Critical CVEs
3,395 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-50638 |
9.1 |
0.0034
|
27.8% | 2026-06-10 | Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against me | |
CVE-2026-63297 |
9.9 |
0.0034
|
27.8% | 2026-08-12 | An authorization bypass vulnerability in LXD due to a timing flaw during configuration mer | |
CVE-2026-44603 |
9.1 |
0.0034
|
27.7% | 2026-05-07 | Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka T | |
CVE-2026-45833 |
9.4 |
0.0034
|
27.7% | 2026-06-12 | A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project a | |
CVE-2026-109774 |
9.8 |
0.0034
|
27.7% | 2026-10-13 | Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerabilit | |
CVE-2026-111411 |
9.3 |
0.0034
|
27.7% | 2026-10-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-46389 |
9.8 |
0.0034
|
27.5% | 2026-06-05 | UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, trusts | |
CVE-2026-58102 |
9.1 |
0.0034
|
27.6% | 2026-07-13 | Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a | |
CVE-2026-91658 |
9.9 |
0.0034
|
27.6% | 2026-10-20 | Vulnerability in Oracle Essbase (component: Security). The supported version that is aff | |
CVE-2026-91663 |
9.9 |
0.0034
|
27.6% | 2026-10-20 | Vulnerability in Oracle Essbase (component: Security). The supported version that is aff | |
CVE-2026-5935 |
9.8 |
0.0034
|
27.5% | 2026-04-23 | IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC cou | |
CVE-2026-92892 |
9.0 |
0.0034
|
27.5% | 2026-10-13 | Potential arbitrary code execution under specific configurations. Updated October 22, 2026 | |
CVE-2026-114219 |
9.1 |
0.0034
|
27.5% | 2026-10-22 | NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unaut | |
CVE-2026-103799 |
9.6 |
0.0034
|
27.5% | 2026-10-28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through | |
CVE-2026-5085 |
9.1 |
0.0034
|
27.3% | 2026-04-13 | Solstice::Session versions through 1440 for Perl generates session ids insecurely. The _g | |
CVE-2026-42222 |
9.8 |
0.0034
|
27.4% | 2026-05-04 | Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenti | |
CVE-2026-54807 |
9.8 |
0.0034
|
27.3% | 2026-06-17 | Unauthenticated Privilege Escalation in Registration Form for WooCommerce <= 1.0.9 version | |
CVE-2026-91230 |
9.3 |
0.0034
|
27.3% | 2026-10-20 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr | |
CVE-2026-105215 |
9.3 |
0.0034
|
27.4% | 2026-10-04 | ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hoste | |
CVE-2026-44221 |
9.0 |
0.0034
|
27.2% | 2026-05-12 | ArcadeDB is a Multi-Model DBMS. Starting in version 21.10.1 and prior to version 26.4.2, a | |
CVE-2026-35305 |
9.3 |
0.0034
|
27.2% | 2026-06-17 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Cent | |
CVE-2026-46906 |
9.6 |
0.0034
|
27.1% | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen | |
CVE-2026-32967 |
9.1 |
0.0034
|
27.1% | 2026-06-17 | Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinSch | |
CVE-2026-57926 |
9.8 |
0.0034
|
27.1% | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a protot | |
CVE-2026-66394 |
9.3 |
0.0034
|
27.0% | 2026-07-27 | SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in | |
CVE-2026-93909 |
9.1 |
0.0034
|
27.0% | 2026-10-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an | |
CVE-2026-44482 |
9.6 |
0.0034
|
27.0% | 2026-05-14 | soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and A | |
CVE-2026-42756 |
9.9 |
0.0034
|
26.9% | 2026-05-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabili | |
CVE-2026-60249 |
9.0 |
0.0034
|
27.0% | 2026-07-21 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core | |
CVE-2026-17832 |
9.6 |
0.0034
|
27.0% | 2026-07-30 | Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker | |
CVE-2026-17617 |
9.8 |
0.0034
|
26.9% | 2026-08-05 | IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request F | |
CVE-2026-86397 |
9.8 |
0.0034
|
27.0% | 2026-10-28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 relea | |
CVE-2026-41064 |
9.3 |
0.0034
|
26.9% | 2026-04-22 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, an inc | |
CVE-2026-11839 |
9.9 |
0.0034
|
26.9% | 2026-06-11 | Unrestricted upload of file with dangerous type vulnerability in Başarsoft Information Tec | |
CVE-2026-59507 |
9.3 |
0.0034
|
26.9% | 2026-08-13 | : Use of Hard-coded Credentials : Exposure of Sensitive Information to an Unauthorized Act | |
CVE-2026-41267 |
9.8 |
0.0033
|
26.7% | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. P | |
CVE-2026-55203 |
9.0 |
0.0033
|
26.8% | 2026-06-18 | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability | |
CVE-2026-22097 |
9.3 |
0.0033
|
26.8% | 2026-07-13 | The firmware update mechanism does not include cryptographic signature validation. This al | |
CVE-2026-109708 |
9.6 |
0.0033
|
26.8% | 2026-10-13 | Sandbox escape due to incorrect boundary conditions in the Networking component. This vuln | |
CVE-2026-42731 |
9.8 |
0.0033
|
26.7% | 2026-05-27 | Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification min | |
CVE-2026-53914 |
9.8 |
0.0033
|
26.5% | 2026-06-26 | In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization i | |
CVE-2026-40494 |
9.8 |
0.0033
|
26.4% | 2026-04-18 | SAIL is a cross-platform library for loading and saving images with support for animation, | |
CVE-2026-48616 |
9.3 |
0.0033
|
26.4% | 2026-06-17 | Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an acc | |
CVE-2026-14101 |
9.6 |
0.0033
|
26.4% | 2026-06-30 | Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 | |
CVE-2026-41201 |
9.1 |
0.0033
|
26.2% | 2026-05-07 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-9270 |
9.1 |
0.0033
|
26.3% | 2026-06-05 | DataDog::DogStatsd versions through 0.07 for Perl allow metric injections. DataDog::DogSt | |
CVE-2026-71290 |
9.1 |
0.0033
|
26.2% | 2026-08-11 | Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or ne | |
CVE-2026-75626 |
9.3 |
0.0033
|
26.2% | 2026-08-18 | SpiderFoot fails to HTML-escape correlation titles built from external scan data sources i | |
CVE-2026-63159 |
9.1 |
0.0033
|
26.2% | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnera | |
CVE-2026-34559 |
9.0 |
0.0033
|
26.1% | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch |