Critical CVEs
3,593 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-7557 |
9.1 |
0.0046
|
40.1% | 2026-08-05 | An improper verification of cryptographic signature vulnerability in the SAML authenticati | |
CVE-2026-70452 |
9.1 |
0.0046
|
40.1% | 2026-08-13 | rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remot | |
CVE-2026-76035 |
9.6 |
0.0046
|
40.0% | 2026-08-18 | Inappropriate implementation in Media in Google Chrome on on Mac prior to 151.0.7922.169 a | |
CVE-2026-114053 |
9.2 |
0.0046
|
40.0% | 2026-10-21 | vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revis | |
CVE-2026-115245 |
9.8 |
0.0046
|
40.0% | 2026-10-29 | The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploade | |
CVE-2026-42376 |
9.8 |
0.0046
|
39.9% | 2026-05-04 | D-Link DIR-456U Hardware Revision A1 (End-of-Life, EOL) contains a hardcoded telnet backdo | |
CVE-2026-33646 |
9.6 |
0.0046
|
40.0% | 2026-06-26 | mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.3.10, mise p | |
CVE-2026-91299 |
10.0 |
0.0046
|
40.0% | 2026-10-20 | Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (c | |
CVE-2026-116233 |
9.4 |
0.0046
|
39.9% | 2026-10-26 | A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts a | |
CVE-2026-116234 |
9.4 |
0.0046
|
39.9% | 2026-10-26 | A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown funct | |
CVE-2026-112241 |
9.8 |
0.0046
|
39.8% | 2026-10-22 | Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allo | |
CVE-2026-20156 |
9.8 |
0.0046
|
39.8% | 2026-07-15 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco | |
CVE-2026-14960 |
9.8 |
0.0046
|
39.8% | 2026-07-15 | Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through | |
CVE-2026-12693 |
9.4 |
0.0046
|
39.8% | 2026-07-17 | Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise | |
CVE-2026-4277 |
9.8 |
0.0046
|
39.8% | 2026-04-07 | An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Add | |
CVE-2026-32327 |
9.1 |
0.0046
|
39.8% | 2026-08-06 | A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any | |
CVE-2026-116214 |
9.3 |
0.0046
|
39.7% | 2026-10-26 | MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allo | |
CVE-2026-102649 |
9.9 |
0.0046
|
39.7% | 2026-10-26 | Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prio | |
CVE-2026-67074 |
9.1 |
0.0046
|
39.7% | 2026-10-28 | HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attacke | |
CVE-2026-64391 |
9.8 |
0.0046
|
39.7% | 2026-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener cre | |
CVE-2026-68381 |
9.8 |
0.0046
|
39.7% | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: pin conn durin | |
CVE-2026-74611 |
9.8 |
0.0046
|
39.7% | 2026-08-22 | In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msg_ | |
CVE-2026-80694 |
9.8 |
0.0046
|
39.7% | 2026-08-28 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_et | |
CVE-2026-89530 |
9.8 |
0.0046
|
39.7% | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject inlin | |
CVE-2026-89550 |
9.8 |
0.0046
|
39.7% | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: | |
CVE-2026-89631 |
9.1 |
0.0046
|
39.7% | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a | |
CVE-2026-89652 |
9.8 |
0.0046
|
39.7% | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied de | |
CVE-2026-89676 |
9.8 |
0.0046
|
39.7% | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix stale s2s_c | |
CVE-2026-89702 |
9.8 |
0.0046
|
39.7% | 2026-09-11 | In the Linux kernel, the following vulnerability has been resolved: nfsd: size fh_verify | |
CVE-2026-33784 |
9.3 |
0.0046
|
39.6% | 2026-04-09 | A Use of Default Password vulnerability in the Juniper Networks Support Insights (JSI) | |
CVE-2026-16498 |
10.0 |
0.0046
|
39.6% | 2026-07-28 | The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential r | |
CVE-2026-10579 |
9.8 |
0.0046
|
39.6% | 2026-08-11 | A flaw was found in Picketlink Federation SAML; the unsolcited response handler would acce | |
CVE-2026-48765 |
9.9 |
0.0046
|
39.6% | 2026-08-11 | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read col | |
CVE-2026-86577 |
9.4 |
0.0046
|
39.6% | 2026-10-27 | Out-of-bounds Write Vulnerability in JP1 Products. This issue affects JP1/Integrated Mana | |
CVE-2026-35035 |
9.0 |
0.0046
|
39.5% | 2026-04-06 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2023-54342 |
9.3 |
0.0046
|
39.5% | 2026-05-05 | Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerabili | |
CVE-2026-7813 |
9.4 |
0.0046
|
39.5% | 2026-05-11 | Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Sha | |
CVE-2026-14121 |
9.8 |
0.0046
|
39.5% | 2026-06-30 | Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7871.47 allowed a re | |
CVE-2026-61203 |
9.4 |
0.0046
|
39.5% | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise FIN Expenses product of Oracle PeopleSoft (comp | |
CVE-2026-71166 |
9.4 |
0.0046
|
39.5% | 2026-08-18 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative We | |
CVE-2026-71167 |
9.4 |
0.0046
|
39.5% | 2026-08-18 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative We | |
CVE-2026-73920 |
9.4 |
0.0046
|
39.5% | 2026-08-18 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative We | |
CVE-2026-99078 |
9.8 |
0.0046
|
39.5% | 2026-10-23 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent st | |
CVE-2026-99079 |
9.8 |
0.0046
|
39.5% | 2026-10-23 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent st | |
CVE-2023-54223 |
9.8 |
0.0045
|
39.4% | 2025-12-30 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix i | |
CVE-2026-56067 |
9.3 |
0.0045
|
39.5% | 2026-06-26 | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions. | |
CVE-2026-52782 |
9.9 |
0.0045
|
39.4% | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17. | |
CVE-2026-57702 |
9.3 |
0.0045
|
39.4% | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-16626 |
9.3 |
0.0045
|
39.4% | 2026-08-10 | Improper restriction of XML external entity reference vulnerability (unauthenticated) in J | |
CVE-2026-115889 |
9.9 |
0.0045
|
39.4% | 2026-10-23 | Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler |