Critical CVEs
3,599 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-63808 |
9.8 |
0.0053
|
44.7% | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential | |
CVE-2026-45689 |
9.1 |
0.0053
|
44.6% | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior t | |
CVE-2026-93328 |
9.3 |
0.0053
|
44.5% | 2026-10-26 | Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolb | |
CVE-2026-65145 |
10.0 |
0.0053
|
44.6% | 2026-10-27 | NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing | |
CVE-2026-54859 |
9.8 |
0.0053
|
44.6% | 2026-10-29 | Unauthenticated PHP Object Injection in Preservation <= 1.15 versions. | |
CVE-2023-22793 |
9.3 |
0.0053
|
44.5% | 2026-10-29 | A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE | |
CVE-2026-57692 |
9.8 |
0.0053
|
44.5% | 2026-07-01 | Incorrect Privilege Assignment vulnerability in LCweb PrivateContent allows Privilege Esca | |
CVE-2026-57623 |
9.0 |
0.0053
|
44.5% | 2026-07-02 | Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions. | |
CVE-2026-58492 |
9.2 |
0.0053
|
44.5% | 2026-07-10 | grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableEx | |
CVE-2026-14446 |
9.8 |
0.0053
|
44.5% | 2026-07-28 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privi | |
CVE-2026-71193 |
9.6 |
0.0053
|
44.5% | 2026-08-12 | In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, an | |
CVE-2026-61567 |
10.0 |
0.0053
|
44.5% | 2026-10-28 | AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/vide | |
CVE-2026-54400 |
9.1 |
0.0052
|
44.5% | 2026-07-02 | A malicious actor with access to the network and high privileges could exploit an Improper | |
CVE-2026-64319 |
9.1 |
0.0052
|
44.4% | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate | |
CVE-2026-44542 |
9.1 |
0.0052
|
44.4% | 2026-05-14 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable | |
CVE-2026-14104 |
9.8 |
0.0052
|
44.3% | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150 | |
CVE-2026-14488 |
9.1 |
0.0052
|
44.4% | 2026-07-29 | The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the templ | |
CVE-2026-16839 |
9.4 |
0.0052
|
44.3% | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sens | |
CVE-2026-72320 |
9.1 |
0.0052
|
44.4% | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_lookup | |
CVE-2026-89672 |
9.1 |
0.0052
|
44.4% | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setac | |
CVE-2026-32956 |
9.3 |
0.0052
|
44.3% | 2026-04-20 | SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer ov | |
CVE-2026-56141 |
9.8 |
0.0052
|
44.3% | 2026-06-19 | In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3. | |
CVE-2026-9733 |
9.1 |
0.0052
|
44.3% | 2026-06-23 | Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure def | |
CVE-2026-57700 |
10.0 |
0.0052
|
44.3% | 2026-06-25 | Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows | |
CVE-2026-22547 |
9.1 |
0.0052
|
44.3% | 2026-07-03 | Gitea versions before 1.25.5 lack validation constraints for repository creation fields, i | |
CVE-2026-57719 |
10.0 |
0.0052
|
44.3% | 2026-07-13 | Unrestricted Upload of File with Dangerous Type vulnerability in CodeRevolution Aimogen Pr | |
CVE-2026-64874 |
9.8 |
0.0052
|
44.3% | 2026-07-23 | Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - | |
CVE-2026-64813 |
10.0 |
0.0052
|
44.3% | 2026-07-23 | In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible i | |
CVE-2026-63229 |
9.1 |
0.0052
|
44.3% | 2026-07-29 | A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthent | |
CVE-2026-63230 |
9.1 |
0.0052
|
44.3% | 2026-07-29 | A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an una | |
CVE-2026-14175 |
9.8 |
0.0052
|
44.3% | 2026-08-04 | Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Inform | |
CVE-2026-66665 |
10.0 |
0.0052
|
44.3% | 2026-08-06 | Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions. | |
CVE-2026-73996 |
9.8 |
0.0052
|
44.3% | 2026-08-18 | Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions. | |
CVE-2026-109422 |
9.2 |
0.0052
|
44.3% | 2026-10-12 | NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 | |
CVE-2026-109122 |
9.4 |
0.0052
|
44.3% | 2026-10-22 | The network management service on affected Kiloview E3 NDI encoder firmware fails to sanit | |
CVE-2026-31908 |
9.1 |
0.0052
|
44.2% | 2026-04-14 | Header injection vulnerability in Apache APISIX. The attacker can take advantage of certa | |
CVE-2026-46850 |
9.9 |
0.0052
|
44.3% | 2026-06-17 | Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). | |
CVE-2026-65885 |
9.4 |
0.0052
|
44.2% | 2026-07-29 | Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2 - | |
CVE-2026-70398 |
9.6 |
0.0052
|
44.2% | 2026-08-12 | A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Manag | |
CVE-2026-20184 |
9.8 |
0.0052
|
44.1% | 2026-04-15 | A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex | |
CVE-2026-7663 |
9.8 |
0.0052
|
44.2% | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access prote | |
CVE-2026-19656 |
9.9 |
0.0052
|
44.2% | 2026-08-12 | ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing an | |
CVE-2026-46807 |
9.8 |
0.0052
|
44.1% | 2026-06-17 | Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: OIM | |
CVE-2026-58081 |
9.8 |
0.0052
|
44.1% | 2026-08-19 | Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly check the si | |
CVE-2026-58082 |
9.8 |
0.0052
|
44.1% | 2026-08-19 | The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) for interme | |
CVE-2026-76934 |
9.8 |
0.0052
|
44.1% | 2026-10-27 | Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This | |
CVE-2026-76939 |
9.8 |
0.0052
|
44.1% | 2026-10-27 | Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This i | |
CVE-2026-82118 |
9.8 |
0.0052
|
44.1% | 2026-10-27 | Stack-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Vers | |
CVE-2026-86574 |
9.8 |
0.0052
|
44.1% | 2026-10-27 | Heap-based Buffer Overflow Vulnerability in JP1/Base. This issue affects JP1/Base: from 1 | |
CVE-2026-27843 |
9.2 |
0.0052
|
44.0% | 2026-04-24 | A vulnerability exists in SenseLive X3050's web management interface that allows critical |