Critical CVEs
3,589 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-76937 |
9.4 |
0.0045
|
39.4% | 2026-10-27 | Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This | |
CVE-2026-82122 |
9.4 |
0.0045
|
39.4% | 2026-10-27 | Stack-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Vers | |
CVE-2026-86575 |
9.4 |
0.0045
|
39.4% | 2026-10-27 | Stack-based Buffer Overflow Vulnerability in JP1 Products. This issue affects JP1/Integra | |
CVE-2026-86576 |
9.4 |
0.0045
|
39.4% | 2026-10-27 | Heap-based Buffer Overflow Vulnerability in JP1 Products. This issue affects JP1/Integrat | |
CVE-2026-46944 |
9.1 |
0.0045
|
39.3% | 2026-06-17 | Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Intern | |
CVE-2026-14973 |
9.3 |
0.0045
|
39.3% | 2026-07-28 | IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be w | |
CVE-2026-17423 |
9.1 |
0.0045
|
39.3% | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sens | |
CVE-2026-6886 |
9.3 |
0.0045
|
39.2% | 2026-04-23 | Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a Authent | |
CVE-2026-17111 |
9.8 |
0.0045
|
39.2% | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send s | |
CVE-2026-113211 |
9.6 |
0.0045
|
39.2% | 2026-10-20 | Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remot | |
CVE-2026-44597 |
9.1 |
0.0045
|
39.1% | 2026-05-07 | Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell | |
CVE-2026-54803 |
9.8 |
0.0045
|
39.1% | 2026-06-17 | Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.4 versions. | |
CVE-2026-57625 |
9.6 |
0.0045
|
39.1% | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8 | |
CVE-2026-62668 |
9.4 |
0.0045
|
39.1% | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your s | |
CVE-2026-48360 |
9.6 |
0.0045
|
39.1% | 2026-10-27 | Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') | |
CVE-2026-91214 |
9.8 |
0.0045
|
39.1% | 2026-10-20 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr | |
CVE-2026-91233 |
9.8 |
0.0045
|
39.1% | 2026-10-20 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Ente | |
CVE-2026-91234 |
9.8 |
0.0045
|
39.1% | 2026-10-20 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr | |
CVE-2026-91235 |
9.8 |
0.0045
|
39.1% | 2026-10-20 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr | |
CVE-2026-91236 |
9.8 |
0.0045
|
39.1% | 2026-10-20 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr | |
CVE-2026-6284 |
9.3 |
0.0045
|
39.1% | 2026-04-17 | An attacker with network access to the PLC is able to brute force discover passwords to ga | |
CVE-2026-11561 |
9.8 |
0.0045
|
39.1% | 2026-06-11 | Improper neutralization of special elements used in an expression language statement ('exp | |
CVE-2026-60208 |
9.1 |
0.0045
|
39.0% | 2026-07-21 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component | |
CVE-2026-54725 |
9.6 |
0.0045
|
39.0% | 2026-07-31 | vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection | |
CVE-2026-114196 |
9.8 |
0.0045
|
39.0% | 2026-10-24 | Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows O | |
CVE-2026-94075 |
9.8 |
0.0045
|
39.0% | 2026-10-24 | Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newslett | |
CVE-2026-62013 |
9.8 |
0.0045
|
39.1% | 2026-10-29 | Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. | |
CVE-2026-62018 |
9.8 |
0.0045
|
39.1% | 2026-10-29 | Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. | |
CVE-2025-62047 |
9.9 |
0.0045
|
39.0% | 2025-11-06 | Unrestricted Upload of File with Dangerous Type vulnerability in Case-Themes Case Addons c | |
CVE-2026-39589 |
9.9 |
0.0045
|
39.0% | 2026-06-17 | Subscriber Arbitrary File Upload in Webenvo <= 0.0.6 versions. | |
CVE-2026-47410 |
9.8 |
0.0045
|
39.0% | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versi | |
CVE-2026-70460 |
9.2 |
0.0045
|
38.9% | 2026-08-13 | rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious s | |
CVE-2026-72889 |
9.8 |
0.0045
|
39.0% | 2026-08-19 | Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorith | |
CVE-2026-93866 |
9.2 |
0.0045
|
39.0% | 2026-10-27 | An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard | |
CVE-2025-58627 |
9.8 |
0.0045
|
38.9% | 2025-11-06 | Authorization Bypass Through User-Controlled Key vulnerability in kamleshyadav Miraculous | |
CVE-2026-25660 |
9.3 |
0.0045
|
38.9% | 2026-04-24 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Sta | |
CVE-2026-8721 |
9.8 |
0.0045
|
38.9% | 2026-05-17 | Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NU | |
CVE-2026-11362 |
9.8 |
0.0045
|
38.9% | 2026-06-05 | DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. | |
CVE-2026-46858 |
9.1 |
0.0045
|
38.9% | 2026-06-17 | Vulnerability in the APM - Application Performance Management product of Oracle Enterprise | |
CVE-2026-60168 |
9.1 |
0.0045
|
38.9% | 2026-07-21 | Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Appli | |
CVE-2026-60591 |
9.1 |
0.0045
|
38.9% | 2026-08-18 | Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Appli | |
CVE-2026-62638 |
9.1 |
0.0045
|
38.9% | 2026-08-18 | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (compone | |
CVE-2026-70854 |
9.1 |
0.0045
|
38.9% | 2026-08-18 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (comp | |
CVE-2026-70976 |
9.1 |
0.0045
|
38.9% | 2026-08-18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager pr | |
CVE-2026-70977 |
9.1 |
0.0045
|
38.9% | 2026-08-18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager pr | |
CVE-2026-70979 |
9.1 |
0.0045
|
38.9% | 2026-08-18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager pr | |
CVE-2026-70981 |
9.1 |
0.0045
|
38.9% | 2026-08-18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager pr | |
CVE-2026-70984 |
9.1 |
0.0045
|
38.9% | 2026-08-18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager pr | |
CVE-2026-71102 |
9.1 |
0.0045
|
38.9% | 2026-08-18 | Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported | |
CVE-2025-61165 |
9.8 |
0.0045
|
38.9% | 2026-08-26 | An arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component of coher |