Critical CVEs
3,502 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-13449 |
9.1 |
0.0041
|
34.9% | 2026-06-30 | IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML | |
CVE-2026-13603 |
9.0 |
0.0041
|
34.8% | 2026-07-01 | The payment integration pretix-oppwa provides support for the payment providers VR Paymen | |
CVE-2026-10577 |
10.0 |
0.0041
|
34.8% | 2026-07-14 | A security issue exists within the 1715-AENTR EtherNet/IP Adapter. The affected product ex | |
CVE-2026-76607 |
10.0 |
0.0041
|
34.8% | 2026-08-22 | Joomla Extension - fabrikar.com - Missing ACL check in download element in Fabrik < 4.7.2. | |
CVE-2026-77995 |
10.0 |
0.0041
|
34.8% | 2026-08-24 | Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client | |
CVE-2026-25775 |
9.3 |
0.0040
|
34.7% | 2026-04-24 | A vulnerability in SenseLive X3050’s remote management service allows firmware retrieval a | |
CVE-2026-46809 |
9.1 |
0.0040
|
34.8% | 2026-06-17 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component | |
CVE-2026-46930 |
9.1 |
0.0040
|
34.7% | 2026-06-17 | Vulnerability in the Oracle In-Memory Cost Management for Discrete Industries product of O | |
CVE-2026-46949 |
9.1 |
0.0040
|
34.7% | 2026-06-17 | Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite | |
CVE-2026-115375 |
9.4 |
0.0040
|
34.8% | 2026-10-22 | Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability th | |
CVE-2026-115377 |
9.4 |
0.0040
|
34.8% | 2026-10-22 | Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file | |
CVE-2026-15089 |
9.1 |
0.0040
|
34.7% | 2026-07-10 | Vulnerability in Drupal Commerce guest registration. This issue affects Commerce guest reg | |
CVE-2026-62414 |
9.1 |
0.0040
|
34.7% | 2026-07-20 | Joomla Extension - joomlack.fr - Improper access control in Page Builder CK < 3.6.2 - The | |
CVE-2026-13072 |
9.2 |
0.0040
|
34.6% | 2026-07-22 | When compute mode is enabled on a standalone mongod instance, insufficient validation of e | |
CVE-2026-14804 |
9.1 |
0.0040
|
34.7% | 2026-08-04 | Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consul | |
CVE-2026-111732 |
9.3 |
0.0040
|
34.6% | 2026-10-29 | P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data le | |
CVE-2026-8363 |
9.8 |
0.0040
|
34.6% | 2026-05-27 | A stack-based buffer overflow condition exists in WOSDeviceDropFolder.dll when processing | |
CVE-2026-46852 |
9.9 |
0.0040
|
34.5% | 2026-06-17 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise | |
CVE-2026-48170 |
9.1 |
0.0040
|
34.5% | 2026-08-07 | `scim-patch`, a library to perform SCIM patch, prior to version 0.9.1 performs prototype p | |
CVE-2026-80587 |
9.8 |
0.0040
|
34.5% | 2026-08-26 | In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combinin | |
CVE-2026-35282 |
9.9 |
0.0040
|
34.5% | 2026-06-17 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middlewa | |
CVE-2026-46765 |
9.9 |
0.0040
|
34.5% | 2026-06-17 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (componen | |
CVE-2026-46767 |
9.9 |
0.0040
|
34.5% | 2026-06-17 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (componen | |
CVE-2026-46779 |
9.9 |
0.0040
|
34.5% | 2026-06-17 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middlewa | |
CVE-2026-46782 |
9.9 |
0.0040
|
34.5% | 2026-06-17 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middlewa | |
CVE-2026-46792 |
9.9 |
0.0040
|
34.5% | 2026-06-17 | Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (compo | |
CVE-2026-46793 |
9.9 |
0.0040
|
34.5% | 2026-06-17 | Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (compo | |
CVE-2026-46802 |
9.9 |
0.0040
|
34.5% | 2026-06-17 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (componen | |
CVE-2026-46814 |
9.9 |
0.0040
|
34.5% | 2026-06-17 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (componen | |
CVE-2026-46844 |
9.9 |
0.0040
|
34.5% | 2026-06-17 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (componen | |
CVE-2026-46900 |
9.9 |
0.0040
|
34.5% | 2026-06-17 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Busine | |
CVE-2026-46963 |
9.9 |
0.0040
|
34.5% | 2026-06-17 | Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (compo | |
CVE-2026-46964 |
9.9 |
0.0040
|
34.5% | 2026-06-17 | Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (compo | |
CVE-2026-56223 |
9.3 |
0.0040
|
34.4% | 2026-06-24 | Capgo before 12.128.2 contains a cross-domain SSO account takeover vulnerability in the pr | |
CVE-2026-55570 |
9.0 |
0.0040
|
34.4% | 2026-06-24 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, it does not | |
CVE-2026-40258 |
9.1 |
0.0040
|
34.3% | 2026-04-17 | The Gramps Web API is a Python REST API for the genealogical research software Gramps. Ver | |
CVE-2026-43899 |
9.6 |
0.0040
|
34.4% | 2026-05-11 | DeepChat is an open-source artificial intelligence agent platform that unifies models, too | |
CVE-2026-65766 |
9.2 |
0.0040
|
34.3% | 2026-07-27 | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in SP Page Builder < 6. | |
CVE-2026-108142 |
9.1 |
0.0040
|
34.3% | 2026-10-27 | A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Co | |
CVE-2026-34571 |
9.0 |
0.0040
|
34.2% | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-49764 |
9.8 |
0.0040
|
34.3% | 2026-06-15 | Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions. | |
CVE-2026-54843 |
9.3 |
0.0040
|
34.3% | 2026-06-25 | Unauthenticated SQL Injection in MDTF <= 1.3.7 versions. | |
CVE-2026-54849 |
9.3 |
0.0040
|
34.3% | 2026-06-25 | Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions. | |
CVE-2026-54820 |
9.3 |
0.0040
|
34.3% | 2026-06-26 | Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions. | |
CVE-2026-54827 |
9.3 |
0.0040
|
34.3% | 2026-06-26 | Unauthenticated SQL Injection in Real Estate 7 <= 3.5.9 versions. | |
CVE-2026-54831 |
9.3 |
0.0040
|
34.3% | 2026-06-26 | Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions. | |
CVE-2026-56034 |
9.3 |
0.0040
|
34.3% | 2026-06-26 | Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions. | |
CVE-2026-56036 |
9.3 |
0.0040
|
34.3% | 2026-06-26 | Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions. | |
CVE-2026-56068 |
9.3 |
0.0040
|
34.3% | 2026-06-26 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions. | |
CVE-2026-57679 |
9.3 |
0.0040
|
34.3% | 2026-07-02 | Unauthenticated SQL Injection in GeekyBot <= 1.2.5 versions. |