Critical CVEs
3,594 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-43083 |
9.1 |
0.0056
|
46.5% | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: net: ioam6: fix OOB a | |
CVE-2026-43414 |
9.8 |
0.0056
|
46.5% | 2026-05-08 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Comple | |
CVE-2026-15265 |
9.4 |
0.0056
|
46.4% | 2026-07-14 | A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privi | |
CVE-2026-28982 |
9.8 |
0.0056
|
46.4% | 2026-07-27 | A race condition was addressed with improved locking. This issue is fixed in macOS Sequoia | |
CVE-2025-34522 |
9.2 |
0.0056
|
46.3% | 2025-08-27 | A heap-based buffer overflow vulnerability exists in the input parsing logic of Arcserve U | |
CVE-2026-27429 |
9.8 |
0.0056
|
46.4% | 2026-06-17 | Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions. | |
CVE-2026-45336 |
10.0 |
0.0056
|
46.4% | 2026-07-16 | HireFlow is a web-based interview management system for managing candidates, scheduling in | |
CVE-2026-16382 |
9.8 |
0.0056
|
46.3% | 2026-07-21 | Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in F | |
CVE-2026-61884 |
9.3 |
0.0056
|
46.4% | 2026-07-24 | The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP credentials configured, intended f | |
CVE-2026-17687 |
9.6 |
0.0056
|
46.4% | 2026-07-30 | Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker | |
CVE-2026-79872 |
9.4 |
0.0056
|
46.3% | 2026-10-22 | A buffer overflow vulnerability exists in the underlying operating system of AOS that coul | |
CVE-2026-69435 |
9.6 |
0.0056
|
46.4% | 2026-10-08 | Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileg | |
CVE-2026-6296 |
9.6 |
0.0056
|
46.3% | 2026-04-15 | Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote at | |
CVE-2023-1357 |
9.8 |
0.0055
|
46.3% | 2023-03-12 | A vulnerability, which was classified as critical, has been found in SourceCodester Simple | |
CVE-2026-35047 |
9.3 |
0.0055
|
46.3% | 2026-04-06 | Brave CMS is an open-source CMS. Prior to 2.0.6, an Unrestricted File Upload vulnerability | |
CVE-2026-6074 |
9.3 |
0.0055
|
46.2% | 2026-04-23 | Intrado 911 Emergency Gateway (EGW) 5.x, 6.x, and 7.x contain a path traversal vulnerabili | |
CVE-2026-42882 |
9.4 |
0.0055
|
46.3% | 2026-05-11 | oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy contains an | |
CVE-2026-65318 |
9.2 |
0.0055
|
46.2% | 2026-07-21 | Verba RAG application version 2.1.3 contains an unauthenticated server-side request forger | |
CVE-2024-53177 |
9.8 |
0.0055
|
46.2% | 2024-12-27 | In the Linux kernel, the following vulnerability has been resolved: smb: prevent use-afte | |
CVE-2026-16235 |
9.8 |
0.0055
|
46.2% | 2026-07-20 | Crypt::Password versions through 0.28 for Perl generate insecure random values for salts. | |
CVE-2026-59147 |
9.8 |
0.0055
|
46.2% | 2026-07-21 | Data::DisjointSet::Shared versions before 0.02 for Perl allow out-of-bounds reads and writ | |
CVE-2026-60007 |
9.1 |
0.0055
|
46.2% | 2026-08-04 | In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguis | |
CVE-2026-71254 |
9.8 |
0.0055
|
46.2% | 2026-08-05 | nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handl | |
CVE-2026-71256 |
9.8 |
0.0055
|
46.2% | 2026-08-05 | nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer | |
CVE-2026-71267 |
9.8 |
0.0055
|
46.2% | 2026-08-05 | microtar's mtar_write_file_header and mtar_write_dir_header functions (src/microtar.c) cop | |
CVE-2026-48056 |
10.0 |
0.0055
|
46.2% | 2026-08-11 | Streambert is a cross-platform Electron Desktop App to stream and download video content. | |
CVE-2026-106013 |
9.8 |
0.0055
|
46.2% | 2026-10-28 | The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twi | |
CVE-2026-84295 |
10.0 |
0.0055
|
46.2% | 2026-10-29 | Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and | |
CVE-2026-34047 |
9.9 |
0.0055
|
46.1% | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-65886 |
9.2 |
0.0055
|
46.1% | 2026-07-29 | Joomla Extension - balbooa.com - Unauthenticated arbitrary file read in Gridbox < 2.20.2 - | |
CVE-2026-64639 |
9.3 |
0.0055
|
46.1% | 2026-08-12 | Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 al | |
CVE-2026-70496 |
9.9 |
0.0055
|
46.1% | 2026-08-19 | A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equival | |
CVE-2026-44277 |
9.8 |
0.0055
|
46.0% | 2026-05-12 | A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthent | |
CVE-2026-16367 |
10.0 |
0.0055
|
46.1% | 2026-07-21 | Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulner | |
CVE-2026-16388 |
9.8 |
0.0055
|
46.1% | 2026-07-21 | Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 1 | |
CVE-2026-16410 |
9.8 |
0.0055
|
46.1% | 2026-07-21 | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed i | |
CVE-2025-65200 |
9.6 |
0.0055
|
46.1% | 2026-10-22 | An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code v | |
CVE-2026-1496 |
9.3 |
0.0055
|
46.0% | 2026-03-27 | Vulnerable versions of Coverity Connect lack an error handler in the authentication logic | |
CVE-2023-54344 |
9.3 |
0.0055
|
46.0% | 2026-05-05 | Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerability that | |
CVE-2026-48777 |
9.3 |
0.0055
|
46.0% | 2026-06-16 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3. | |
CVE-2026-71851 |
9.0 |
0.0055
|
46.0% | 2026-08-07 | crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0. | |
CVE-2026-59106 |
9.3 |
0.0055
|
46.0% | 2026-10-26 | A security vulnerability has been identified in the WolfProt interface implementation. Ins | |
CVE-2026-13766 |
9.8 |
0.0055
|
46.0% | 2026-06-30 | DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL iden | |
CVE-2026-60264 |
9.8 |
0.0055
|
45.9% | 2026-07-21 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core | |
CVE-2026-73381 |
9.1 |
0.0055
|
45.9% | 2026-08-18 | Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions. | |
CVE-2026-115806 |
9.8 |
0.0055
|
46.0% | 2026-10-24 | The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object In | |
CVE-2023-54203 |
9.1 |
0.0055
|
45.9% | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-o | |
CVE-2026-35503 |
9.3 |
0.0055
|
45.9% | 2026-04-24 | A vulnerability in SenseLive X3050’s web management interface allows authentication logic | |
CVE-2026-49767 |
9.8 |
0.0055
|
45.9% | 2026-06-17 | Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions. | |
CVE-2026-57331 |
9.9 |
0.0055
|
45.9% | 2026-06-29 | Performer Arbitrary File Deletion in Paid Videochat Turnkey Site <= 7.4.8 versions. |