Critical CVEs
3,594 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-16359 |
9.1 |
0.0047
|
40.6% | 2026-07-21 | Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fi | |
CVE-2026-64392 |
9.1 |
0.0047
|
40.6% | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener cre | |
CVE-2026-8402 |
9.8 |
0.0047
|
40.5% | 2026-06-30 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-55115 |
9.9 |
0.0047
|
40.6% | 2026-07-02 | A malicious actor with access to the network and low privileges could exploit a Server-Sid | |
CVE-2026-4321 |
9.8 |
0.0047
|
40.5% | 2026-07-03 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-13020 |
9.8 |
0.0047
|
40.5% | 2026-07-07 | A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS | |
CVE-2026-8307 |
9.8 |
0.0047
|
40.5% | 2026-07-08 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-5955 |
9.8 |
0.0047
|
40.5% | 2026-07-09 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-8297 |
9.8 |
0.0047
|
40.5% | 2026-07-17 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-54051 |
9.9 |
0.0047
|
40.5% | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.9.1, the a | |
CVE-2026-1617 |
9.8 |
0.0047
|
40.5% | 2026-07-21 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-2395 |
9.8 |
0.0047
|
40.5% | 2026-07-22 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2026-64691 |
9.8 |
0.0047
|
40.5% | 2026-07-27 | A buffer overflow was addressed with improved size validation. This issue is fixed in macO | |
CVE-2026-4978 |
9.8 |
0.0047
|
40.5% | 2026-07-30 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulne | |
CVE-2025-55787 |
9.8 |
0.0047
|
40.5% | 2026-09-17 | In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists. | |
CVE-2026-54061 |
9.1 |
0.0047
|
40.5% | 2026-07-08 | Dgraph is an open source distributed GraphQL database. Prior to version 25.3.5, Dgraph Alp | |
CVE-2026-17701 |
9.6 |
0.0047
|
40.5% | 2026-07-30 | Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 151.0 | |
CVE-2026-93228 |
9.1 |
0.0047
|
40.4% | 2026-09-24 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject Write | |
CVE-2026-34260 |
9.6 |
0.0047
|
40.3% | 2026-05-12 | SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that a | |
CVE-2026-52706 |
9.8 |
0.0047
|
40.4% | 2026-06-17 | Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions. | |
CVE-2026-60369 |
9.9 |
0.0047
|
40.4% | 2026-07-22 | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware | |
CVE-2026-17276 |
9.9 |
0.0047
|
40.3% | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privi | |
CVE-2026-112992 |
9.6 |
0.0047
|
40.3% | 2026-10-20 | Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attac | |
CVE-2026-113007 |
9.6 |
0.0047
|
40.3% | 2026-10-20 | Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote | |
CVE-2026-113056 |
9.6 |
0.0047
|
40.3% | 2026-10-20 | Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a rem | |
CVE-2026-113116 |
9.6 |
0.0047
|
40.3% | 2026-10-20 | Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attack | |
CVE-2026-113126 |
9.6 |
0.0047
|
40.3% | 2026-10-20 | Memory corruption in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a rem | |
CVE-2026-113138 |
9.6 |
0.0047
|
40.3% | 2026-10-20 | Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remo | |
CVE-2026-113169 |
9.6 |
0.0047
|
40.3% | 2026-10-20 | Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 | |
CVE-2026-113171 |
9.6 |
0.0047
|
40.3% | 2026-10-20 | Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed | |
CVE-2026-113222 |
9.6 |
0.0047
|
40.3% | 2026-10-20 | Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to | |
CVE-2025-65656 |
9.8 |
0.0046
|
40.3% | 2025-12-02 | dcat-admin v2.2.3-beta and before is vulnerable to file inclusion in admin/src/Extend/Vers | |
CVE-2026-39591 |
9.9 |
0.0046
|
40.3% | 2026-06-15 | Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions. | |
CVE-2026-22327 |
9.9 |
0.0046
|
40.3% | 2026-06-17 | Subscriber Arbitrary File Upload in Restaurt <= 1.0.4 versions. | |
CVE-2026-113263 |
9.6 |
0.0046
|
40.3% | 2026-10-20 | Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a rem | |
CVE-2026-34072 |
9.8 |
0.0046
|
40.2% | 2026-04-01 | Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live loggin | |
CVE-2026-34456 |
9.8 |
0.0046
|
40.2% | 2026-04-01 | Reviactyl is an open-source game server management panel built using Laravel, React, Filam | |
CVE-2026-22874 |
9.6 |
0.0046
|
40.2% | 2026-07-03 | Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and m | |
CVE-2026-15704 |
9.8 |
0.0046
|
40.2% | 2026-07-24 | In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployment | |
CVE-2026-55089 |
9.9 |
0.0046
|
40.2% | 2026-08-19 | Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/ | |
CVE-2025-62818 |
9.8 |
0.0046
|
40.2% | 2026-04-07 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos | |
CVE-2026-35298 |
9.1 |
0.0046
|
40.1% | 2026-06-17 | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core) | |
CVE-2026-8649 |
9.8 |
0.0046
|
40.1% | 2026-07-08 | Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress | |
CVE-2026-8709 |
9.9 |
0.0046
|
40.2% | 2026-08-05 | An improper privilege management vulnerability in the REST API document patch operation of | |
CVE-2026-9193 |
9.9 |
0.0046
|
40.2% | 2026-08-05 | An improper privilege management vulnerability in the Hadoop integration of Progress MarkL | |
CVE-2026-93865 |
9.2 |
0.0046
|
40.1% | 2026-10-27 | A missing authentication vulnerability in the Fireware OS FireCluster synchronization daem | |
CVE-2026-46875 |
9.1 |
0.0046
|
40.1% | 2026-06-17 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise | |
CVE-2026-46896 |
9.1 |
0.0046
|
40.1% | 2026-06-17 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Busine | |
CVE-2026-46945 |
9.1 |
0.0046
|
40.1% | 2026-06-17 | Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Intern | |
CVE-2026-46946 |
9.1 |
0.0046
|
40.1% | 2026-06-17 | Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Intern |