Critical CVEs
3,297 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-15409 |
10.0 |
0.0679
|
94.0% | 2026-07-14 | KEV RW | SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that coul |
CVE-2026-42530 |
9.2 |
0.0645
|
93.7% | 2026-06-17 | NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open So | |
CVE-2026-62327 |
9.3 |
0.0627
|
93.6% | 2026-07-13 | 9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerab | |
CVE-2026-13773 |
10.0 |
0.0610
|
93.4% | 2026-06-30 | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub | |
CVE-2026-20180 |
9.9 |
0.0602
|
93.3% | 2026-04-15 | A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remo | |
CVE-2026-44262 |
9.4 |
0.0586
|
93.2% | 2026-05-12 | Scramble generates API documentation for Laravel project. From 0.13.2 to before 0.13.22, w | |
CVE-2026-19586 |
9.3 |
0.0572
|
93.0% | 2026-08-20 | A pre-authentication OS command injection vulnerability has been identified in Omada gatew | |
CVE-2026-73034 |
9.3 |
0.0570
|
93.0% | 2026-08-11 | DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote | |
CVE-2026-44194 |
9.1 |
0.0567
|
93.0% | 2026-05-13 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticat | |
CVE-2026-53787 |
9.3 |
0.0564
|
92.9% | 2026-06-12 | Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arb | |
CVE-2026-20186 |
9.9 |
0.0560
|
92.9% | 2026-04-15 | A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remo | |
CVE-2026-41103 |
9.1 |
0.0538
|
92.6% | 2026-05-12 | Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & | |
CVE-2025-64393 |
9.4 |
0.0520
|
92.5% | 2026-10-07 | This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitra | |
CVE-2026-4670 |
9.8 |
0.0504
|
92.3% | 2026-04-30 | Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automa | |
CVE-2026-41922 |
9.3 |
0.0498
|
92.2% | 2026-05-04 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vu | |
CVE-2026-48909 |
9.5 |
0.0494
|
92.1% | 2026-06-20 | SP LMS (com_splms) < 4.1.4 by JoomShaper deserializes user-controlled cookie data without | |
CVE-2026-6516 |
10.0 |
0.0473
|
91.8% | 2026-07-23 | Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Re | |
CVE-2026-49952 |
9.3 |
0.0472
|
91.8% | 2026-06-15 | Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerab | |
CVE-2026-18963 |
9.1 |
0.0468
|
91.7% | 2026-08-18 | A flaw was found in the reset-credentials flow of the keycloak-services component, which i | |
CVE-2026-58123 |
9.3 |
0.0465
|
91.7% | 2026-07-09 | Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerabili | |
CVE-2026-104286 |
9.8 |
0.0457
|
91.6% | 2026-10-01 | KEV | Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte o |
CVE-2026-50627 |
9.1 |
0.0452
|
91.5% | 2026-06-12 | The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) cla | |
CVE-2026-58479 |
9.2 |
0.0440
|
91.3% | 2026-07-14 | Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a command injection | |
CVE-2026-42607 |
9.1 |
0.0438
|
91.3% | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an authenticated user with admin | |
CVE-2026-59865 |
9.3 |
0.0436
|
91.2% | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota i | |
CVE-2026-15748 |
9.8 |
0.0409
|
90.7% | 2026-08-18 | The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all ve | |
CVE-2026-61498 |
9.3 |
0.0401
|
90.5% | 2026-07-13 | Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in th | |
CVE-2026-41925 |
9.3 |
0.0400
|
90.5% | 2026-05-04 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vu | |
CVE-2026-55200 |
9.2 |
0.0388
|
90.2% | 2026-06-17 | libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in | |
CVE-2026-41452 |
9.3 |
0.0374
|
89.8% | 2026-08-03 | Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middlewa | |
CVE-2026-7411 |
10.0 |
0.0368
|
89.6% | 2026-05-05 | In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path nor | |
CVE-2026-73296 |
9.4 |
0.0365
|
89.6% | 2026-08-12 | Microsoft UFO open-source framework for intelligent automation across devices and platform | |
CVE-2026-34415 |
9.3 |
0.0357
|
89.3% | 2026-04-22 | Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vul | |
CVE-2026-58480 |
9.2 |
0.0357
|
89.3% | 2026-07-08 | Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbit | |
CVE-2026-56782 |
9.3 |
0.0356
|
89.3% | 2026-06-29 | Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and / | |
CVE-2026-16232 |
9.3 |
0.0352
|
89.2% | 2026-07-22 | KEV | Check Point SmartConsole contains an improper authentication vulnerability which could all |
CVE-2026-5524 |
9.8 |
0.0348
|
89.1% | 2026-07-02 | The Divi Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload leading | |
CVE-2026-60121 |
9.3 |
0.0330
|
88.5% | 2026-07-13 | Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in th | |
CVE-2026-53576 |
10.0 |
0.0330
|
88.5% | 2026-06-26 | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, | |
CVE-2026-8986 |
9.5 |
0.0328
|
88.4% | 2026-07-21 | Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection | |
CVE-2026-45321 |
9.6 |
0.0328
|
88.4% | 2026-05-12 | KEV RW | TanStack contains an unspecified vulnerability that allowed malicious versions of the prod |
CVE-2026-12571 |
9.8 |
0.0327
|
88.4% | 2026-08-11 | An authentication bypass in ManageEngine DDI Central's password-reset workflow allows acco | |
CVE-2026-9103 |
9.8 |
0.0321
|
88.1% | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized a | |
CVE-2026-41924 |
9.3 |
0.0320
|
88.1% | 2026-05-04 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vu | |
CVE-2026-71944 |
9.3 |
0.0317
|
88.0% | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_2026 | |
CVE-2026-71945 |
9.3 |
0.0317
|
88.0% | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_2026 | |
CVE-2026-71946 |
9.3 |
0.0317
|
88.0% | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_2026 | |
CVE-2026-71947 |
9.3 |
0.0317
|
88.0% | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_2026 | |
CVE-2026-71948 |
9.3 |
0.0317
|
88.0% | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_2026 | |
CVE-2026-71949 |
9.3 |
0.0317
|
88.0% | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_2026 |