Critical CVEs
3,495 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-62015 |
9.8 |
0.0040
|
33.8% | 2026-10-29 | Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. | |
CVE-2026-62016 |
9.8 |
0.0040
|
33.8% | 2026-10-29 | Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | |
CVE-2026-17349 |
9.3 |
0.0040
|
33.7% | 2026-07-31 | /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin | |
CVE-2026-73090 |
9.3 |
0.0040
|
33.7% | 2026-08-11 | PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpda | |
CVE-2026-71063 |
9.6 |
0.0040
|
33.7% | 2026-08-18 | Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported | |
CVE-2026-71064 |
9.6 |
0.0040
|
33.7% | 2026-08-18 | Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported | |
CVE-2026-2053 |
10.0 |
0.0039
|
33.6% | 2026-06-26 | The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does | |
CVE-2026-18716 |
9.1 |
0.0039
|
33.6% | 2026-08-20 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker | |
CVE-2026-93895 |
9.1 |
0.0039
|
33.6% | 2026-10-13 | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unau | |
CVE-2026-94267 |
9.0 |
0.0039
|
33.5% | 2026-10-23 | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fiel | |
CVE-2026-41589 |
9.6 |
0.0039
|
33.5% | 2026-05-07 | Wish is an SSH server with defaults and a collection of middlewares. From version 2.0.0 to | |
CVE-2026-41507 |
9.8 |
0.0039
|
33.5% | 2026-05-08 | math-codegen generates code from mathematical expressions. Prior to version 0.4.3, string | |
CVE-2026-13380 |
9.0 |
0.0039
|
33.5% | 2026-07-20 | VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTT | |
CVE-2026-17681 |
9.6 |
0.0039
|
33.5% | 2026-07-30 | Insufficient validation of untrusted input in Web Authentication in Google Chrome on Andro | |
CVE-2026-19166 |
9.6 |
0.0039
|
33.5% | 2026-08-06 | Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 allowed a re | |
CVE-2026-10543 |
9.8 |
0.0039
|
33.5% | 2026-08-12 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escala | |
CVE-2026-53793 |
9.1 |
0.0039
|
33.5% | 2026-08-13 | rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote cli | |
CVE-2025-52910 |
9.8 |
0.0039
|
33.3% | 2025-11-04 | An issue was discovered in the GPU in Samsung Mobile Processor and Wearable Processor Exyn | |
CVE-2026-35044 |
9.6 |
0.0039
|
33.3% | 2026-04-06 | BentoML is a Python library for building online serving systems optimized for AI apps and | |
CVE-2026-60424 |
9.0 |
0.0039
|
33.4% | 2026-07-21 | Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (compone | |
CVE-2026-61201 |
9.0 |
0.0039
|
33.4% | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise CRM Common Objects product of Oracle PeopleSoft | |
CVE-2026-61223 |
9.0 |
0.0039
|
33.4% | 2026-07-21 | Vulnerability in the Oracle Communications Converged Application Server product of Oracle | |
CVE-2026-61029 |
9.0 |
0.0039
|
33.4% | 2026-08-18 | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component | |
CVE-2026-70980 |
9.0 |
0.0039
|
33.4% | 2026-08-18 | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager pr | |
CVE-2026-44257 |
9.3 |
0.0039
|
33.2% | 2026-05-12 | efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip w | |
CVE-2026-46795 |
9.3 |
0.0039
|
33.2% | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone | |
CVE-2026-46805 |
9.3 |
0.0039
|
33.2% | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone | |
CVE-2026-2342 |
9.3 |
0.0039
|
33.2% | 2026-07-09 | Improper neutralization of input during web page generation ('cross-site scripting') vulne | |
CVE-2026-75851 |
9.4 |
0.0039
|
33.2% | 2026-08-18 | ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to pro | |
CVE-2026-98549 |
9.1 |
0.0039
|
33.2% | 2026-10-18 | In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsi | |
CVE-2026-41050 |
9.9 |
0.0039
|
33.1% | 2026-05-13 | Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, | |
CVE-2026-44888 |
9.8 |
0.0039
|
33.1% | 2026-05-27 | Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-0 | |
CVE-2026-39494 |
9.3 |
0.0039
|
33.1% | 2026-06-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-32966 |
9.8 |
0.0039
|
33.2% | 2026-06-17 | DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclos | |
CVE-2026-52780 |
9.6 |
0.0039
|
33.2% | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17. | |
CVE-2026-15643 |
9.2 |
0.0039
|
33.1% | 2026-07-14 | AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) is a Model Context Protocol serv | |
CVE-2026-41468 |
9.3 |
0.0039
|
33.0% | 2026-04-22 | Beghelli Sicuro24 SicuroWeb embeds AngularJS 1.5.2, an end-of-life component containing kn | |
CVE-2026-24303 |
9.6 |
0.0039
|
33.1% | 2026-04-23 | Improper certificate validation in Microsoft Partner Center allows an unauthorized attacke | |
CVE-2026-8362 |
9.8 |
0.0039
|
33.1% | 2026-05-27 | A stack-based buffer overflow condition exists in WOSDefaultHttpModule.dll when processing | |
CVE-2026-75828 |
9.3 |
0.0039
|
33.0% | 2026-08-18 | Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() | |
CVE-2026-91250 |
9.9 |
0.0039
|
33.0% | 2026-10-20 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adap | |
CVE-2026-91251 |
9.9 |
0.0039
|
33.0% | 2026-10-20 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adap | |
CVE-2026-113788 |
9.4 |
0.0039
|
33.0% | 2026-10-21 | Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a | |
CVE-2026-91232 |
9.9 |
0.0039
|
33.0% | 2026-10-20 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr | |
CVE-2026-91222 |
9.9 |
0.0039
|
33.1% | 2026-10-20 | Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Mid | |
CVE-2024-25182 |
9.8 |
0.0039
|
32.9% | 2025-12-29 | givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php. | |
CVE-2024-27480 |
9.8 |
0.0039
|
32.9% | 2025-12-29 | givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload. | |
CVE-2026-4370 |
10.0 |
0.0039
|
32.9% | 2026-04-01 | A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4. | |
CVE-2026-5387 |
9.3 |
0.0039
|
32.9% | 2026-04-15 | The vulnerability, if exploited, could allow an unauthenticated miscreant to perform opera | |
CVE-2026-39462 |
9.3 |
0.0039
|
32.9% | 2026-04-24 | A vulnerability exists in SenseLive X3050’s web management interface in which password upd |