Critical CVEs
3,477 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-62452 |
9.9 |
0.0038
|
31.6% | 2026-08-18 | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component | |
CVE-2026-34275 |
9.8 |
0.0038
|
31.5% | 2026-04-21 | Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite | |
CVE-2026-44666 |
9.3 |
0.0038
|
31.5% | 2026-05-14 | HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. Pr | |
CVE-2026-14423 |
9.6 |
0.0038
|
31.6% | 2026-07-01 | Type Confusion in Tint in Google Chrome prior to 150.0.7871.46 allowed a remote attacker t | |
CVE-2026-10534 |
9.8 |
0.0038
|
31.5% | 2026-08-12 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow | |
CVE-2026-87347 |
9.6 |
0.0038
|
31.5% | 2026-10-20 | Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OS | |
CVE-2026-39529 |
9.8 |
0.0037
|
31.4% | 2026-06-17 | Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions. | |
CVE-2026-40725 |
9.8 |
0.0037
|
31.4% | 2026-06-17 | Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions. | |
CVE-2026-49075 |
9.8 |
0.0037
|
31.4% | 2026-06-17 | Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions. | |
CVE-2026-49107 |
9.8 |
0.0037
|
31.4% | 2026-06-17 | Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions. | |
CVE-2026-54194 |
9.8 |
0.0037
|
31.4% | 2026-06-17 | Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions. | |
CVE-2026-101420 |
9.6 |
0.0037
|
31.4% | 2026-10-20 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (compo | |
CVE-2026-91403 |
9.1 |
0.0037
|
31.4% | 2026-10-21 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi | |
CVE-2026-42858 |
9.9 |
0.0037
|
31.3% | 2026-05-11 | Open edX Platform enables the authoring and delivery of online learning at any scale. The | |
CVE-2026-67426 |
9.3 |
0.0037
|
31.3% | 2026-07-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, | |
CVE-2026-111663 |
9.2 |
0.0037
|
31.3% | 2026-10-16 | Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows una | |
CVE-2026-68426 |
9.8 |
0.0037
|
31.3% | 2026-08-10 | In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb-> | |
CVE-2026-40042 |
9.3 |
0.0037
|
31.2% | 2026-04-13 | Pachno 1.0.6 contains an XML external entity injection vulnerability that allows unauthent | |
CVE-2026-3893 |
9.4 |
0.0037
|
31.2% | 2026-04-28 | The Carlson VASCO-B GNSS Receiver lacks an authentication mechanism, allowing an attacker | |
CVE-2026-43900 |
9.3 |
0.0037
|
31.1% | 2026-05-11 | DeepChat is an open-source artificial intelligence agent platform that unifies models, too | |
CVE-2026-35320 |
9.0 |
0.0037
|
31.3% | 2026-06-17 | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (compone | |
CVE-2026-13798 |
9.6 |
0.0037
|
31.2% | 2026-06-30 | Heap buffer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remot | |
CVE-2026-58122 |
9.3 |
0.0037
|
31.2% | 2026-07-09 | Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows u | |
CVE-2026-15966 |
9.8 |
0.0037
|
31.2% | 2026-07-23 | Permissive cross-domain security policy with untrusted domains vulnerability in Progress M | |
CVE-2026-15967 |
9.8 |
0.0037
|
31.2% | 2026-07-23 | Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue aff | |
CVE-2026-17680 |
9.6 |
0.0037
|
31.2% | 2026-07-30 | Heap buffer overflow in Color in Google Chrome on ChromeOS prior to 151.0.7922.72 allowed | |
CVE-2026-17758 |
9.6 |
0.0037
|
31.2% | 2026-07-30 | Heap buffer overflow in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote atta | |
CVE-2026-22340 |
9.3 |
0.0037
|
31.1% | 2026-06-17 | Unauthenticated SQL Injection in WPJobster <= 6.3.5 versions. | |
CVE-2026-39438 |
9.3 |
0.0037
|
31.1% | 2026-06-17 | Unauthenticated SQL Injection in ListingPro <= 2.9.10 versions. | |
CVE-2026-39596 |
9.3 |
0.0037
|
31.1% | 2026-06-17 | Unauthenticated SQL Injection in Blocksy Companion Pro < 2.1.29 versions. | |
CVE-2026-49076 |
9.3 |
0.0037
|
31.1% | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-12686 |
9.3 |
0.0037
|
31.1% | 2026-07-06 | An authenticated user could manipulate a company ID parameter in a POST request to the bac | |
CVE-2026-39746 |
9.3 |
0.0037
|
31.1% | 2026-10-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-77903 |
9.0 |
0.0037
|
31.1% | 2026-09-17 | Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker t | |
CVE-2026-32557 |
9.3 |
0.0037
|
31.1% | 2026-10-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-8431 |
9.4 |
0.0037
|
31.0% | 2026-05-12 | An administrative user with access to configure webhooks can execute arbitrary commands by | |
CVE-2026-60104 |
9.3 |
0.0037
|
31.0% | 2026-07-08 | Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/a | |
CVE-2026-61239 |
9.9 |
0.0037
|
31.0% | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle | |
CVE-2026-60916 |
9.9 |
0.0037
|
31.0% | 2026-08-18 | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middlewa | |
CVE-2026-73930 |
9.9 |
0.0037
|
31.0% | 2026-08-18 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative We | |
CVE-2026-48114 |
9.8 |
0.0037
|
30.9% | 2026-06-15 | Metacat is data repository software that helps researchers preserve, share, and discover d | |
CVE-2026-57858 |
9.3 |
0.0037
|
30.9% | 2026-08-12 | Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnera | |
CVE-2026-34037 |
9.9 |
0.0037
|
30.7% | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-72789 |
9.2 |
0.0037
|
30.7% | 2026-08-12 | SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, tr | |
CVE-2026-103792 |
9.6 |
0.0037
|
30.7% | 2026-10-28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through | |
CVE-2026-46897 |
9.9 |
0.0037
|
30.6% | 2026-06-17 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Busine | |
CVE-2026-46901 |
9.9 |
0.0037
|
30.6% | 2026-06-17 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Busine | |
CVE-2026-92885 |
9.8 |
0.0037
|
30.6% | 2026-10-27 | The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to | |
CVE-2026-118375 |
9.2 |
0.0037
|
30.6% | 2026-10-28 | llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rp | |
CVE-2026-40493 |
9.8 |
0.0037
|
30.5% | 2026-04-18 | SAIL is a cross-platform library for loading and saving images with support for animation, |