Critical CVEs
3,594 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-11913 |
9.8 |
0.0056
|
46.9% | 2026-07-10 | vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions: *. | |
CVE-2026-57724 |
9.8 |
0.0056
|
46.9% | 2026-07-13 | Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injec | |
CVE-2026-57744 |
9.8 |
0.0056
|
46.8% | 2026-07-13 | Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-ex | |
CVE-2026-57770 |
9.8 |
0.0056
|
46.8% | 2026-07-13 | Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphoto | |
CVE-2026-57811 |
10.0 |
0.0056
|
46.9% | 2026-07-13 | Improper Control of Generation of Code ('Code Injection') vulnerability in Realtyna Realty | |
CVE-2026-59518 |
9.8 |
0.0056
|
46.8% | 2026-07-13 | Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Ob | |
CVE-2026-44747 |
9.9 |
0.0056
|
46.9% | 2026-07-14 | SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical | |
CVE-2026-59544 |
9.8 |
0.0056
|
46.9% | 2026-07-23 | Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions. | |
CVE-2026-17561 |
9.8 |
0.0056
|
46.9% | 2026-07-31 | Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Softwar | |
CVE-2026-28139 |
9.8 |
0.0056
|
46.8% | 2026-08-06 | Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions. | |
CVE-2026-65552 |
9.8 |
0.0056
|
46.9% | 2026-08-06 | Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions. | |
CVE-2026-65556 |
9.8 |
0.0056
|
46.8% | 2026-08-06 | Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versio | |
CVE-2026-65571 |
9.8 |
0.0056
|
46.8% | 2026-08-06 | Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions. | |
CVE-2026-65572 |
9.8 |
0.0056
|
46.8% | 2026-08-06 | Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions. | |
CVE-2026-65573 |
9.8 |
0.0056
|
46.8% | 2026-08-06 | Unauthenticated PHP Object Injection in Abelle <= 1.22 versions. | |
CVE-2026-65574 |
9.8 |
0.0056
|
46.8% | 2026-08-06 | Unauthenticated PHP Object Injection in Abogado <= 1.18 versions. | |
CVE-2026-65575 |
9.8 |
0.0056
|
46.8% | 2026-08-06 | Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions. | |
CVE-2026-65576 |
9.8 |
0.0056
|
46.8% | 2026-08-06 | Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions. | |
CVE-2026-65577 |
9.8 |
0.0056
|
46.8% | 2026-08-06 | Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions. | |
CVE-2026-65578 |
9.8 |
0.0056
|
46.9% | 2026-08-06 | Unauthenticated PHP Object Injection in Agora <= 1.9 versions. | |
CVE-2026-65579 |
9.8 |
0.0056
|
46.8% | 2026-08-06 | Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions. | |
CVE-2026-65581 |
9.8 |
0.0056
|
46.8% | 2026-08-06 | Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions. | |
CVE-2026-28149 |
9.8 |
0.0056
|
46.8% | 2026-08-13 | Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions. | |
CVE-2026-32470 |
9.8 |
0.0056
|
46.8% | 2026-08-18 | Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions. | |
CVE-2026-73341 |
9.8 |
0.0056
|
46.8% | 2026-08-18 | Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions. | |
CVE-2026-73366 |
9.8 |
0.0056
|
46.8% | 2026-08-18 | Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions. | |
CVE-2026-73376 |
9.8 |
0.0056
|
46.8% | 2026-08-18 | Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions. | |
CVE-2026-73380 |
9.8 |
0.0056
|
46.8% | 2026-08-18 | Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions. | |
CVE-2026-73397 |
9.8 |
0.0056
|
46.8% | 2026-08-18 | Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions. | |
CVE-2026-16926 |
9.1 |
0.0056
|
46.8% | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite a | |
CVE-2026-32563 |
9.8 |
0.0056
|
46.8% | 2026-08-24 | Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= | |
CVE-2024-53095 |
9.8 |
0.0056
|
46.9% | 2024-11-21 | In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use- | |
CVE-2026-26149 |
9.0 |
0.0056
|
46.8% | 2026-04-14 | Improper neutralization of escape, meta, or control sequences in Microsoft Power Apps allo | |
CVE-2026-42869 |
10.0 |
0.0056
|
46.8% | 2026-05-11 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security oper | |
CVE-2026-25718 |
9.1 |
0.0056
|
46.8% | 2026-07-03 | Gitea versions before 1.25.5 mishandle path resolution during template repository generati | |
CVE-2026-113682 |
9.1 |
0.0056
|
46.7% | 2026-10-20 | Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability | |
CVE-2026-34208 |
10.0 |
0.0056
|
46.6% | 2026-04-06 | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct ass | |
CVE-2026-50551 |
9.9 |
0.0056
|
46.7% | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan cont | |
CVE-2026-73269 |
9.9 |
0.0056
|
46.7% | 2026-08-12 | A flaw was found in the cluster-curator-controller component. A local user, by creating a | |
CVE-2026-96252 |
9.1 |
0.0056
|
46.6% | 2026-10-13 | Improper verification of cryptographic signature in Active Directory Federation Services ( | |
CVE-2026-8859 |
9.9 |
0.0056
|
46.6% | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary | |
CVE-2026-64738 |
9.8 |
0.0056
|
46.6% | 2026-07-27 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS | |
CVE-2026-44945 |
9.1 |
0.0056
|
46.6% | 2026-08-05 | A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/aut | |
CVE-2026-58016 |
9.1 |
0.0056
|
46.6% | 2026-06-30 | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() | |
CVE-2026-54203 |
9.2 |
0.0056
|
46.6% | 2026-08-07 | Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's We | |
CVE-2026-74880 |
9.3 |
0.0056
|
46.6% | 2026-08-17 | openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in key | |
CVE-2026-77645 |
9.2 |
0.0056
|
46.6% | 2026-08-20 | A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill an | |
CVE-2017-20251 |
9.3 |
0.0056
|
46.5% | 2026-06-09 | 1 PoC | WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerabili |
CVE-2026-47705 |
9.6 |
0.0056
|
46.5% | 2026-08-11 | TypeBot is a chatbot builder tool. Version 3.16.1 has a CSV injection vulnerability in the | |
CVE-2026-73032 |
9.4 |
0.0056
|
46.5% | 2026-08-11 | PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows atta |