Critical CVEs
3,297 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-71950 |
9.3 |
0.0317
|
88.0% | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_2026 | |
CVE-2026-71951 |
9.3 |
0.0317
|
88.0% | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_2026 | |
CVE-2026-71952 |
9.3 |
0.0317
|
88.0% | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_2026 | |
CVE-2026-71953 |
9.3 |
0.0317
|
88.0% | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_2026 | |
CVE-2026-71954 |
9.3 |
0.0317
|
88.0% | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_2026 | |
CVE-2026-71955 |
9.3 |
0.0317
|
88.0% | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_20260211004 | |
CVE-2026-71956 |
9.3 |
0.0317
|
88.0% | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_20260211004 | |
CVE-2026-41923 |
9.3 |
0.0309
|
87.7% | 2026-05-04 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vu | |
CVE-2026-41492 |
9.8 |
0.0308
|
87.6% | 2026-04-24 | Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes th | |
CVE-2026-50522 |
9.8 |
0.0304
|
87.5% | 2026-07-14 | KEV | Microsoft SharePoint contains a deserialization of untrusted data vulnerability which coul |
CVE-2026-49468 |
9.5 |
0.0303
|
87.4% | 2026-06-22 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prio | |
CVE-2026-59726 |
10.0 |
0.0302
|
87.4% | 2026-07-09 | Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo's default | |
CVE-2026-48313 |
9.3 |
0.0295
|
87.1% | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of | |
CVE-2026-58457 |
9.3 |
0.0294
|
87.1% | 2026-07-01 | Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) contains an unauthenticated OS c | |
CVE-2026-52102 |
9.8 |
0.0294
|
87.1% | 2026-08-03 | An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8 | |
CVE-2026-53753 |
10.0 |
0.0290
|
86.9% | 2026-06-23 | Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_e | |
CVE-2026-8153 |
9.8 |
0.0285
|
86.7% | 2026-05-08 | OS command injection in Dashboard Server interface in Universal Robots PolyScope versions | |
CVE-2026-46339 |
10.0 |
0.0276
|
86.2% | 2026-07-15 | 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js mi | |
CVE-2026-20896 |
9.8 |
0.0276
|
86.2% | 2026-07-03 | Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* | |
CVE-2026-38709 |
9.8 |
0.0275
|
86.2% | 2026-07-30 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3 | |
CVE-2026-38711 |
9.8 |
0.0275
|
86.2% | 2026-07-31 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3 | |
CVE-2026-38708 |
9.8 |
0.0275
|
86.2% | 2026-07-31 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3 | |
CVE-2026-38713 |
9.8 |
0.0275
|
86.2% | 2026-07-31 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3 | |
CVE-2026-110640 |
9.3 |
0.0273
|
86.0% | 2026-10-14 | Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows atta | |
CVE-2026-12486 |
9.1 |
0.0270
|
85.9% | 2026-06-24 | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality o | |
CVE-2026-12849 |
9.1 |
0.0270
|
85.9% | 2026-06-24 | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality o | |
CVE-2026-12850 |
9.1 |
0.0270
|
85.9% | 2026-06-24 | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality o | |
CVE-2026-12851 |
9.1 |
0.0270
|
85.9% | 2026-06-24 | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality o | |
CVE-2026-28672 |
9.8 |
0.0263
|
85.5% | 2026-08-10 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulner | |
CVE-2026-7840 |
9.3 |
0.0263
|
85.4% | 2026-07-01 | UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP a | |
CVE-2026-46725 |
9.2 |
0.0262
|
85.4% | 2026-05-19 | The extension passes an attacker-controlled cookie directly to PHP's unserialize() without | |
CVE-2026-59801 |
9.3 |
0.0262
|
85.4% | 2026-07-13 | 9Router through version 0.4.41 contains an unauthenticated access vulnerability that allow | |
CVE-2026-53976 |
9.3 |
0.0261
|
85.4% | 2026-08-06 | OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints / | |
CVE-2026-16766 |
9.8 |
0.0257
|
85.1% | 2026-07-25 | Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection ( | |
CVE-2026-34038 |
9.9 |
0.0254
|
84.9% | 2026-07-06 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-110635 |
9.3 |
0.0252
|
84.8% | 2026-10-14 | webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconv | |
CVE-2026-4408 |
9.8 |
0.0250
|
84.6% | 2026-05-28 | A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file | |
CVE-2026-61808 |
9.8 |
0.0250
|
84.6% | 2026-08-07 | LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, t | |
CVE-2026-65008 |
9.3 |
0.0249
|
84.6% | 2026-07-21 | Grav 2.0.4 (fixed in 2.0.7) contains a remote code execution vulnerability in Blueprint::d | |
CVE-2026-62392 |
9.8 |
0.0248
|
84.5% | 2026-07-14 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | |
CVE-2026-71983 |
9.3 |
0.0246
|
84.4% | 2026-08-08 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerabili | |
CVE-2026-71984 |
9.3 |
0.0246
|
84.4% | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerabili | |
CVE-2026-71985 |
9.3 |
0.0246
|
84.4% | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerabili | |
CVE-2026-71986 |
9.3 |
0.0246
|
84.4% | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerabili | |
CVE-2026-71987 |
9.3 |
0.0246
|
84.4% | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerabili | |
CVE-2026-71988 |
9.3 |
0.0246
|
84.4% | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerabili | |
CVE-2026-71989 |
9.3 |
0.0246
|
84.4% | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerabili | |
CVE-2026-71990 |
9.3 |
0.0246
|
84.4% | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerabili | |
CVE-2026-71991 |
9.3 |
0.0246
|
84.4% | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerabili | |
CVE-2026-71992 |
9.3 |
0.0246
|
84.4% | 2026-08-09 | MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerabili |