Critical CVEs
3,532 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-73924 |
9.1 |
0.0043
|
36.8% | 2026-08-18 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative We | |
CVE-2026-62009 |
9.8 |
0.0043
|
36.8% | 2026-10-29 | Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions. | |
CVE-2026-62014 |
9.8 |
0.0043
|
36.8% | 2026-10-29 | Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. | |
CVE-2026-34178 |
9.1 |
0.0042
|
36.7% | 2026-04-09 | In Canonical LXD before 6.8, the backup import path validates project restrictions against | |
CVE-2026-10539 |
9.5 |
0.0042
|
36.7% | 2026-07-01 | A Control-M/Server communication command does not sufficiently filter or sanitize user-sup | |
CVE-2026-20304 |
9.9 |
0.0042
|
36.7% | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco | |
CVE-2026-113078 |
9.6 |
0.0042
|
36.7% | 2026-10-20 | Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a | |
CVE-2026-113084 |
9.6 |
0.0042
|
36.7% | 2026-10-20 | Improper input validation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a | |
CVE-2023-29131 |
10.0 |
0.0042
|
36.7% | 2023-07-11 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Affected dev | |
CVE-2026-48875 |
9.3 |
0.0042
|
36.6% | 2026-06-17 | Unauthenticated SQL Injection in JetSmartFilters <= 3.8.1 versions. | |
CVE-2026-41052 |
9.4 |
0.0042
|
36.7% | 2026-06-29 | Improper privilege handling could be used by users with Project Owner role to escalate pri | |
CVE-2026-64863 |
9.1 |
0.0042
|
36.6% | 2026-07-28 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to | |
CVE-2025-11709 |
9.8 |
0.0042
|
36.5% | 2025-10-14 | A compromised web process was able to trigger out of bounds reads and writes in a more pri | |
CVE-2025-11710 |
9.8 |
0.0042
|
36.5% | 2025-10-14 | A compromised web process using malicious IPC messages could have caused the privileged br | |
CVE-2026-33615 |
9.1 |
0.0042
|
36.5% | 2026-04-02 | An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerabil | |
CVE-2026-62378 |
9.0 |
0.0042
|
36.5% | 2026-07-15 | RustFS Console is a web management console for the RustFS distributed file system. From 0. | |
CVE-2026-40289 |
9.1 |
0.0042
|
36.4% | 2026-04-14 | PraisonAI is a multi-agent teams system. In versions below 4.5.139 of PraisonAI and 1.5.14 | |
CVE-2026-65760 |
9.2 |
0.0042
|
36.5% | 2026-07-23 | Joomla Extension - joomshaper.com - cross-customer order and personal information disclosu | |
CVE-2026-96355 |
9.1 |
0.0042
|
36.4% | 2026-10-22 | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Dru | |
CVE-2026-71277 |
9.1 |
0.0042
|
36.4% | 2026-08-05 | rust-iot-platform's AuthToken request-guard implementation (api/src/main.rs) only checks w | |
CVE-2026-76571 |
9.3 |
0.0042
|
36.3% | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated SQL injection in list filter condition p | |
CVE-2026-101590 |
9.1 |
0.0042
|
36.3% | 2026-10-20 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-micro | |
CVE-2026-91265 |
9.1 |
0.0042
|
36.3% | 2026-10-20 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen | |
CVE-2026-91305 |
9.1 |
0.0042
|
36.3% | 2026-10-20 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen | |
CVE-2026-114607 |
9.1 |
0.0042
|
36.3% | 2026-10-22 | Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta | |
CVE-2026-40088 |
9.6 |
0.0042
|
36.2% | 2026-04-09 | PraisonAI is a multi-agent teams system. Prior to 4.5.121, the execute_command function an | |
CVE-2026-64829 |
9.1 |
0.0042
|
36.2% | 2026-07-22 | Question2Answer through 1.8.8 contains a session invalidation vulnerability that allows at | |
CVE-2026-102560 |
9.8 |
0.0042
|
36.2% | 2026-09-29 | A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a | |
CVE-2026-112709 |
9.2 |
0.0042
|
36.2% | 2026-10-27 | A heap-based buffer overflow vulnerability in the Fireware OS authentication service allow | |
CVE-2026-112710 |
9.2 |
0.0042
|
36.2% | 2026-10-27 | A heap-based buffer overflow vulnerability exists in the Fireware OS authentication servic | |
CVE-2026-62006 |
9.8 |
0.0042
|
36.2% | 2026-10-29 | Unauthenticated PHP Object Injection in Nuts <= 1.12 versions. | |
CVE-2026-62008 |
9.8 |
0.0042
|
36.2% | 2026-10-29 | Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. | |
CVE-2026-62012 |
9.8 |
0.0042
|
36.2% | 2026-10-29 | Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions. | |
CVE-2026-62017 |
9.8 |
0.0042
|
36.2% | 2026-10-29 | Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions. | |
CVE-2026-60034 |
9.4 |
0.0042
|
36.1% | 2026-07-20 | Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0 - | |
CVE-2026-112296 |
9.3 |
0.0042
|
36.1% | 2026-10-19 | FlyCms through commit edfdf724 contains a default credentials vulnerability that allows un | |
CVE-2026-11541 |
9.8 |
0.0042
|
36.0% | 2026-06-30 | IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebSphere Appl | |
CVE-2024-4457 |
9.1 |
0.0042
|
36.0% | 2026-10-18 | The Management Console fails to properly validate input related to the configuration of JD | |
CVE-2026-76466 |
9.8 |
0.0042
|
36.0% | 2026-10-21 | A vulnerability in the database service feature of Cisco Expressway Series could allow an | |
CVE-2026-35615 |
9.2 |
0.0042
|
35.9% | 2026-04-07 | PraisonAI is a multi-agent teams system. Prior to 1.5.113, _validate_path() calls os.path. | |
CVE-2026-29198 |
9.8 |
0.0042
|
35.9% | 2026-04-23 | In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a N | |
CVE-2026-46789 |
9.6 |
0.0042
|
35.9% | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone | |
CVE-2026-28698 |
9.2 |
0.0042
|
35.9% | 2026-07-23 | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system inform | |
CVE-2026-73329 |
9.2 |
0.0042
|
35.9% | 2026-08-12 | CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated | |
CVE-2026-73332 |
9.2 |
0.0042
|
35.9% | 2026-08-12 | CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form | |
CVE-2026-70958 |
9.6 |
0.0042
|
35.9% | 2026-08-18 | Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion | |
CVE-2026-16903 |
9.6 |
0.0042
|
35.9% | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arb | |
CVE-2026-87302 |
9.1 |
0.0042
|
35.9% | 2026-10-20 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component | |
CVE-2026-57116 |
9.8 |
0.0042
|
35.9% | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, Prai | |
CVE-2026-65184 |
9.8 |
0.0042
|
35.9% | 2026-10-26 | The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-s |