Critical CVEs
3,516 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-8152 |
9.3 |
0.0041
|
35.6% | 2026-07-22 | Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based c | |
CVE-2026-50736 |
9.0 |
0.0041
|
35.7% | 2026-07-28 | The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL | |
CVE-2026-62629 |
9.4 |
0.0041
|
35.7% | 2026-08-18 | Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (compone | |
CVE-2026-85818 |
9.0 |
0.0041
|
35.7% | 2026-10-13 | Improper verification of cryptographic signature in Windows Schannel allows an unauthorize | |
CVE-2026-34285 |
9.1 |
0.0041
|
35.6% | 2026-04-21 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware | |
CVE-2026-34286 |
9.1 |
0.0041
|
35.6% | 2026-04-21 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware | |
CVE-2026-13883 |
9.6 |
0.0041
|
35.6% | 2026-06-30 | Type Confusion in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker | |
CVE-2026-14739 |
9.8 |
0.0041
|
35.6% | 2026-07-07 | DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements wit | |
CVE-2026-59506 |
9.3 |
0.0041
|
35.6% | 2026-08-13 | : Missing Authentication for Critical Function vulnerability in Priority Portal Generator | |
CVE-2026-73644 |
9.6 |
0.0041
|
35.5% | 2026-08-13 | OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorizat | |
CVE-2025-60553 |
9.8 |
0.0041
|
35.5% | 2025-10-24 | D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the curTime p | |
CVE-2026-50085 |
9.8 |
0.0041
|
35.5% | 2026-06-12 | The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command payloads, and f | |
CVE-2026-9222 |
9.2 |
0.0041
|
35.5% | 2026-06-26 | Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only requir | |
CVE-2026-3144 |
9.8 |
0.0041
|
35.5% | 2026-07-08 | IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an at | |
CVE-2026-40492 |
9.8 |
0.0041
|
35.4% | 2026-04-18 | SAIL is a cross-platform library for loading and saving images with support for animation, | |
CVE-2026-35283 |
9.9 |
0.0041
|
35.3% | 2026-06-17 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middlewa | |
CVE-2026-35284 |
9.9 |
0.0041
|
35.3% | 2026-06-17 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middlewa | |
CVE-2026-35285 |
9.9 |
0.0041
|
35.3% | 2026-06-17 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middlewa | |
CVE-2026-35294 |
9.9 |
0.0041
|
35.3% | 2026-06-17 | Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (compo | |
CVE-2026-35313 |
9.9 |
0.0041
|
35.3% | 2026-06-17 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: | |
CVE-2026-35316 |
9.9 |
0.0041
|
35.3% | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone | |
CVE-2026-35321 |
9.9 |
0.0041
|
35.3% | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone | |
CVE-2026-35323 |
9.9 |
0.0041
|
35.3% | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone | |
CVE-2026-46832 |
9.9 |
0.0041
|
35.4% | 2026-06-17 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise | |
CVE-2026-46838 |
9.9 |
0.0041
|
35.3% | 2026-06-17 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (componen | |
CVE-2026-46847 |
9.9 |
0.0041
|
35.3% | 2026-06-17 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (componen | |
CVE-2026-46854 |
9.9 |
0.0041
|
35.4% | 2026-06-17 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise | |
CVE-2026-46895 |
9.9 |
0.0041
|
35.4% | 2026-06-17 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Busine | |
CVE-2026-46907 |
9.9 |
0.0041
|
35.3% | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Order Promising product of Oracle JD Edwards | |
CVE-2026-46908 |
9.9 |
0.0041
|
35.3% | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Accounts Payable product of Oracle JD Edward | |
CVE-2026-46918 |
9.9 |
0.0041
|
35.3% | 2026-06-17 | Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E- | |
CVE-2026-46933 |
9.9 |
0.0041
|
35.3% | 2026-06-17 | Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (compo | |
CVE-2026-55518 |
9.6 |
0.0041
|
35.4% | 2026-07-17 | Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0. | |
CVE-2026-66398 |
9.4 |
0.0041
|
35.3% | 2026-07-27 | phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration | |
CVE-2026-45083 |
9.8 |
0.0041
|
35.2% | 2026-05-27 | The Goobi viewer is a web application that allows digitised material to be displayed in a | |
CVE-2026-61645 |
9.1 |
0.0041
|
35.3% | 2026-10-29 | Docat is a tool for hosting versioned static documentation. In the affected implementation | |
CVE-2026-47172 |
9.5 |
0.0041
|
35.2% | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. | |
CVE-2026-47365 |
9.9 |
0.0041
|
35.2% | 2026-06-12 | Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WH | |
CVE-2026-60032 |
9.4 |
0.0041
|
35.2% | 2026-07-20 | Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0 | |
CVE-2026-68586 |
9.2 |
0.0041
|
35.2% | 2026-08-03 | SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBa | |
CVE-2026-63158 |
9.1 |
0.0041
|
35.2% | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability tha | |
CVE-2025-65358 |
9.8 |
0.0041
|
35.1% | 2025-12-02 | Edoc-doctor-appointment-system v1.0.1 was discovered to contain SQl injection vulnerabilit | |
CVE-2026-112862 |
9.8 |
0.0041
|
35.0% | 2026-10-23 | Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database pa | |
CVE-2026-112853 |
9.8 |
0.0041
|
35.0% | 2026-10-23 | Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allow | |
CVE-2026-112857 |
9.8 |
0.0041
|
35.1% | 2026-10-23 | Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Obje | |
CVE-2026-115968 |
9.8 |
0.0041
|
35.0% | 2026-10-28 | Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimat | |
CVE-2026-112380 |
9.0 |
0.0041
|
34.9% | 2026-10-20 | Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote acto | |
CVE-2026-91341 |
9.1 |
0.0041
|
35.0% | 2026-10-20 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com | |
CVE-2026-76531 |
9.9 |
0.0041
|
35.0% | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has | |
CVE-2026-91225 |
9.1 |
0.0041
|
35.0% | 2026-10-20 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adap |