Critical CVEs
3,395 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-34569 |
9.0 |
0.0033
|
26.1% | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-68582 |
9.3 |
0.0033
|
26.1% | 2026-08-02 | Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) | |
CVE-2026-112327 |
9.3 |
0.0033
|
26.1% | 2026-10-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-5734 |
9.8 |
0.0033
|
26.0% | 2026-04-07 | Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0. | |
CVE-2026-2449 |
9.0 |
0.0033
|
26.0% | 2026-04-14 | Improper neutralization of argument delimiters in a command ('argument injection') vulnera | |
CVE-2026-76299 |
9.9 |
0.0033
|
26.0% | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has | |
CVE-2026-76935 |
9.4 |
0.0033
|
25.9% | 2026-10-27 | Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System 3. This | |
CVE-2026-63160 |
9.1 |
0.0033
|
25.8% | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remem | |
CVE-2026-91224 |
9.9 |
0.0033
|
25.9% | 2026-10-20 | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabr | |
CVE-2026-11832 |
9.1 |
0.0033
|
25.8% | 2026-06-15 | Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. | |
CVE-2026-14038 |
9.3 |
0.0033
|
25.7% | 2026-06-30 | Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 150.0 | |
CVE-2025-70516 |
9.1 |
0.0033
|
25.8% | 2026-10-07 | The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper au | |
CVE-2026-5166 |
9.6 |
0.0033
|
25.7% | 2026-04-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabili | |
CVE-2026-30496 |
9.8 |
0.0033
|
25.7% | 2026-05-07 | The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes an | |
CVE-2026-6213 |
10.0 |
0.0033
|
25.6% | 2026-05-08 | A vulnerability in Remote Spark SparkView before build 1122 allows an attacker to bypasses | |
CVE-2026-45091 |
9.1 |
0.0033
|
25.7% | 2026-05-12 | sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spr | |
CVE-2026-48768 |
9.3 |
0.0033
|
25.6% | 2026-06-18 | TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-i | |
CVE-2026-63569 |
9.1 |
0.0033
|
25.6% | 2026-10-02 | Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellma | |
CVE-2026-91243 |
9.6 |
0.0033
|
25.7% | 2026-10-20 | Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Mid | |
CVE-2026-76475 |
9.3 |
0.0033
|
25.6% | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, engineeri | |
CVE-2026-118305 |
9.6 |
0.0033
|
25.7% | 2026-10-27 | Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote att | |
CVE-2026-118306 |
9.6 |
0.0033
|
25.7% | 2026-10-27 | Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote a | |
CVE-2026-118321 |
9.6 |
0.0033
|
25.7% | 2026-10-27 | Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 al | |
CVE-2026-118340 |
9.6 |
0.0033
|
25.7% | 2026-10-27 | Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacke | |
CVE-2026-72794 |
9.2 |
0.0032
|
25.5% | 2026-08-12 | siyuan versions before v3.7.4 expose the session cookie signing key through the /api/syste | |
CVE-2026-109705 |
9.6 |
0.0032
|
25.5% | 2026-10-13 | Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free | |
CVE-2026-109707 |
9.6 |
0.0032
|
25.5% | 2026-10-13 | Sandbox escape due to use-after-free in the Networking component. This vulnerability was f | |
CVE-2026-53942 |
9.9 |
0.0032
|
25.5% | 2026-10-23 | Conda Organization Infrastructure is a centralized location for infrastructure codes. Prio | |
CVE-2026-22619 |
9.9 |
0.0032
|
25.4% | 2026-04-16 | Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its exe | |
CVE-2026-8076 |
9.3 |
0.0032
|
25.5% | 2026-05-08 | Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, where the | |
CVE-2026-114611 |
9.1 |
0.0032
|
25.5% | 2026-10-22 | OCO-Server is a self-hosted endpoint management application for computer inventory, softwa | |
CVE-2026-34568 |
9.0 |
0.0032
|
25.3% | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-41248 |
9.1 |
0.0032
|
25.3% | 2026-04-24 | Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRou | |
CVE-2026-42087 |
9.6 |
0.0032
|
25.3% | 2026-05-04 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from | |
CVE-2026-48745 |
9.3 |
0.0032
|
25.3% | 2026-06-17 | Traccar Client is a GPS tracking mobile app for sending location updates to private server | |
CVE-2026-74253 |
10.0 |
0.0032
|
25.3% | 2026-08-17 | Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user | |
CVE-2026-95695 |
9.1 |
0.0032
|
25.3% | 2026-10-13 | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remot | |
CVE-2026-112860 |
9.3 |
0.0032
|
25.3% | 2026-10-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-58073 |
9.5 |
0.0032
|
25.2% | 2026-08-04 | A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to | |
CVE-2026-115324 |
9.2 |
0.0032
|
25.2% | 2026-10-22 | mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/da | |
CVE-2026-23818 |
9.6 |
0.0032
|
25.1% | 2026-04-07 | A vulnerability has been identified in the graphical user interface (GUI) of HPE Aruba Net | |
CVE-2026-33698 |
9.3 |
0.0032
|
25.1% | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38, a chained attack can enable | |
CVE-2026-22337 |
9.8 |
0.0032
|
25.1% | 2026-04-27 | Incorrect Privilege Assignment vulnerability in Directorist Directorist Social Login allow | |
CVE-2026-34901 |
9.8 |
0.0032
|
25.1% | 2026-06-15 | Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions. | |
CVE-2026-49058 |
9.8 |
0.0032
|
25.1% | 2026-06-17 | Unauthenticated Privilege Escalation in LoginPress Pro <= 6.2.2 versions. | |
CVE-2026-46989 |
9.1 |
0.0032
|
25.0% | 2026-07-21 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise | |
CVE-2026-68587 |
9.2 |
0.0032
|
25.1% | 2026-08-03 | SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHe | |
CVE-2026-42758 |
9.8 |
0.0032
|
25.0% | 2026-05-27 | Incorrect Privilege Assignment vulnerability in Saleswonder Team: Tobias WebinarIgnition w | |
CVE-2026-115905 |
10.0 |
0.0032
|
25.0% | 2026-10-26 | zip is a zip library for Rust that supports reading and writing simple ZIP files. Through | |
CVE-2026-34971 |
9.0 |
0.0032
|
24.8% | 2026-04-09 | Wasmtime is a runtime for WebAssembly. From 32.0.0 to before 36.0.7, 42.0.2, and 43.0.1, W |