Critical CVEs
3,491 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-73930 |
9.9 |
0.0037
|
31.0% | 2026-08-18 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative We | |
CVE-2026-48114 |
9.8 |
0.0037
|
30.9% | 2026-06-15 | Metacat is data repository software that helps researchers preserve, share, and discover d | |
CVE-2026-57858 |
9.3 |
0.0037
|
30.9% | 2026-08-12 | Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnera | |
CVE-2026-34037 |
9.9 |
0.0037
|
30.7% | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and d | |
CVE-2026-72789 |
9.2 |
0.0037
|
30.7% | 2026-08-12 | SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, tr | |
CVE-2026-103792 |
9.6 |
0.0037
|
30.7% | 2026-10-28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through | |
CVE-2026-46897 |
9.9 |
0.0037
|
30.6% | 2026-06-17 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Busine | |
CVE-2026-46901 |
9.9 |
0.0037
|
30.6% | 2026-06-17 | Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Busine | |
CVE-2026-92885 |
9.8 |
0.0037
|
30.6% | 2026-10-27 | The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass leading to | |
CVE-2026-118375 |
9.2 |
0.0037
|
30.6% | 2026-10-28 | llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rp | |
CVE-2026-40493 |
9.8 |
0.0037
|
30.5% | 2026-04-18 | SAIL is a cross-platform library for loading and saving images with support for animation, | |
CVE-2026-41571 |
9.4 |
0.0037
|
30.5% | 2026-05-04 | Note Mark is an open-source note-taking application. In version 0.19.2, IsPasswordMatch in | |
CVE-2026-17847 |
9.6 |
0.0037
|
30.5% | 2026-07-30 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.7 | |
CVE-2026-106486 |
9.9 |
0.0037
|
30.5% | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backsta | |
CVE-2026-106076 |
9.0 |
0.0037
|
30.5% | 2026-10-27 | A vulnerability allowing an authenticated organization-transfer peer to inject SQL into th | |
CVE-2026-104383 |
9.4 |
0.0037
|
30.5% | 2026-10-28 | Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions | |
CVE-2026-4101 |
9.8 |
0.0037
|
30.4% | 2026-04-01 | IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Co | |
CVE-2026-5963 |
9.3 |
0.0037
|
30.4% | 2026-04-20 | EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthentic | |
CVE-2026-5964 |
9.3 |
0.0037
|
30.4% | 2026-04-20 | EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthentic | |
CVE-2026-42889 |
9.1 |
0.0037
|
30.4% | 2026-05-12 | Relay adds real-time collaboration to Obsidian. Relay Server versions 0.9.0 through 0.9.6 | |
CVE-2026-42155 |
9.3 |
0.0037
|
30.4% | 2026-05-15 | Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alt | |
CVE-2026-42812 |
9.4 |
0.0037
|
30.3% | 2026-05-04 | In Apache Iceberg, the table's metadata files are control files: they tell readers which d | |
CVE-2026-11714 |
9.8 |
0.0037
|
30.3% | 2026-06-30 | IBM WebSphere Application Server Liberty is affected by a server-side request forgery vuln | |
CVE-2026-110720 |
9.9 |
0.0037
|
30.3% | 2026-10-26 | Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization byp | |
CVE-2026-112362 |
9.1 |
0.0037
|
30.3% | 2026-10-27 | @fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versi | |
CVE-2026-63149 |
9.1 |
0.0037
|
30.3% | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that | |
CVE-2026-91218 |
9.6 |
0.0037
|
30.3% | 2026-10-20 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr | |
CVE-2026-39440 |
9.9 |
0.0036
|
30.2% | 2026-04-23 | Improper Control of Generation of Code ('Code Injection') vulnerability in Funnelforms LLC | |
CVE-2026-50083 |
9.8 |
0.0036
|
30.2% | 2026-06-12 | The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, | |
CVE-2026-41566 |
9.4 |
0.0036
|
30.2% | 2026-06-25 | Improper Handling of Insufficient Permissions or Privileges vulnerability in Apache Kvrock | |
CVE-2026-45363 |
9.1 |
0.0036
|
30.2% | 2026-07-14 | ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to | |
CVE-2026-70855 |
9.3 |
0.0036
|
30.2% | 2026-08-18 | Vulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM (component: H | |
CVE-2026-20043 |
9.0 |
0.0036
|
30.2% | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco | |
CVE-2026-49798 |
9.3 |
0.0036
|
30.2% | 2026-07-14 | Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges loc | |
CVE-2026-34177 |
9.1 |
0.0036
|
30.1% | 2026-04-09 | Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOpti | |
CVE-2026-42368 |
9.9 |
0.0036
|
30.1% | 2026-05-04 | A privilege escalation vulnerability exists in the Web Interface functionality of GeoVisio | |
CVE-2026-39492 |
9.3 |
0.0036
|
30.1% | 2026-06-15 | Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions. | |
CVE-2026-39493 |
9.3 |
0.0036
|
30.1% | 2026-06-15 | Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions. | |
CVE-2026-109780 |
9.8 |
0.0036
|
30.1% | 2026-10-13 | Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firef | |
CVE-2024-34323 |
10.0 |
0.0036
|
30.1% | 2026-10-13 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Re | |
CVE-2026-82120 |
9.8 |
0.0036
|
30.1% | 2026-10-27 | Heap-based Buffer Overflow Vulnerability in HiRDB. This issue affects HiRDB Server Versi | |
CVE-2026-35263 |
9.9 |
0.0036
|
29.9% | 2026-06-17 | Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core) | |
CVE-2026-46861 |
9.6 |
0.0036
|
30.0% | 2026-06-17 | Vulnerability in the MySQL NDB Cluster product of Oracle MySQL (component: Cluster: NDB Op | |
CVE-2026-46919 |
9.8 |
0.0036
|
30.0% | 2026-06-17 | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component | |
CVE-2026-60239 |
9.6 |
0.0036
|
29.9% | 2026-07-21 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core | |
CVE-2026-60540 |
9.6 |
0.0036
|
30.0% | 2026-07-21 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Inte | |
CVE-2026-60564 |
9.6 |
0.0036
|
30.0% | 2026-07-21 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (componen | |
CVE-2026-60773 |
9.6 |
0.0036
|
30.0% | 2026-07-21 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite | |
CVE-2026-62549 |
9.6 |
0.0036
|
30.0% | 2026-07-21 | Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Pa | |
CVE-2026-60861 |
9.6 |
0.0036
|
30.0% | 2026-08-18 | Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (compon |