Critical CVEs
3,532 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-90863 |
9.1 |
0.0066
|
51.4% | 2026-10-29 | Missing authorization in the administrative interface of Progress Software WS_FTP Server v | |
CVE-2026-7839 |
9.1 |
0.0066
|
51.3% | 2026-07-01 | UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardco | |
CVE-2026-56843 |
9.9 |
0.0066
|
51.3% | 2026-07-08 | Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low- | |
CVE-2026-56271 |
9.3 |
0.0066
|
51.3% | 2026-07-12 | Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JW | |
CVE-2026-73069 |
9.1 |
0.0066
|
51.3% | 2026-08-11 | Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, | |
CVE-2026-10666 |
9.8 |
0.0065
|
51.3% | 2026-07-12 | parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the f | |
CVE-2026-9195 |
9.3 |
0.0065
|
51.3% | 2026-08-05 | A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server bef | |
CVE-2026-56015 |
9.1 |
0.0065
|
51.3% | 2026-07-03 | Net::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via an unbounde | |
CVE-2026-60082 |
9.1 |
0.0065
|
51.3% | 2026-07-14 | DBI versions before 1.651 for Perl do not enforce statement handle consistency with the ro | |
CVE-2026-57073 |
9.1 |
0.0065
|
51.3% | 2026-07-16 | HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead. The pars | |
CVE-2026-114383 |
10.0 |
0.0065
|
51.3% | 2026-10-21 | A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function se | |
CVE-2026-89537 |
9.1 |
0.0065
|
51.3% | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Reject short | |
CVE-2026-25470 |
10.0 |
0.0065
|
51.2% | 2026-06-17 | Unauthenticated Remote Code Execution (RCE) in ACPT (Pro) - Custom Post Types Plugin for W | |
CVE-2026-26292 |
9.8 |
0.0065
|
51.2% | 2026-07-03 | Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync | |
CVE-2026-72472 |
9.8 |
0.0065
|
51.2% | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: nfs: use nfsi->rwsem | |
CVE-2026-74350 |
9.8 |
0.0065
|
51.2% | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate fast | |
CVE-2026-74401 |
9.8 |
0.0065
|
51.2% | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: dlm: fix add msg hand | |
CVE-2026-89788 |
9.8 |
0.0065
|
51.2% | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix tree conne | |
CVE-2026-24727 |
9.3 |
0.0065
|
51.2% | 2026-07-24 | An unrestricted upload of file with dangerous type vulnerability in the e-paper draft uplo | |
CVE-2026-48162 |
9.1 |
0.0065
|
51.2% | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and respon | |
CVE-2026-46512 |
9.9 |
0.0065
|
51.1% | 2026-07-16 | Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialpla | |
CVE-2026-73263 |
9.9 |
0.0065
|
51.1% | 2026-08-12 | Prowler is a cloud security platform. Prior to 5.36.0, the Kubernetes provider connection | |
CVE-2026-73294 |
9.9 |
0.0065
|
51.1% | 2026-08-12 | Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-bet | |
CVE-2026-57881 |
9.8 |
0.0065
|
51.1% | 2026-06-26 | An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in GeoVision | |
CVE-2026-58586 |
9.8 |
0.0065
|
51.1% | 2026-07-24 | Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image: | |
CVE-2026-67967 |
9.8 |
0.0065
|
51.1% | 2026-08-17 | Buffer Overflow vulnerability in Tenda W20E V16.01.0.6(2782) allows an attacker to execute | |
CVE-2026-41553 |
10.0 |
0.0065
|
51.0% | 2026-05-15 | PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Remote Co | |
CVE-2026-8507 |
9.8 |
0.0065
|
51.0% | 2026-05-17 | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws | |
CVE-2026-52830 |
9.4 |
0.0065
|
51.0% | 2026-07-02 | fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates H | |
CVE-2026-71479 |
9.1 |
0.0065
|
51.0% | 2026-08-17 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset mana | |
CVE-2026-33943 |
9.8 |
0.0065
|
50.9% | 2026-03-27 | Happy DOM is a JavaScript implementation of a web browser without its graphical user inter | |
CVE-2026-40702 |
9.3 |
0.0065
|
50.9% | 2026-06-25 | WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersona | |
CVE-2026-10025 |
9.8 |
0.0065
|
50.9% | 2026-08-05 | IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an X | |
CVE-2026-97785 |
10.0 |
0.0065
|
50.9% | 2026-10-22 | 1 PoC | Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privil |
CVE-2026-40911 |
10.0 |
0.0065
|
50.9% | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket pl | |
CVE-2026-35278 |
9.8 |
0.0064
|
50.9% | 2026-06-17 | Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (co | |
CVE-2026-67324 |
9.3 |
0.0064
|
50.9% | 2026-08-01 | GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short | |
CVE-2026-19425 |
9.3 |
0.0064
|
50.9% | 2026-08-11 | Travel Agency Management System developed by Win Men Intermational has a SQL Injection vul | |
CVE-2026-40189 |
9.3 |
0.0064
|
50.8% | 2026-04-10 | goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the docum | |
CVE-2026-7803 |
9.8 |
0.0064
|
50.8% | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.10.0 could allow arbitrary code execution due to improper | |
CVE-2026-12692 |
9.8 |
0.0064
|
50.8% | 2026-07-17 | Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platform allows | |
CVE-2026-59243 |
9.8 |
0.0064
|
50.8% | 2026-07-29 | The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decodi | |
CVE-2026-15706 |
9.8 |
0.0064
|
50.8% | 2026-08-20 | Missing authentication for critical function vulnerability in Baylan Measuring Instruments | |
CVE-2026-76938 |
9.8 |
0.0064
|
50.8% | 2026-10-27 | Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3. This issue | |
CVE-2026-82117 |
9.8 |
0.0064
|
50.8% | 2026-10-27 | Authentication Bypass by Spoofing Vulnerability in HiRDB. This issue affects HiRDB Server | |
CVE-2026-109218 |
9.8 |
0.0064
|
50.8% | 2026-10-28 | The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all ver | |
CVE-2026-34265 |
9.8 |
0.0064
|
50.7% | 2026-08-11 | SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logica | |
CVE-2026-69102 |
9.3 |
0.0064
|
50.7% | 2026-08-11 | MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secre | |
CVE-2026-79852 |
9.8 |
0.0064
|
50.7% | 2026-10-22 | A vulnerability in the web-based management interface of AOS could allow an unauthenticate | |
CVE-2026-79854 |
9.8 |
0.0064
|
50.7% | 2026-10-22 | A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote |