microsoft Container Registry allows an | |
CVE-2026-63455 |
9.8 |
0.0080
|
56.4% | 2026-08-04 | Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator c | |
CVE-2026-63456 |
9.8 |
0.0080
|
56.4% | 2026-08-04 | Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator c | |
CVE-2026-17218 |
9.8 |
0.0080
|
56.3% | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due t | |
CVE-2026-16840 |
9.8 |
0.0080
|
56.3% | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb | |
CVE-2026-16917 |
9.8 |
0.0080
|
56.3% | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb | |
CVE-2026-16919 |
9.8 |
0.0080
|
56.3% | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb | |
CVE-2026-17118 |
9.8 |
0.0080
|
56.3% | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb | |
CVE-2026-17136 |
9.8 |
0.0080
|
56.3% | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb | |
CVE-2026-17160 |
9.8 |
0.0080
|
56.3% | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb | |
CVE-2026-15068 |
9.9 |
0.0079
|
56.3% | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authenticated attac | |
CVE-2026-16816 |
9.9 |
0.0079
|
56.3% | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker | |
CVE-2026-18835 |
9.9 |
0.0079
|
56.3% | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker | |
CVE-2026-46456 |
9.8 |
0.0079
|
56.2% | 2026-07-06 | Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aw | |
CVE-2026-9659 |
9.1 |
0.0079
|
56.2% | 2026-10-20 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilt | |
CVE-2026-65605 |
9.4 |
0.0079
|
56.2% | 2026-07-23 | SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute Vie | |
CVE-2026-56160 |
9.1 |
0.0079
|
56.2% | 2026-07-23 | Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to e | |
CVE-2026-72593 |
9.8 |
0.0079
|
56.2% | 2026-08-10 | A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthent | |
CVE-2026-54823 |
9.9 |
0.0079
|
56.1% | 2026-06-25 | Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions. | |
CVE-2026-59543 |
9.9 |
0.0079
|
56.1% | 2026-07-23 | Subscriber Remote Code Execution (RCE) in Advanced Views <= 3.8.11 versions. | |
CVE-2026-65548 |
9.9 |
0.0079
|
56.1% | 2026-08-06 | Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions. | |
CVE-2026-72567 |
9.8 |
0.0079
|
56.1% | 2026-08-10 | An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f3 | |
CVE-2026-32444 |
9.9 |
0.0079
|
56.1% | 2026-08-18 | Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions. | |
CVE-2026-87701 |
9.6 |
0.0079
|
56.2% | 2026-09-17 | Improper neutralization of special elements in output used by a downstream component ('inj | |
CVE-2026-60112 |
9.3 |
0.0079
|
56.1% | 2026-07-29 | AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerab | |
CVE-2026-7524 |
9.8 |
0.0079
|
56.0% | 2026-05-27 | IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper val | |
CVE-2026-28302 |
9.1 |
0.0079
|
56.0% | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability | |
CVE-2026-28304 |
9.1 |
0.0079
|
56.0% | 2026-07-21 | SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploite | |
CVE-2026-28305 |
9.1 |
0.0079
|
56.0% | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability | |
CVE-2026-28308 |
9.1 |
0.0079
|
56.0% | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability | |
CVE-2026-54680 |
9.9 |
0.0078
|
56.0% | 2026-07-29 | Logging operator automates the deployment and configuration of Kubernetes logging pipeline | |
CVE-2026-48381 |
9.0 |
0.0078
|
56.0% | 2026-08-11 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements | |
CVE-2026-8979 |
9.3 |
0.0078
|
56.0% | 2026-05-28 | The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to an authentication | |
CVE-2026-48853 |
9.2 |
0.0078
|
56.0% | 2026-06-15 | Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling | |
CVE-2026-63382 |
9.2 |
0.0078
|
56.0% | 2026-08-20 | Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent e | |
CVE-2026-48519 |
9.6 |
0.0078
|
55.9% | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1. | |
CVE-2026-64606 |
9.8 |
0.0078
|
55.9% | 2026-07-21 | Deserialization of untrusted data vulnerability that may allow class-registration checks t |