Critical CVEs
3,594 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-63106 |
9.3 |
0.0050
|
42.6% | 2026-08-10 | ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the | |
CVE-2026-76606 |
10.0 |
0.0050
|
42.5% | 2026-08-22 | Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2. | |
CVE-2026-91323 |
9.8 |
0.0050
|
42.6% | 2026-10-20 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component | |
CVE-2026-104354 |
9.1 |
0.0050
|
42.5% | 2026-10-27 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements | |
CVE-2026-6443 |
9.8 |
0.0050
|
42.5% | 2026-04-17 | All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in var | |
CVE-2026-26232 |
9.1 |
0.0050
|
42.5% | 2026-07-03 | Gitea versions before 1.25.5 do not consistently enforce OAuth2 authorization code expiry | |
CVE-2026-26247 |
9.1 |
0.0050
|
42.5% | 2026-07-03 | Gitea versions before 1.25.5 do not persist the OAuth2 PKCE S256 challenge method correctl | |
CVE-2026-51380 |
9.8 |
0.0050
|
42.5% | 2026-07-15 | Buffer Overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to | |
CVE-2026-28306 |
9.1 |
0.0050
|
42.5% | 2026-07-21 | SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain | |
CVE-2026-28307 |
9.1 |
0.0050
|
42.5% | 2026-07-21 | SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain | |
CVE-2026-28309 |
9.1 |
0.0050
|
42.5% | 2026-07-21 | SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domai | |
CVE-2026-28310 |
9.1 |
0.0050
|
42.5% | 2026-07-21 | SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain | |
CVE-2026-28313 |
9.1 |
0.0050
|
42.5% | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability | |
CVE-2026-28317 |
9.1 |
0.0050
|
42.5% | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability | |
CVE-2026-75856 |
9.2 |
0.0050
|
42.4% | 2026-08-18 | CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS | |
CVE-2026-111693 |
9.3 |
0.0050
|
42.4% | 2026-10-16 | DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability | |
CVE-2026-113014 |
9.6 |
0.0050
|
42.5% | 2026-10-20 | Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote | |
CVE-2026-113023 |
9.6 |
0.0050
|
42.5% | 2026-10-20 | Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a | |
CVE-2026-113089 |
9.6 |
0.0050
|
42.5% | 2026-10-20 | Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed | |
CVE-2026-113235 |
9.6 |
0.0050
|
42.5% | 2026-10-20 | Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a r | |
CVE-2026-113252 |
9.6 |
0.0050
|
42.5% | 2026-10-20 | Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 a | |
CVE-2026-113300 |
9.6 |
0.0050
|
42.5% | 2026-10-20 | Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote atta | |
CVE-2026-113328 |
9.6 |
0.0050
|
42.5% | 2026-10-20 | Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a rem | |
CVE-2026-113336 |
9.6 |
0.0050
|
42.4% | 2026-10-20 | Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote | |
CVE-2026-13221 |
9.1 |
0.0049
|
42.4% | 2026-07-13 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 | |
CVE-2026-47040 |
9.1 |
0.0049
|
42.4% | 2026-07-21 | Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported v | |
CVE-2026-61130 |
9.1 |
0.0049
|
42.4% | 2026-07-21 | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynam | |
CVE-2026-61155 |
9.1 |
0.0049
|
42.4% | 2026-07-21 | Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Com | |
CVE-2026-75837 |
9.3 |
0.0049
|
42.4% | 2026-08-18 | Grav before 2.0.14 fails to guard the access field in the core group blueprint with the re | |
CVE-2026-60728 |
9.1 |
0.0049
|
42.4% | 2026-08-18 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (componen | |
CVE-2026-60754 |
9.1 |
0.0049
|
42.4% | 2026-08-18 | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Mark | |
CVE-2026-70994 |
9.1 |
0.0049
|
42.4% | 2026-08-18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager pr | |
CVE-2026-70997 |
9.1 |
0.0049
|
42.4% | 2026-08-18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager pr | |
CVE-2026-45688 |
9.1 |
0.0049
|
42.4% | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior t | |
CVE-2026-50747 |
9.9 |
0.0049
|
42.4% | 2026-07-02 | A malicious actor with access to the network and low privileges could exploit a series of | |
CVE-2026-5483 |
9.9 |
0.0049
|
42.2% | 2026-04-10 | A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh- | |
CVE-2026-40621 |
9.3 |
0.0049
|
42.2% | 2026-05-13 | ELECOM wireless LAN access point devices do not require authentication to access some spec | |
CVE-2026-74406 |
9.8 |
0.0049
|
42.2% | 2026-08-15 | In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential | |
CVE-2026-89633 |
9.8 |
0.0049
|
42.2% | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB | |
CVE-2026-89078 |
9.9 |
0.0049
|
42.2% | 2026-09-24 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19. | |
CVE-2026-46386 |
9.9 |
0.0049
|
42.1% | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to , the official | |
CVE-2026-44935 |
9.9 |
0.0049
|
42.1% | 2026-07-02 | Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 | |
CVE-2026-76473 |
9.8 |
0.0049
|
42.2% | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, engineeri | |
CVE-2026-105780 |
9.9 |
0.0049
|
42.1% | 2026-10-27 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that | |
CVE-2026-54856 |
9.8 |
0.0049
|
42.2% | 2026-10-29 | Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | |
CVE-2026-54857 |
9.8 |
0.0049
|
42.2% | 2026-10-29 | Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | |
CVE-2026-54858 |
9.8 |
0.0049
|
42.2% | 2026-10-29 | Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. | |
CVE-2026-54860 |
9.8 |
0.0049
|
42.2% | 2026-10-29 | Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. | |
CVE-2025-58963 |
10.0 |
0.0049
|
42.1% | 2025-10-22 | Unrestricted Upload of File with Dangerous Type vulnerability in 7oroof Medcity medcity al | |
CVE-2026-34000 |
9.1 |
0.0049
|
42.1% | 2026-05-05 | A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB g |