Critical CVEs
3,573 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-116747 |
9.2 |
0.0062
|
49.8% | 2026-10-26 | Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that allows unau | |
CVE-2026-16834 |
9.8 |
0.0062
|
49.8% | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a den | |
CVE-2026-113744 |
10.0 |
0.0062
|
49.8% | 2026-10-21 | A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element | |
CVE-2026-110186 |
9.8 |
0.0062
|
49.8% | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary c | |
CVE-2026-49257 |
10.0 |
0.0062
|
49.8% | 2026-06-18 | mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apach | |
CVE-2026-28314 |
9.1 |
0.0062
|
49.7% | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that le | |
CVE-2026-50755 |
9.8 |
0.0062
|
49.7% | 2026-07-21 | An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitiv | |
CVE-2026-73483 |
9.4 |
0.0062
|
49.8% | 2026-08-13 | Flowise (packages flowise and flowise-components) in versions <= 3.1.2 contain a sandbox e | |
CVE-2026-66794 |
9.3 |
0.0062
|
49.7% | 2026-08-19 | A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kuberne | |
CVE-2026-41203 |
9.4 |
0.0062
|
49.7% | 2026-05-07 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-67567 |
9.9 |
0.0062
|
49.7% | 2026-08-20 | A flaw was found in the multicloud-operators-subscription component. This vulnerability al | |
CVE-2026-16395 |
9.8 |
0.0062
|
49.6% | 2026-07-21 | Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 | |
CVE-2026-16402 |
9.8 |
0.0062
|
49.6% | 2026-07-21 | Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Fire | |
CVE-2026-16408 |
9.8 |
0.0062
|
49.6% | 2026-07-21 | Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in F | |
CVE-2026-54489 |
9.8 |
0.0062
|
49.6% | 2026-08-06 | Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, co | |
CVE-2026-98490 |
9.8 |
0.0062
|
49.6% | 2026-10-18 | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: con | |
CVE-2026-90235 |
9.8 |
0.0062
|
49.6% | 2026-09-17 | In the Linux kernel, the following vulnerability has been resolved: sunrpc: xprtsock: ann | |
CVE-2026-41635 |
9.8 |
0.0062
|
49.5% | 2026-04-27 | Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for stat | |
CVE-2026-49757 |
9.2 |
0.0062
|
49.4% | 2026-06-15 | Authentication Bypass by Spoofing vulnerability in team-alembic AshAuthentication allows a | |
CVE-2026-70478 |
9.2 |
0.0062
|
49.4% | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. P | |
CVE-2026-116235 |
9.4 |
0.0061
|
49.4% | 2026-10-26 | A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is a | |
CVE-2026-27303 |
9.6 |
0.0061
|
49.3% | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untr | |
CVE-2026-49035 |
9.2 |
0.0061
|
49.3% | 2026-07-23 | The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initi | |
CVE-2026-14976 |
9.8 |
0.0061
|
49.3% | 2026-07-28 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote | |
CVE-2022-51026 |
9.3 |
0.0061
|
49.3% | 2026-10-22 | Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows u | |
CVE-2026-89713 |
9.1 |
0.0061
|
49.3% | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: NFSD: check truncate | |
CVE-2026-1949 |
9.8 |
0.0061
|
49.3% | 2026-04-24 | Delta Electronics AS320T has incorrect calculation of the buffer size on the stack in the | |
CVE-2026-1951 |
9.8 |
0.0061
|
49.3% | 2026-04-24 | Delta Electronics AS320T has no checking of the length of the buffer with the directory na | |
CVE-2026-50242 |
9.8 |
0.0061
|
49.2% | 2026-06-19 | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3. | |
CVE-2026-62422 |
9.8 |
0.0061
|
49.2% | 2026-07-14 | In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 20 | |
CVE-2026-47865 |
9.8 |
0.0061
|
49.2% | 2026-07-18 | VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user | |
CVE-2026-64731 |
9.8 |
0.0061
|
49.2% | 2026-07-27 | A path handling issue was addressed with improved validation. This issue is fixed in macOS | |
CVE-2026-54735 |
10.0 |
0.0061
|
49.2% | 2026-07-29 | Prebid Server is an open-source solution for running real-time advertising auctions in the | |
CVE-2026-79856 |
9.8 |
0.0061
|
49.2% | 2026-10-22 | A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an u | |
CVE-2026-103688 |
9.8 |
0.0061
|
49.2% | 2026-10-28 | The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate | |
CVE-2026-34263 |
9.6 |
0.0061
|
49.2% | 2026-05-12 | Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticate | |
CVE-2026-50770 |
9.8 |
0.0061
|
49.2% | 2026-08-17 | An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate | |
CVE-2026-50774 |
9.8 |
0.0061
|
49.2% | 2026-08-17 | An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the | |
CVE-2026-40288 |
9.8 |
0.0061
|
49.1% | 2026-04-14 | PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.14 | |
CVE-2026-16360 |
9.8 |
0.0061
|
49.1% | 2026-07-21 | Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bu | |
CVE-2026-74988 |
9.8 |
0.0061
|
49.1% | 2026-08-18 | Internally found bugs present in Firefox ESR 153.0 and Firefox 153. Some of these bugs sho | |
CVE-2026-116508 |
9.3 |
0.0061
|
49.1% | 2026-10-26 | A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by | |
CVE-2023-0758 |
9.8 |
0.0061
|
49.1% | 2023-02-09 | A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical. This iss | |
CVE-2026-65317 |
9.2 |
0.0061
|
49.1% | 2026-07-21 | Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability c | |
CVE-2026-72550 |
9.8 |
0.0061
|
49.1% | 2026-08-11 | An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthen | |
CVE-2026-72599 |
9.8 |
0.0061
|
49.1% | 2026-08-11 | An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to ex | |
CVE-2026-55276 |
9.1 |
0.0061
|
49.0% | 2026-06-29 | Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that spe | |
CVE-2026-98959 |
9.8 |
0.0061
|
49.0% | 2026-10-23 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr repl | |
CVE-2026-56188 |
9.8 |
0.0061
|
49.0% | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition' | |
CVE-2026-4767 |
9.8 |
0.0061
|
49.0% | 2026-07-02 | Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. WAF |