Critical CVEs
3,497 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-57726 |
9.3 |
0.0040
|
34.3% | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-57739 |
9.3 |
0.0040
|
34.3% | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-59515 |
9.3 |
0.0040
|
34.3% | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-59514 |
9.3 |
0.0040
|
34.3% | 2026-07-23 | Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions. | |
CVE-2026-59525 |
9.3 |
0.0040
|
34.3% | 2026-07-23 | Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions. | |
CVE-2026-59526 |
9.3 |
0.0040
|
34.3% | 2026-07-23 | Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. | |
CVE-2026-61948 |
9.3 |
0.0040
|
34.3% | 2026-07-23 | Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions. | |
CVE-2026-61950 |
9.3 |
0.0040
|
34.3% | 2026-07-23 | Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions. | |
CVE-2026-48144 |
9.1 |
0.0040
|
34.3% | 2026-07-27 | Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_gli | |
CVE-2026-59527 |
9.3 |
0.0040
|
34.3% | 2026-07-27 | Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. | |
CVE-2026-59533 |
9.3 |
0.0040
|
34.3% | 2026-07-27 | Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions. | |
CVE-2026-59538 |
9.3 |
0.0040
|
34.3% | 2026-07-27 | Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions. | |
CVE-2026-59549 |
9.3 |
0.0040
|
34.3% | 2026-07-27 | Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 v | |
CVE-2026-59550 |
9.3 |
0.0040
|
34.3% | 2026-07-27 | Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions. | |
CVE-2026-65508 |
9.3 |
0.0040
|
34.3% | 2026-08-06 | Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions. | |
CVE-2026-65520 |
9.3 |
0.0040
|
34.3% | 2026-08-06 | Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions. | |
CVE-2026-65546 |
9.3 |
0.0040
|
34.3% | 2026-08-06 | Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions. | |
CVE-2026-66447 |
9.3 |
0.0040
|
34.3% | 2026-08-06 | Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions. | |
CVE-2026-66659 |
9.3 |
0.0040
|
34.3% | 2026-08-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-28001 |
9.3 |
0.0040
|
34.3% | 2026-08-13 | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. | |
CVE-2026-28142 |
9.3 |
0.0040
|
34.3% | 2026-08-13 | Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions. | |
CVE-2026-61966 |
9.3 |
0.0040
|
34.3% | 2026-08-13 | Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions. | |
CVE-2026-61969 |
9.3 |
0.0040
|
34.3% | 2026-08-13 | Unauthenticated SQL Injection in Listdom <= 5.6.0 versions. | |
CVE-2026-66436 |
9.3 |
0.0040
|
34.3% | 2026-08-13 | Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions. | |
CVE-2026-66472 |
9.3 |
0.0040
|
34.3% | 2026-08-13 | Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions. | |
CVE-2026-66478 |
9.3 |
0.0040
|
34.3% | 2026-08-13 | Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions. | |
CVE-2026-73187 |
9.3 |
0.0040
|
34.3% | 2026-08-18 | Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions. | |
CVE-2026-73339 |
9.3 |
0.0040
|
34.3% | 2026-08-18 | Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions. | |
CVE-2026-73355 |
9.3 |
0.0040
|
34.3% | 2026-08-18 | Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions. | |
CVE-2026-73365 |
9.3 |
0.0040
|
34.3% | 2026-08-18 | Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions. | |
CVE-2026-74015 |
9.3 |
0.0040
|
34.3% | 2026-08-18 | Unauthenticated SQL Injection in Readabler < 2.0.18 versions. | |
CVE-2026-66592 |
9.3 |
0.0040
|
34.3% | 2026-08-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-91638 |
9.9 |
0.0040
|
34.2% | 2026-10-20 | Vulnerability in Oracle Essbase (component: Security). The supported version that is aff | |
CVE-2026-76302 |
9.9 |
0.0040
|
34.2% | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has | |
CVE-2026-18450 |
9.8 |
0.0040
|
34.3% | 2026-10-27 | The BMC does not correctly enforce integrity and encryption requirements for IPMI commands | |
CVE-2026-11546 |
9.8 |
0.0040
|
34.2% | 2026-06-30 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a serv | |
CVE-2026-113867 |
9.1 |
0.0040
|
34.1% | 2026-10-20 | Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Becaus | |
CVE-2026-33102 |
9.3 |
0.0040
|
34.0% | 2026-04-23 | Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized | |
CVE-2016-20101 |
9.2 |
0.0040
|
34.1% | 2026-10-20 | Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability | |
CVE-2026-7182 |
9.2 |
0.0040
|
33.9% | 2026-05-15 | Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HT | |
CVE-2026-50737 |
9.0 |
0.0040
|
33.9% | 2026-07-28 | When applying replicated changes for a row that is missing one or more columns, pglogical | |
CVE-2026-46892 |
9.1 |
0.0040
|
33.8% | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle | |
CVE-2026-12341 |
9.8 |
0.0040
|
33.8% | 2026-07-20 | This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attack | |
CVE-2026-91490 |
9.1 |
0.0040
|
33.8% | 2026-10-20 | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware | |
CVE-2026-62003 |
9.8 |
0.0040
|
33.8% | 2026-10-29 | Unauthenticated PHP Object Injection in Mission <= 1.22 versions. | |
CVE-2026-62004 |
9.8 |
0.0040
|
33.8% | 2026-10-29 | Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. | |
CVE-2026-62005 |
9.8 |
0.0040
|
33.8% | 2026-10-29 | Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. | |
CVE-2026-62010 |
9.8 |
0.0040
|
33.8% | 2026-10-29 | Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. | |
CVE-2026-62011 |
9.8 |
0.0040
|
33.8% | 2026-10-29 | Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. | |
CVE-2026-62015 |
9.8 |
0.0040
|
33.8% | 2026-10-29 | Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. |