Critical CVEs
3,594 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-34002 |
9.1 |
0.0049
|
42.1% | 2026-05-05 | A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects | |
CVE-2026-17676 |
9.6 |
0.0049
|
42.1% | 2026-07-30 | Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 a | |
CVE-2026-111813 |
10.0 |
0.0049
|
42.1% | 2026-10-21 | Apache Traffic Server's experimental magick plugin lets an unauthenticated client control | |
CVE-2026-113399 |
9.8 |
0.0049
|
42.0% | 2026-10-20 | Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefo | |
CVE-2026-71424 |
9.6 |
0.0049
|
42.0% | 2026-08-17 | Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mc | |
CVE-2026-80098 |
9.3 |
0.0049
|
42.0% | 2026-09-03 | Improper verification of cryptographic signature in Copilot Studio allows an unauthorized | |
CVE-2026-41551 |
9.3 |
0.0049
|
42.0% | 2026-05-12 | A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions con | |
CVE-2026-20303 |
9.9 |
0.0049
|
41.9% | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco | |
CVE-2026-107081 |
9.8 |
0.0049
|
41.9% | 2026-10-19 | SQL injection via identifier injection in the tableName and tableFields POST parameters of | |
CVE-2026-86868 |
9.1 |
0.0049
|
42.0% | 2026-10-20 | An authentication issue was addressed with improved state management. This issue is fixed | |
CVE-2026-107058 |
9.8 |
0.0049
|
41.9% | 2026-10-29 | An issue in Shelter versionCode 445 allows attackers to register their own auth_key and ex | |
CVE-2026-61235 |
9.1 |
0.0049
|
41.8% | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Switzerland product of Oracl | |
CVE-2026-62546 |
9.1 |
0.0049
|
41.8% | 2026-07-21 | Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (com | |
CVE-2026-61034 |
9.1 |
0.0049
|
41.8% | 2026-08-18 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component | |
CVE-2026-70876 |
9.1 |
0.0049
|
41.8% | 2026-08-18 | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperi | |
CVE-2026-10879 |
9.8 |
0.0049
|
41.7% | 2026-06-05 | DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements wit | |
CVE-2026-115931 |
9.9 |
0.0049
|
41.7% | 2026-10-23 | Postiz lets a signed-in user ask the backend to run a function on one of their connected c | |
CVE-2026-40044 |
9.3 |
0.0048
|
41.7% | 2026-04-13 | Pachno 1.0.6 contains a deserialization vulnerability that allows unauthenticated attacker | |
CVE-2026-10560 |
9.1 |
0.0048
|
41.7% | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /a | |
CVE-2026-71195 |
9.9 |
0.0048
|
41.7% | 2026-10-21 | In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not | |
CVE-2026-110475 |
9.3 |
0.0048
|
41.7% | 2026-10-26 | This vulnerability exists in the CreditNirvana Collections Platform due to improper authen | |
CVE-2026-69399 |
9.8 |
0.0048
|
41.7% | 2026-09-17 | Azure Arc Elevation of Privilege Vulnerability | |
CVE-2026-90037 |
9.8 |
0.0048
|
41.7% | 2026-09-16 | In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent client | |
CVE-2025-13204 |
9.8 |
0.0048
|
41.7% | 2025-11-14 | npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to e | |
CVE-2026-33808 |
9.1 |
0.0048
|
41.6% | 2026-04-15 | Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to E | |
CVE-2026-35286 |
9.8 |
0.0048
|
41.6% | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone | |
CVE-2026-35292 |
10.0 |
0.0048
|
41.7% | 2026-06-17 | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Conso | |
CVE-2026-35293 |
9.8 |
0.0048
|
41.6% | 2026-06-17 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component | |
CVE-2026-35296 |
9.8 |
0.0048
|
41.6% | 2026-06-17 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component | |
CVE-2026-35301 |
10.0 |
0.0048
|
41.7% | 2026-06-17 | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Conso | |
CVE-2026-35310 |
9.8 |
0.0048
|
41.6% | 2026-06-17 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core | |
CVE-2026-35319 |
9.8 |
0.0048
|
41.6% | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone | |
CVE-2026-46783 |
9.8 |
0.0048
|
41.6% | 2026-06-17 | Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (compo | |
CVE-2026-46797 |
9.8 |
0.0048
|
41.6% | 2026-06-17 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component | |
CVE-2026-46798 |
10.0 |
0.0048
|
41.7% | 2026-06-17 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component | |
CVE-2026-46800 |
10.0 |
0.0048
|
41.7% | 2026-06-17 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component | |
CVE-2026-46801 |
9.8 |
0.0048
|
41.6% | 2026-06-17 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component | |
CVE-2026-46853 |
9.6 |
0.0048
|
41.6% | 2026-06-17 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise | |
CVE-2026-46878 |
9.8 |
0.0048
|
41.6% | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen | |
CVE-2026-46879 |
9.8 |
0.0048
|
41.6% | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen | |
CVE-2026-46880 |
9.8 |
0.0048
|
41.6% | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen | |
CVE-2026-46890 |
9.8 |
0.0048
|
41.7% | 2026-06-17 | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Mark | |
CVE-2026-46905 |
9.8 |
0.0048
|
41.6% | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen | |
CVE-2026-46909 |
9.8 |
0.0048
|
41.6% | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen | |
CVE-2026-47846 |
9.8 |
0.0048
|
41.6% | 2026-06-18 | Bitnami Cassandra container images are affected by a retained default superuser vulnerabil | |
CVE-2026-56030 |
9.8 |
0.0048
|
41.6% | 2026-06-26 | Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions. | |
CVE-2026-56033 |
9.8 |
0.0048
|
41.6% | 2026-06-26 | Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions. | |
CVE-2026-57813 |
9.8 |
0.0048
|
41.6% | 2026-07-13 | Incorrect Privilege Assignment vulnerability in properfraction MailOptin mailoptin allows | |
CVE-2026-61462 |
9.2 |
0.0048
|
41.6% | 2026-07-13 | mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index. | |
CVE-2026-64873 |
9.8 |
0.0048
|
41.6% | 2026-07-23 | Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query UR |