Critical CVEs
3,394 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-112856 |
9.8 |
0.0031
|
24.2% | 2026-10-23 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allo | |
CVE-2026-112858 |
9.8 |
0.0031
|
24.2% | 2026-10-23 | Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object | |
CVE-2026-112859 |
9.8 |
0.0031
|
24.2% | 2026-10-23 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-bi | |
CVE-2026-34564 |
9.0 |
0.0031
|
24.1% | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-33519 |
9.8 |
0.0031
|
24.1% | 2026-04-21 | An incorrect authorization vulnerability exists in Esri Portal for ArcGIS 11.4, 11.5 and 1 | |
CVE-2026-49080 |
9.3 |
0.0031
|
24.0% | 2026-06-17 | Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions. | |
CVE-2026-61451 |
9.4 |
0.0031
|
24.0% | 2026-07-15 | The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the cli | |
CVE-2026-115384 |
9.4 |
0.0031
|
24.0% | 2026-10-22 | Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vu | |
CVE-2026-34751 |
9.1 |
0.0031
|
24.0% | 2026-04-01 | Payload is a free and open source headless content management system. Prior to version 3.7 | |
CVE-2026-49769 |
9.8 |
0.0031
|
23.9% | 2026-06-15 | Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions. | |
CVE-2026-54433 |
10.0 |
0.0031
|
24.0% | 2026-07-14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scri | |
CVE-2026-18108 |
9.8 |
0.0031
|
24.0% | 2026-08-03 | Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encry | |
CVE-2026-13851 |
9.1 |
0.0031
|
23.9% | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android p | |
CVE-2026-13852 |
9.1 |
0.0031
|
23.9% | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android p | |
CVE-2026-105207 |
9.3 |
0.0031
|
23.9% | 2026-10-04 | ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts a | |
CVE-2025-58628 |
9.3 |
0.0031
|
23.7% | 2025-09-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-6771 |
9.8 |
0.0031
|
23.7% | 2026-04-21 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox | |
CVE-2026-44089 |
9.4 |
0.0031
|
23.7% | 2026-06-23 | Totolink EX1200L router is vulnerable to Buffer Overflow in the login functionality in cgi | |
CVE-2026-0481 |
9.2 |
0.0031
|
23.6% | 2026-05-15 | Unrestricted IP address binding in the AMD Device Metrics Exporter (ROCm ecosystem) could | |
CVE-2026-54808 |
9.3 |
0.0031
|
23.6% | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-75835 |
9.3 |
0.0031
|
23.6% | 2026-08-18 | Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization v | |
CVE-2026-111816 |
9.2 |
0.0031
|
23.6% | 2026-10-21 | Apache Traffic Server forwarded a malformed 302 response that should have been rejected as | |
CVE-2026-64024 |
9.4 |
0.0031
|
23.6% | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CP | |
CVE-2026-1950 |
9.8 |
0.0031
|
23.4% | 2026-04-24 | Delta Electronics AS320T has No checking of the length of the buffer with the file name v | |
CVE-2026-46978 |
10.0 |
0.0031
|
23.5% | 2026-06-17 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administr | |
CVE-2025-67108 |
10.0 |
0.0031
|
23.3% | 2025-12-23 | eProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket revocation | |
CVE-2026-39305 |
10.0 |
0.0031
|
23.3% | 2026-04-07 | PraisonAI is a multi-agent teams system. Prior to 1.5.113, the Action Orchestrator feature | |
CVE-2026-13853 |
9.6 |
0.0031
|
23.4% | 2026-06-30 | Use after free in Journeys in Google Chrome prior to 150.0.7871.47 allowed a remote attack | |
CVE-2026-13854 |
9.6 |
0.0031
|
23.3% | 2026-06-30 | Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote | |
CVE-2026-13861 |
9.6 |
0.0031
|
23.3% | 2026-06-30 | Use after free in Core in Google Chrome prior to 150.0.7871.47 allowed a remote attacker w | |
CVE-2026-13878 |
9.6 |
0.0031
|
23.4% | 2026-06-30 | Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remot | |
CVE-2026-13880 |
9.6 |
0.0031
|
23.4% | 2026-06-30 | Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote atta | |
CVE-2026-14113 |
9.6 |
0.0031
|
23.4% | 2026-06-30 | Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a rem | |
CVE-2026-40313 |
9.1 |
0.0031
|
23.2% | 2026-04-14 | PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions | |
CVE-2026-52704 |
10.0 |
0.0031
|
23.2% | 2026-06-15 | Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas Woo | |
CVE-2026-72793 |
9.2 |
0.0031
|
23.3% | 2026-08-12 | SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/syst | |
CVE-2026-72795 |
9.2 |
0.0031
|
23.3% | 2026-08-12 | SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in t | |
CVE-2026-73608 |
9.2 |
0.0031
|
23.3% | 2026-08-13 | SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7. | |
CVE-2026-40154 |
9.6 |
0.0030
|
23.1% | 2026-04-09 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, PraisonAI treats remotely fetch | |
CVE-2026-27243 |
9.3 |
0.0030
|
23.2% | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Sc | |
CVE-2026-27245 |
9.3 |
0.0030
|
23.2% | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Sc | |
CVE-2026-27246 |
9.3 |
0.0030
|
23.2% | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a DOM-based Cross-Site Sc | |
CVE-2026-49108 |
9.8 |
0.0030
|
23.2% | 2026-06-17 | Unauthenticated PHP Object Injection in Moderno < 1.43 versions. | |
CVE-2026-57169 |
9.6 |
0.0030
|
23.2% | 2026-10-16 | Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container ter | |
CVE-2026-105869 |
9.2 |
0.0030
|
23.1% | 2026-10-21 | Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles li | |
CVE-2026-12293 |
9.8 |
0.0030
|
22.9% | 2026-06-16 | Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox | |
CVE-2026-47407 |
9.4 |
0.0030
|
23.0% | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior | |
CVE-2026-9205 |
9.8 |
0.0030
|
22.9% | 2026-08-05 | IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_ | |
CVE-2026-39795 |
9.3 |
0.0030
|
22.9% | 2026-10-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-46893 |
9.9 |
0.0030
|
22.9% | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle JD Edwards |