Critical CVEs
3,594 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-59540 |
9.8 |
0.0048
|
41.6% | 2026-07-23 | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions. | |
CVE-2026-61951 |
9.8 |
0.0048
|
41.6% | 2026-07-23 | Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions. | |
CVE-2026-64812 |
10.0 |
0.0048
|
41.6% | 2026-07-23 | In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Re | |
CVE-2026-16504 |
9.8 |
0.0048
|
41.6% | 2026-07-31 | Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing | |
CVE-2026-17351 |
9.4 |
0.0048
|
41.6% | 2026-07-31 | The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the | |
CVE-2026-71214 |
9.8 |
0.0048
|
41.6% | 2026-08-05 | The Aerie/PlanDev sequencing-server's authorization middleware (sequencing-server/src/app. | |
CVE-2026-28005 |
9.8 |
0.0048
|
41.6% | 2026-08-06 | Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versi | |
CVE-2026-65507 |
9.8 |
0.0048
|
41.6% | 2026-08-06 | Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions. | |
CVE-2026-61967 |
9.8 |
0.0048
|
41.6% | 2026-08-13 | Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions. | |
CVE-2026-66424 |
9.8 |
0.0048
|
41.6% | 2026-08-13 | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions. | |
CVE-2026-66691 |
9.8 |
0.0048
|
41.6% | 2026-08-13 | Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions. | |
CVE-2026-84999 |
9.8 |
0.0048
|
41.6% | 2026-10-28 | The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Uplo | |
CVE-2026-91216 |
10.0 |
0.0048
|
41.6% | 2026-10-20 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr | |
CVE-2026-91231 |
10.0 |
0.0048
|
41.6% | 2026-10-20 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adap | |
CVE-2026-91221 |
10.0 |
0.0048
|
41.6% | 2026-10-20 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr | |
CVE-2026-35280 |
9.9 |
0.0048
|
41.6% | 2026-06-17 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middlewa | |
CVE-2026-35281 |
9.9 |
0.0048
|
41.6% | 2026-06-17 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middlewa | |
CVE-2026-64815 |
9.8 |
0.0048
|
41.5% | 2026-07-23 | In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Desi | |
CVE-2026-46752 |
10.0 |
0.0048
|
41.5% | 2026-06-25 | Redis Lua HEAP overflow in cjson library vulnerability in Apache Kvrocks. This issue affe | |
CVE-2026-47724 |
9.9 |
0.0048
|
41.5% | 2026-07-23 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. | |
CVE-2026-33117 |
9.1 |
0.0048
|
41.4% | 2026-05-12 | The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local c | |
CVE-2026-7165 |
9.4 |
0.0048
|
41.4% | 2026-06-22 | The vulnerability is present in the ‘/addJugador’ endpoint: * The 'keyJugador' and 'key | |
CVE-2026-55500 |
9.9 |
0.0048
|
41.4% | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoin | |
CVE-2026-56027 |
9.9 |
0.0048
|
41.4% | 2026-06-26 | Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions. | |
CVE-2026-56058 |
9.9 |
0.0048
|
41.4% | 2026-06-26 | Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions. | |
CVE-2026-56059 |
9.9 |
0.0048
|
41.4% | 2026-06-26 | Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions. | |
CVE-2026-27419 |
9.9 |
0.0048
|
41.4% | 2026-07-02 | Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions. | |
CVE-2026-57710 |
9.9 |
0.0048
|
41.4% | 2026-07-13 | Unrestricted Upload of File with Dangerous Type vulnerability in quantumcloud WoowBot Pro | |
CVE-2026-22752 |
9.6 |
0.0048
|
41.3% | 2026-07-16 | Authentication bypass by primary weakness vulnerability in Spring Security Spring Authoriz | |
CVE-2026-8982 |
10.0 |
0.0048
|
41.4% | 2026-07-21 | Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V | |
CVE-2026-17691 |
9.6 |
0.0048
|
41.3% | 2026-07-30 | Out of bounds write in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a | |
CVE-2026-17695 |
9.6 |
0.0048
|
41.3% | 2026-07-30 | Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allow | |
CVE-2026-32463 |
9.9 |
0.0048
|
41.4% | 2026-08-18 | Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions. | |
CVE-2026-32474 |
9.9 |
0.0048
|
41.4% | 2026-08-18 | Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions. | |
CVE-2026-66627 |
9.9 |
0.0048
|
41.4% | 2026-08-18 | Unrestricted Upload of File with Dangerous Type vulnerability in EDGE22 Studios Ltd. GP Pr | |
CVE-2026-74014 |
9.9 |
0.0048
|
41.4% | 2026-08-20 | Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions. | |
CVE-2026-90864 |
9.1 |
0.0048
|
41.3% | 2026-10-29 | A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0 | |
CVE-2026-40884 |
9.8 |
0.0048
|
41.3% | 2026-04-21 | goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP a | |
CVE-2026-44717 |
9.8 |
0.0048
|
41.2% | 2026-05-15 | MCP Calculate Server is a mathematical calculation service based on MCP protocol and SymPy | |
CVE-2026-11414 |
10.0 |
0.0048
|
41.2% | 2026-06-05 | A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download U | |
CVE-2026-18363 |
9.1 |
0.0048
|
41.2% | 2026-07-30 | A logic vulnerability in the password reset token validation routine implemented by osTick | |
CVE-2026-42090 |
9.6 |
0.0048
|
41.2% | 2026-05-04 | Notesnook is a note-taking app focused on user privacy & ease of use. Prior to Notesnook W | |
CVE-2026-42021 |
9.1 |
0.0048
|
41.2% | 2026-10-20 | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static | |
CVE-2026-42022 |
9.1 |
0.0048
|
41.2% | 2026-10-20 | Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static | |
CVE-2026-109391 |
9.2 |
0.0048
|
41.2% | 2026-10-12 | Square Squash through commit e73f280 contains an insecure deserialization vulnerability th | |
CVE-2026-44643 |
9.3 |
0.0048
|
41.2% | 2026-05-11 | Angular Expressions provides expressions for the Angular.JS web framework as a standalone | |
CVE-2026-49085 |
9.8 |
0.0048
|
41.1% | 2026-06-15 | Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elemento | |
CVE-2026-49104 |
9.8 |
0.0048
|
41.1% | 2026-06-15 | Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form | |
CVE-2026-49105 |
9.8 |
0.0048
|
41.1% | 2026-06-15 | Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, | |
CVE-2026-9691 |
9.8 |
0.0048
|
41.1% | 2026-06-15 | Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, |