Critical CVEs
3,594 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-59099 |
9.3 |
0.0055
|
45.9% | 2026-07-02 | Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that allows remot | |
CVE-2026-57401 |
9.9 |
0.0055
|
45.9% | 2026-07-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabili | |
CVE-2026-60366 |
10.0 |
0.0055
|
45.9% | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware | |
CVE-2026-60367 |
9.8 |
0.0055
|
45.9% | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware | |
CVE-2026-60372 |
9.8 |
0.0055
|
45.9% | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware | |
CVE-2026-66662 |
9.8 |
0.0055
|
45.9% | 2026-08-06 | Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions. | |
CVE-2026-42370 |
9.8 |
0.0055
|
45.9% | 2026-05-04 | A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVisio | |
CVE-2026-17655 |
9.6 |
0.0055
|
45.8% | 2026-07-30 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.7 | |
CVE-2026-40620 |
9.3 |
0.0055
|
45.7% | 2026-04-24 | A vulnerability in SenseLive X3050’s embedded management service allows full administrativ | |
CVE-2026-22096 |
9.3 |
0.0055
|
45.8% | 2026-07-13 | The webserver running on port 8090 does not require authentication. This allows for sensit | |
CVE-2026-44887 |
9.8 |
0.0054
|
45.7% | 2026-05-27 | Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-0 | |
CVE-2026-60024 |
9.8 |
0.0054
|
45.7% | 2026-07-17 | Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8. | |
CVE-2026-17697 |
9.6 |
0.0054
|
45.7% | 2026-07-30 | Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker | |
CVE-2026-17032 |
9.8 |
0.0054
|
45.7% | 2026-08-06 | Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's c | |
CVE-2026-7415 |
9.8 |
0.0054
|
45.7% | 2026-05-07 | The MQTT broker embedded in Yarbo firmware v2.3.9 is configured to allow anonymous connect | |
CVE-2026-7166 |
9.2 |
0.0054
|
45.7% | 2026-06-22 | Vulnerability involving the exposure of sensitive data provided without adequate protectio | |
CVE-2026-45568 |
9.9 |
0.0054
|
45.7% | 2026-07-16 | zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, z | |
CVE-2026-63190 |
9.4 |
0.0054
|
45.7% | 2026-10-28 | FearlessCMS is a flat-file `content` management system centered on simplicity and open sou | |
CVE-2026-49973 |
9.2 |
0.0054
|
45.6% | 2026-06-11 | Hermes WebUI before version 0.51.358 contains an improper access control vulnerability tha | |
CVE-2026-12819 |
9.3 |
0.0054
|
45.6% | 2026-06-30 | Delta Electronics DVP12SE PLC exposes a Modbus TCP service over a specified port without a | |
CVE-2026-57828 |
9.0 |
0.0054
|
45.6% | 2026-07-11 | Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1 | |
CVE-2026-67341 |
9.3 |
0.0054
|
45.6% | 2026-08-01 | ArcadeDB versions before 26.7.2 fail to enforce scripting authorization checks on the SQL | |
CVE-2026-67342 |
9.3 |
0.0054
|
45.6% | 2026-08-01 | ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP hand | |
CVE-2026-41497 |
9.8 |
0.0054
|
45.5% | 2026-05-08 | PraisonAI is a multi-agent teams system. Prior to version 4.6.9, the fix for PraisonAI's M | |
CVE-2026-40783 |
9.9 |
0.0054
|
45.5% | 2026-06-17 | Contributor Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.37 versions. | |
CVE-2026-66396 |
9.3 |
0.0054
|
45.5% | 2026-07-27 | SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when re | |
CVE-2026-43779 |
9.8 |
0.0054
|
45.5% | 2026-07-27 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequo | |
CVE-2026-64702 |
9.8 |
0.0054
|
45.5% | 2026-07-27 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in | |
CVE-2026-1114 |
9.8 |
0.0054
|
45.4% | 2026-04-07 | In parisneo/lollms version 2.1.0, the application's session management is vulnerable to im | |
CVE-2026-6023 |
9.8 |
0.0054
|
45.4% | 2026-04-22 | In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter c | |
CVE-2026-39920 |
9.3 |
0.0054
|
45.4% | 2026-04-24 | BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis | |
CVE-2026-9711 |
9.8 |
0.0054
|
45.4% | 2026-06-30 | The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress (full) is vulne | |
CVE-2025-6519 |
9.3 |
0.0054
|
45.3% | 2025-09-02 | E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a d | |
CVE-2026-59139 |
9.1 |
0.0054
|
45.3% | 2026-07-21 | Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unva | |
CVE-2026-59140 |
9.1 |
0.0054
|
45.3% | 2026-07-21 | Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unva | |
CVE-2026-59141 |
9.1 |
0.0054
|
45.3% | 2026-07-21 | Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unva | |
CVE-2026-59142 |
9.1 |
0.0054
|
45.3% | 2026-07-21 | Data::HashMap::Shared versions before 0.14 for Perl allow an out-of-bounds read via an unv | |
CVE-2026-59145 |
9.1 |
0.0054
|
45.3% | 2026-07-21 | Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalid | |
CVE-2026-62420 |
9.9 |
0.0054
|
45.4% | 2026-08-12 | An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass ta | |
CVE-2026-63300 |
9.9 |
0.0054
|
45.4% | 2026-08-12 | An improper validation vulnerability in the instancePostMigration function in lxd/instance | |
CVE-2026-19001 |
9.5 |
0.0054
|
45.3% | 2026-08-12 | The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer w | |
CVE-2026-61564 |
10.0 |
0.0054
|
45.3% | 2026-10-28 | AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint | |
CVE-2026-51119 |
9.1 |
0.0054
|
45.3% | 2026-07-10 | An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the | |
CVE-2026-65048 |
9.3 |
0.0054
|
45.3% | 2026-07-21 | Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticate | |
CVE-2026-17552 |
9.1 |
0.0054
|
45.3% | 2026-07-27 | Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via un | |
CVE-2026-101809 |
10.0 |
0.0054
|
45.3% | 2026-10-20 | Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Noti | |
CVE-2026-43125 |
9.8 |
0.0054
|
45.3% | 2026-05-06 | In the Linux kernel, the following vulnerability has been resolved: dlm: validate length | |
CVE-2026-42369 |
10.0 |
0.0054
|
45.2% | 2026-05-04 | GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance ca | |
CVE-2026-44791 |
9.4 |
0.0054
|
45.2% | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, | |
CVE-2026-40005 |
9.1 |
0.0054
|
45.2% | 2026-07-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabili |