Critical CVEs
3,497 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2023-2186 |
9.8 |
0.0071
|
53.4% | 2023-06-07 | On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacke | |
CVE-2026-50628 |
9.8 |
0.0071
|
53.3% | 2026-06-12 | A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound | |
CVE-2026-71207 |
9.8 |
0.0071
|
53.3% | 2026-08-05 | The Stock-Inventory-Management-System application's login.php assigns raw username/passwor | |
CVE-2026-72526 |
9.9 |
0.0070
|
53.3% | 2026-08-12 | A flaw was found in the multicloud-integrations component. The Application propagation con | |
CVE-2026-48055 |
10.0 |
0.0070
|
53.3% | 2026-06-17 | Streambert is a cross-platform Electron Desktop App to stream and download any video media | |
CVE-2026-13014 |
9.2 |
0.0070
|
53.3% | 2026-07-13 | A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unaut | |
CVE-2026-8457 |
9.8 |
0.0070
|
53.3% | 2026-08-02 | The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass | |
CVE-2026-111183 |
9.8 |
0.0070
|
53.3% | 2026-10-21 | GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This | |
CVE-2026-79848 |
10.0 |
0.0070
|
53.3% | 2026-10-22 | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote a | |
CVE-2026-79849 |
10.0 |
0.0070
|
53.3% | 2026-10-22 | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote a | |
CVE-2026-116692 |
9.8 |
0.0070
|
53.3% | 2026-10-27 | MLflow is an open source AI engineering platform for agents, large language models, and ma | |
CVE-2026-26210 |
9.3 |
0.0070
|
53.3% | 2026-04-23 | KTransformers through 0.5.3 contains an unsafe deserialization vulnerability in the balanc | |
CVE-2026-109444 |
9.3 |
0.0070
|
53.3% | 2026-10-20 | OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows | |
CVE-2026-114403 |
9.2 |
0.0070
|
53.3% | 2026-10-21 | PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability | |
CVE-2026-105944 |
10.0 |
0.0070
|
53.3% | 2026-10-21 | Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has it | |
CVE-2026-46652 |
9.8 |
0.0070
|
53.3% | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a | |
CVE-2026-12116 |
9.8 |
0.0070
|
53.2% | 2026-07-09 | A vulnerability in the Xerte Online Tools allows for RCE through the antivirus binary path | |
CVE-2026-66902 |
9.8 |
0.0070
|
53.2% | 2026-08-04 | Google::Auth versions before 0.06 for Perl run a command named in an external_account cred | |
CVE-2026-51346 |
9.1 |
0.0070
|
53.2% | 2026-08-17 | SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a | |
CVE-2026-75143 |
9.3 |
0.0070
|
53.2% | 2026-08-19 | FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader ( | |
CVE-2026-21515 |
9.9 |
0.0070
|
53.2% | 2026-04-24 | Exposure of sensitive information to an unauthorized actor in Azure IOT Central allows an | |
CVE-2026-10789 |
9.6 |
0.0070
|
53.2% | 2026-06-22 | A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running | |
CVE-2026-3031 |
9.8 |
0.0070
|
53.2% | 2026-07-16 | Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg libra | |
CVE-2026-54806 |
9.8 |
0.0070
|
53.1% | 2026-06-17 | Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions. | |
CVE-2026-115727 |
9.2 |
0.0070
|
53.1% | 2026-10-23 | AgenticSeek before commit 409840c contains a remote code execution vulnerability because l | |
CVE-2026-43629 |
9.2 |
0.0070
|
53.1% | 2026-08-06 | llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the K | |
CVE-2026-111057 |
10.0 |
0.0070
|
53.1% | 2026-10-19 | Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashbo | |
CVE-2026-79853 |
9.8 |
0.0070
|
53.0% | 2026-10-22 | Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could | |
CVE-2026-12257 |
9.3 |
0.0070
|
53.0% | 2026-07-13 | Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vuln | |
CVE-2026-76604 |
10.0 |
0.0070
|
53.0% | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form eleme | |
CVE-2026-76605 |
10.0 |
0.0070
|
53.0% | 2026-08-22 | Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7. | |
CVE-2026-112398 |
9.2 |
0.0070
|
53.0% | 2026-10-19 | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder c | |
CVE-2026-7871 |
9.8 |
0.0069
|
52.9% | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary | |
CVE-2026-65701 |
9.3 |
0.0069
|
52.9% | 2026-07-23 | SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vuln | |
CVE-2026-61962 |
10.0 |
0.0069
|
53.0% | 2026-08-13 | Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions. | |
CVE-2026-98548 |
9.8 |
0.0069
|
52.9% | 2026-10-18 | In the Linux kernel, the following vulnerability has been resolved: sctp: discard the res | |
CVE-2026-79859 |
9.8 |
0.0069
|
52.9% | 2026-10-22 | Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead t | |
CVE-2026-40342 |
9.9 |
0.0069
|
52.9% | 2026-04-17 | Firebird is an open-source relational database management system. In versions prior to 5.0 | |
CVE-2026-69254 |
9.4 |
0.0069
|
52.8% | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. P | |
CVE-2026-112005 |
9.2 |
0.0069
|
52.8% | 2026-10-18 | WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote at | |
CVE-2026-24014 |
9.8 |
0.0069
|
52.8% | 2026-07-06 | Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the upl | |
CVE-2026-46455 |
9.8 |
0.0069
|
52.8% | 2026-07-06 | Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component. The cam | |
CVE-2026-62183 |
9.8 |
0.0069
|
52.8% | 2026-07-20 | Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user | |
CVE-2026-28812 |
9.8 |
0.0069
|
52.8% | 2026-07-30 | UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may a | |
CVE-2026-63298 |
9.9 |
0.0069
|
52.8% | 2026-08-12 | An improper neutralization of special elements vulnerability in LXD's NVIDIA instance conf | |
CVE-2026-34884 |
9.8 |
0.0069
|
52.8% | 2026-08-18 | SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache | |
CVE-2026-44179 |
9.9 |
0.0069
|
52.8% | 2026-10-28 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content | |
CVE-2026-28369 |
9.1 |
0.0069
|
52.7% | 2026-03-27 | A flaw was found in Undertow. When Undertow receives an HTTP request where the first heade | |
CVE-2026-48773 |
9.8 |
0.0069
|
52.7% | 2026-06-19 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Versions 2.0.18 throug | |
CVE-2026-48582 |
9.6 |
0.0069
|
52.7% | 2026-06-19 | Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevat |