Critical CVEs
3,502 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-48773 |
9.8 |
0.0069
|
52.7% | 2026-06-19 | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Versions 2.0.18 throug | |
CVE-2026-48582 |
9.6 |
0.0069
|
52.7% | 2026-06-19 | Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevat | |
CVE-2026-18191 |
9.3 |
0.0069
|
52.7% | 2026-07-29 | VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unaut | |
CVE-2026-56161 |
9.6 |
0.0069
|
52.7% | 2026-08-06 | Improper access control in Azure Logic Apps allows an authorized attacker to disclose info | |
CVE-2026-62896 |
9.6 |
0.0069
|
52.7% | 2026-08-06 | Improper authentication in Microsoft Teams allows an authorized attacker to elevate privil | |
CVE-2026-79844 |
10.0 |
0.0069
|
52.7% | 2026-10-22 | Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an u | |
CVE-2026-79850 |
10.0 |
0.0069
|
52.7% | 2026-10-22 | Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote a | |
CVE-2026-77930 |
9.3 |
0.0069
|
52.7% | 2026-10-20 | EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows atta | |
CVE-2026-118690 |
9.3 |
0.0069
|
52.7% | 2026-10-28 | Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows | |
CVE-2026-8983 |
10.0 |
0.0069
|
52.7% | 2026-07-21 | Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication t | |
CVE-2026-5787 |
9.1 |
0.0069
|
52.6% | 2026-05-07 | An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and | |
CVE-2026-44193 |
9.1 |
0.0069
|
52.6% | 2026-05-13 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC met | |
CVE-2026-62390 |
9.8 |
0.0069
|
52.6% | 2026-07-14 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-54363 |
9.3 |
0.0069
|
52.6% | 2026-07-30 | CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows u | |
CVE-2026-32227 |
9.8 |
0.0069
|
52.6% | 2026-08-10 | SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users a | |
CVE-2026-67443 |
9.2 |
0.0069
|
52.6% | 2026-08-18 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and ear | |
CVE-2026-72098 |
9.8 |
0.0069
|
52.6% | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: dm-verity: fix buffer | |
CVE-2026-52186 |
9.8 |
0.0069
|
52.6% | 2026-07-01 | SQL Injection vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote att | |
CVE-2026-51821 |
9.8 |
0.0069
|
52.6% | 2026-07-13 | SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remo | |
CVE-2026-109219 |
9.8 |
0.0069
|
52.6% | 2026-10-16 | The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4. | |
CVE-2026-31158 |
9.8 |
0.0069
|
52.6% | 2026-10-26 | 1 PoC | SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a re |
CVE-2026-66088 |
9.4 |
0.0069
|
52.6% | 2026-10-29 | In openEQUELLA before 2026.1, the system.execute() function available to the scripting eng | |
CVE-2026-72565 |
9.8 |
0.0068
|
52.5% | 2026-08-10 | A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remo | |
CVE-2026-74886 |
9.3 |
0.0068
|
52.6% | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where | |
CVE-2024-57521 |
10.0 |
0.0068
|
52.5% | 2025-12-23 | SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execut | |
CVE-2026-28564 |
9.8 |
0.0068
|
52.4% | 2026-07-10 | Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in | |
CVE-2026-27690 |
9.1 |
0.0068
|
52.5% | 2026-07-14 | Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attack | |
CVE-2026-71289 |
9.8 |
0.0068
|
52.4% | 2026-08-05 | The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's de | |
CVE-2026-68079 |
9.8 |
0.0068
|
52.5% | 2026-08-06 | In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be re | |
CVE-2026-50561 |
9.4 |
0.0068
|
52.4% | 2026-08-12 | Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent developme | |
CVE-2026-39465 |
9.1 |
0.0068
|
52.4% | 2026-06-15 | Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions. | |
CVE-2026-52439 |
9.8 |
0.0068
|
52.4% | 2026-07-23 | An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via t | |
CVE-2026-14974 |
9.8 |
0.0068
|
52.4% | 2026-07-28 | IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to | |
CVE-2026-50772 |
9.8 |
0.0068
|
52.4% | 2026-08-17 | An issue in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbitrar | |
CVE-2026-117532 |
9.3 |
0.0068
|
52.4% | 2026-10-27 | REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in th | |
CVE-2026-41202 |
9.4 |
0.0068
|
52.3% | 2026-05-07 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-17566 |
9.4 |
0.0067
|
52.1% | 2026-07-31 | pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolatin | |
CVE-2026-13473 |
9.8 |
0.0067
|
52.0% | 2026-07-17 | IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through 8.2.1.0 | |
CVE-2026-17138 |
9.8 |
0.0067
|
52.0% | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb | |
CVE-2026-19437 |
9.8 |
0.0067
|
52.0% | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb | |
CVE-2026-15043 |
9.8 |
0.0067
|
52.0% | 2026-07-14 | DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operat | |
CVE-2026-41521 |
9.1 |
0.0067
|
52.0% | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow v | |
CVE-2026-48158 |
9.3 |
0.0067
|
52.0% | 2026-08-10 | use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15: | |
CVE-2026-48159 |
9.3 |
0.0067
|
52.0% | 2026-08-10 | use-reducer-async is a React useReducer with async actions. Between 2026-05-18 16:29:52 an | |
CVE-2026-48160 |
9.3 |
0.0067
|
52.0% | 2026-08-10 | react-tracked provides state usage tracking with Proxies. Between 2026-05-18 19:26:36 and | |
CVE-2026-48161 |
9.3 |
0.0067
|
52.0% | 2026-08-10 | react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20: | |
CVE-2026-13737 |
9.2 |
0.0067
|
52.0% | 2026-08-11 | CommServe contained an allowlist bypass vulnerability affecting command execution authoriz | |
CVE-2026-13738 |
9.2 |
0.0067
|
52.0% | 2026-08-11 | CommServe contained an authorization bypass vulnerability affecting a limited set of comma | |
CVE-2025-70290 |
9.8 |
0.0067
|
52.0% | 2026-08-26 | An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability i | |
CVE-2026-96207 |
10.0 |
0.0067
|
52.0% | 2026-10-08 | Improper certificate validation in Microsoft Partner Center allows an unauthorized attacke |