Critical CVEs
3,593 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-56266 |
9.2 |
0.0048
|
41.2% | 2026-06-22 | Crawl4AI before 0.8.7 contains a server-side request forgery vulnerability in the /crawl, | |
CVE-2026-2397 |
9.8 |
0.0048
|
41.1% | 2026-07-10 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-5134 |
9.8 |
0.0048
|
41.1% | 2026-08-06 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-43632 |
9.2 |
0.0048
|
41.2% | 2026-08-06 | llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in | |
CVE-2026-105489 |
9.9 |
0.0048
|
41.1% | 2026-10-27 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements | |
CVE-2026-61998 |
9.8 |
0.0048
|
41.1% | 2026-10-29 | Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions. | |
CVE-2026-62001 |
9.8 |
0.0048
|
41.1% | 2026-10-29 | Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions. | |
CVE-2026-7372 |
9.0 |
0.0047
|
41.1% | 2026-05-04 | A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVisio | |
CVE-2026-57433 |
9.8 |
0.0047
|
41.1% | 2026-07-13 | Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a | |
CVE-2026-69083 |
9.9 |
0.0047
|
41.1% | 2026-08-03 | SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchA | |
CVE-2026-47754 |
9.3 |
0.0047
|
41.1% | 2026-08-10 | Metacat is data repository software that helps researchers preserve, share, and discover d | |
CVE-2026-113186 |
9.6 |
0.0047
|
41.1% | 2026-10-20 | Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote att | |
CVE-2026-113189 |
9.6 |
0.0047
|
41.1% | 2026-10-20 | Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker t | |
CVE-2026-113261 |
9.6 |
0.0047
|
41.1% | 2026-10-20 | Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote | |
CVE-2026-113270 |
9.6 |
0.0047
|
41.1% | 2026-10-20 | Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attac | |
CVE-2026-113283 |
9.6 |
0.0047
|
41.1% | 2026-10-20 | Memory corruption in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078 | |
CVE-2026-113342 |
9.6 |
0.0047
|
41.1% | 2026-10-20 | Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote atta | |
CVE-2026-35304 |
9.8 |
0.0047
|
41.0% | 2026-06-17 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core | |
CVE-2026-35307 |
10.0 |
0.0047
|
41.0% | 2026-06-17 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core | |
CVE-2026-35308 |
10.0 |
0.0047
|
41.0% | 2026-06-17 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Cent | |
CVE-2026-46803 |
10.0 |
0.0047
|
41.0% | 2026-06-17 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (componen | |
CVE-2026-46845 |
9.8 |
0.0047
|
41.0% | 2026-06-17 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (componen | |
CVE-2026-46884 |
9.8 |
0.0047
|
41.0% | 2026-06-17 | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Mark | |
CVE-2026-46887 |
9.8 |
0.0047
|
41.0% | 2026-06-17 | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Mark | |
CVE-2026-46889 |
9.8 |
0.0047
|
41.0% | 2026-06-17 | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Mark | |
CVE-2026-16184 |
9.8 |
0.0047
|
41.0% | 2026-07-28 | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass auth | |
CVE-2026-76474 |
9.8 |
0.0047
|
41.0% | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, engineeri | |
CVE-2026-35309 |
9.8 |
0.0047
|
40.9% | 2026-06-17 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Cent | |
CVE-2026-46766 |
9.8 |
0.0047
|
40.9% | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone | |
CVE-2026-46778 |
10.0 |
0.0047
|
40.9% | 2026-06-17 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middlewa | |
CVE-2026-46781 |
10.0 |
0.0047
|
40.9% | 2026-06-17 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middlewa | |
CVE-2026-46799 |
9.8 |
0.0047
|
40.9% | 2026-06-17 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component | |
CVE-2026-46813 |
9.8 |
0.0047
|
40.9% | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone | |
CVE-2026-46856 |
9.6 |
0.0047
|
40.9% | 2026-06-17 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise | |
CVE-2026-46860 |
9.8 |
0.0047
|
40.9% | 2026-06-17 | Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). S | |
CVE-2026-46881 |
9.8 |
0.0047
|
40.9% | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen | |
CVE-2026-46882 |
9.8 |
0.0047
|
40.9% | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen | |
CVE-2026-46883 |
9.8 |
0.0047
|
40.9% | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen | |
CVE-2026-46902 |
9.8 |
0.0047
|
40.9% | 2026-06-17 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Busine | |
CVE-2026-46904 |
9.8 |
0.0047
|
40.9% | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen | |
CVE-2026-59891 |
9.6 |
0.0047
|
40.9% | 2026-07-14 | sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to | |
CVE-2026-44126 |
9.2 |
0.0047
|
40.9% | 2026-05-08 | SEPPmail Secure Email Gateway before version 15.0.4 insecurely deserializes untrusted data | |
CVE-2026-32661 |
9.3 |
0.0047
|
40.8% | 2026-05-13 | Stack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWAL | |
CVE-2026-86384 |
9.8 |
0.0047
|
40.9% | 2026-10-28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 relea | |
CVE-2026-64637 |
9.9 |
0.0047
|
40.8% | 2026-08-07 | Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authen | |
CVE-2026-93857 |
9.2 |
0.0047
|
40.8% | 2026-10-27 | A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, un | |
CVE-2026-49252 |
9.9 |
0.0047
|
40.7% | 2026-06-18 | deepstream is a server that allows clients and backend services to sync data, send message | |
CVE-2026-91665 |
9.8 |
0.0047
|
40.6% | 2026-10-20 | Vulnerability in Oracle Essbase (component: Security). The supported version that is aff | |
CVE-2026-103693 |
9.0 |
0.0047
|
40.6% | 2026-10-29 | The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before | |
CVE-2026-16359 |
9.1 |
0.0047
|
40.6% | 2026-07-21 | Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fi |