Critical CVEs
3,601 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-35268 |
9.9 |
0.0052
|
44.0% | 2026-06-17 | Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Core | |
CVE-2026-35312 |
9.8 |
0.0052
|
44.0% | 2026-06-17 | Vulnerability in the Oracle Virtual Directory product of Oracle Fusion Middleware (compone | |
CVE-2026-46773 |
9.8 |
0.0052
|
44.0% | 2026-06-17 | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (compone | |
CVE-2026-46774 |
9.8 |
0.0052
|
44.0% | 2026-06-17 | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (compone | |
CVE-2026-105781 |
10.0 |
0.0052
|
44.0% | 2026-10-27 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements | |
CVE-2026-105420 |
9.4 |
0.0052
|
44.0% | 2026-10-28 | Wing FTP Server does not verify user's base folder. An attacker with admin privileges can | |
CVE-2026-32998 |
9.4 |
0.0052
|
44.0% | 2026-05-28 | This vulnerability in Veeam Service Provider Console allows for remote code execution. | |
CVE-2026-8980 |
9.3 |
0.0052
|
44.0% | 2026-05-28 | The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to privilege escalat | |
CVE-2026-65884 |
10.0 |
0.0052
|
44.0% | 2026-07-29 | Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registrati | |
CVE-2026-65887 |
10.0 |
0.0052
|
44.0% | 2026-07-29 | Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.2 | |
CVE-2026-65888 |
10.0 |
0.0052
|
44.0% | 2026-07-29 | Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The | |
CVE-2026-64622 |
9.3 |
0.0052
|
43.9% | 2026-07-20 | Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured a | |
CVE-2026-103406 |
9.8 |
0.0052
|
43.9% | 2026-10-28 | An Improper Neutralization of Special Elements used in an OS Command vulnerability in the | |
CVE-2026-30993 |
9.8 |
0.0052
|
43.8% | 2026-04-15 | Slah CMS v1.5.0 and below was discovered to contain a remote code execution (RCE) vulnerab | |
CVE-2026-45261 |
9.3 |
0.0052
|
43.8% | 2026-05-28 | GitButler is a modern Git-based version control interface for AI-powered workflows. Prior | |
CVE-2026-55572 |
10.0 |
0.0052
|
43.9% | 2026-10-14 | e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's o | |
CVE-2023-0745 |
9.8 |
0.0051
|
43.8% | 2023-02-09 | The High Availability functionality of Yugabyte Anywhere can | |
CVE-2026-16407 |
9.8 |
0.0051
|
43.8% | 2026-07-21 | Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in F | |
CVE-2024-58307 |
9.3 |
0.0051
|
43.7% | 2025-12-11 | CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view fun | |
CVE-2026-56261 |
9.2 |
0.0051
|
43.7% | 2026-07-10 | Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the D | |
CVE-2024-51311 |
9.8 |
0.0051
|
43.7% | 2026-07-20 | The Tenda TX9 V22.03.02.05 firmware has a stack overflow vulnerability in the sub_4418CC f | |
CVE-2024-51313 |
9.8 |
0.0051
|
43.7% | 2026-07-20 | The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EA38 f | |
CVE-2024-51312 |
9.8 |
0.0051
|
43.7% | 2026-07-20 | The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EEE0 f | |
CVE-2024-51314 |
9.8 |
0.0051
|
43.7% | 2026-07-20 | The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_424CE0 f | |
CVE-2024-51315 |
9.8 |
0.0051
|
43.7% | 2026-07-20 | The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_425964 f | |
CVE-2023-53969 |
9.3 |
0.0051
|
43.6% | 2025-12-22 | Screen SFT DAB 600/C firmware 1.9.3 contains a session management vulnerability that allow | |
CVE-2026-64796 |
9.8 |
0.0051
|
43.7% | 2026-07-22 | Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension | |
CVE-2026-42933 |
10.0 |
0.0051
|
43.7% | 2026-07-23 | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vu | |
CVE-2026-65879 |
9.8 |
0.0051
|
43.6% | 2026-07-27 | Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wi | |
CVE-2026-2346 |
9.8 |
0.0051
|
43.7% | 2026-08-03 | Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mo | |
CVE-2026-18749 |
9.8 |
0.0051
|
43.6% | 2026-08-12 | The type=track branch authorises on _is_my_case(t_attach.case) only and never checks Vince | |
CVE-2026-42023 |
9.1 |
0.0051
|
43.7% | 2026-10-20 | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static | |
CVE-2026-42024 |
9.1 |
0.0051
|
43.7% | 2026-10-20 | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static | |
CVE-2026-42025 |
9.1 |
0.0051
|
43.7% | 2026-10-20 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6 | |
CVE-2026-42026 |
9.1 |
0.0051
|
43.7% | 2026-10-20 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6 | |
CVE-2026-9660 |
9.1 |
0.0051
|
43.7% | 2026-10-20 | Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilt | |
CVE-2026-9817 |
9.1 |
0.0051
|
43.7% | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality | |
CVE-2026-9869 |
9.1 |
0.0051
|
43.7% | 2026-10-20 | A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionalit | |
CVE-2026-114087 |
9.2 |
0.0051
|
43.7% | 2026-10-21 | Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets | |
CVE-2026-107861 |
9.4 |
0.0051
|
43.6% | 2026-10-22 | The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize | |
CVE-2026-110243 |
9.4 |
0.0051
|
43.6% | 2026-10-22 | The network management service on affected Kiloview E3 NDI encoder firmware fails to valid | |
CVE-2026-35431 |
10.0 |
0.0051
|
43.6% | 2026-04-23 | Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an | |
CVE-2026-53690 |
9.3 |
0.0051
|
43.6% | 2026-06-30 | An SQL Injection vulnerability exists in Redeight CMS version 1.0 via the "userEmail" para | |
CVE-2026-58473 |
9.3 |
0.0051
|
43.6% | 2026-07-07 | Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthen | |
CVE-2026-53431 |
9.1 |
0.0051
|
43.6% | 2026-07-30 | Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attack | |
CVE-2026-114268 |
9.4 |
0.0051
|
43.6% | 2026-10-21 | A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the | |
CVE-2026-61997 |
9.8 |
0.0051
|
43.6% | 2026-10-29 | Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions. | |
CVE-2026-62002 |
9.8 |
0.0051
|
43.6% | 2026-10-29 | Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions. | |
CVE-2026-42380 |
9.8 |
0.0051
|
43.5% | 2026-06-17 | Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions. | |
CVE-2026-13772 |
9.9 |
0.0051
|
43.5% | 2026-06-30 | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolv |