Critical CVEs
3,393 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-47391 |
9.8 |
0.0150
|
74.2% | 2026-07-21 | PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party | |
CVE-2021-25827 |
9.8 |
0.0150
|
74.2% | 2023-06-28 | Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-F | |
CVE-2026-49481 |
9.6 |
0.0148
|
73.9% | 2026-08-12 | UpSnap is a wake on lan web app. Versions prior to 5.4.0 have an OS command injection vuln | |
CVE-2026-8398 |
9.3 |
0.0146
|
73.4% | 2026-05-15 | KEV | Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiali |
CVE-2026-41137 |
9.4 |
0.0145
|
73.3% | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. P | |
CVE-2026-10138 |
9.1 |
0.0145
|
73.3% | 2026-10-20 | A OS command injection vulnerability exists in the boa formUpload() functionality of X2000 | |
CVE-2026-64193 |
9.8 |
0.0144
|
73.1% | 2026-07-20 | Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED | |
CVE-2026-56062 |
9.3 |
0.0144
|
73.1% | 2026-06-26 | Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions. | |
CVE-2026-56070 |
9.3 |
0.0144
|
73.1% | 2026-06-26 | Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions. | |
CVE-2026-6875 |
9.5 |
0.0143
|
72.9% | 2026-07-13 | ServiceNow has addressed a remote code execution vulnerability that was identified in the | |
CVE-2026-61736 |
9.3 |
0.0142
|
72.8% | 2026-07-15 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the serv | |
CVE-2026-48281 |
10.0 |
0.0142
|
72.8% | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validati | |
CVE-2026-79857 |
9.8 |
0.0141
|
72.7% | 2026-10-22 | There is a command injection vulnerability in the PAPI protocol (Aruba's access point mana | |
CVE-2026-59866 |
9.3 |
0.0141
|
72.7% | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota em | |
CVE-2026-56121 |
9.3 |
0.0141
|
72.5% | 2026-06-24 | Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthent | |
CVE-2026-90531 |
9.6 |
0.0140
|
72.4% | 2026-10-13 | Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Ref | |
CVE-2026-22095 |
9.3 |
0.0139
|
72.3% | 2026-07-13 | The network diagnosis endpoint on the web server at port 8090 is vulnerable to command inj | |
CVE-2026-22103 |
9.3 |
0.0139
|
72.3% | 2026-07-13 | The NPC start endpoint on the web server at port 8090 is vulnerable to command injection. | |
CVE-2026-69085 |
9.9 |
0.0139
|
72.3% | 2026-08-03 | SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDoc | |
CVE-2026-10131 |
9.1 |
0.0139
|
72.2% | 2026-10-20 | An OS command injection vulnerability exists in the boa formPasswordSetup functionality of | |
CVE-2026-10135 |
9.1 |
0.0139
|
72.2% | 2026-10-20 | A OS command injection vulnerability exists in the batchupg functionality of X2000R (versi | |
CVE-2026-31843 |
10.0 |
0.0138
|
72.1% | 2026-04-16 | The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the | |
CVE-2026-59707 |
9.2 |
0.0138
|
72.1% | 2026-07-07 | LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST | |
CVE-2026-56292 |
9.2 |
0.0138
|
72.1% | 2026-07-09 | Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQ | |
CVE-2026-115995 |
9.4 |
0.0138
|
72.0% | 2026-10-24 | A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. | |
CVE-2026-79846 |
10.0 |
0.0137
|
71.8% | 2026-10-22 | Command injection vulnerabilities exist in the affected interface of AOS-8 that could allo | |
CVE-2026-48323 |
10.0 |
0.0137
|
71.8% | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements | |
CVE-2026-47103 |
9.3 |
0.0136
|
71.7% | 2026-06-17 | Python StateMachine versions 3.0.0 before 3.2.0 contains a remote code execution vulnerabi | |
CVE-2026-58449 |
9.3 |
0.0135
|
71.5% | 2026-06-30 | txtai through 9.10.0, fixed in commit 11b32da, exposes an API /reindex endpoint whose func | |
CVE-2026-39339 |
9.1 |
0.0135
|
71.5% | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical authenti | |
CVE-2026-21571 |
9.4 |
0.0135
|
71.3% | 2026-04-21 | This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0 | |
CVE-2026-54836 |
9.3 |
0.0134
|
71.3% | 2026-06-25 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-42221 |
9.8 |
0.0134
|
71.3% | 2026-05-04 | Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before ve | |
CVE-2026-41880 |
9.0 |
0.0133
|
71.0% | 2026-07-10 | R-SOFT DMS is vulnerable to OS Command Injection in the Optical Character Recognition (OCR | |
CVE-2026-59864 |
9.3 |
0.0133
|
71.0% | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota p | |
CVE-2026-70291 |
9.8 |
0.0133
|
71.0% | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to | |
CVE-2026-43512 |
9.8 |
0.0133
|
70.9% | 2026-05-12 | DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache | |
CVE-2026-42647 |
9.3 |
0.0132
|
70.8% | 2026-06-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-112352 |
9.1 |
0.0132
|
70.8% | 2026-10-27 | Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows | |
CVE-2026-2332 |
9.1 |
0.0131
|
70.5% | 2026-04-14 | In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extens | |
CVE-2026-110264 |
10.0 |
0.0131
|
70.5% | 2026-10-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11. | |
CVE-2026-112900 |
9.2 |
0.0130
|
70.4% | 2026-10-19 | Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argum | |
CVE-2026-104353 |
9.9 |
0.0130
|
70.4% | 2026-10-27 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements | |
CVE-2023-27407 |
9.9 |
0.0130
|
70.3% | 2023-05-09 | A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web bas | |
CVE-2026-48277 |
10.0 |
0.0129
|
70.3% | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validati | |
CVE-2026-42537 |
9.8 |
0.0129
|
70.2% | 2026-08-10 | Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommend | |
CVE-2026-35499 |
9.1 |
0.0129
|
70.1% | 2026-10-20 | An os command injection vulnerability exists in the boa formWsc peerRptPin functionality o | |
CVE-2026-70279 |
9.3 |
0.0129
|
70.1% | 2026-10-13 | Improper neutralization of input during web page generation ('cross-site scripting') in Mi | |
CVE-2026-44939 |
9.4 |
0.0128
|
69.9% | 2026-06-19 | A command injection vulnerability in the Rancher Manager cluster before 2.14.2 import endp | |
CVE-2026-70553 |
9.3 |
0.0127
|
69.8% | 2026-08-04 | MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated att |