Critical CVEs
3,393 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-60002 |
9.4 |
0.0030
|
22.7% | 2026-07-08 | ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key du | |
CVE-2026-16358 |
9.8 |
0.0030
|
22.7% | 2026-07-21 | Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in | |
CVE-2026-44196 |
9.1 |
0.0030
|
22.6% | 2026-05-12 | Pingvin Share X is a secure and easy self-hosted file sharing platform. From 1.14.1 to 1.1 | |
CVE-2026-16349 |
9.8 |
0.0030
|
22.6% | 2026-07-21 | Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed i | |
CVE-2026-47702 |
9.1 |
0.0030
|
22.6% | 2026-08-11 | TypeBot is a chatbot builder tool. In version 3.16.1, API tokens (bearer credentials used | |
CVE-2026-53662 |
9.6 |
0.0030
|
22.4% | 2026-06-23 | immich is a high performance self-hosted photo and video management solution. From commit | |
CVE-2026-75832 |
9.3 |
0.0030
|
22.5% | 2026-08-18 | The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 | |
CVE-2024-34324 |
9.1 |
0.0030
|
22.4% | 2026-10-13 | An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hija | |
CVE-2026-34989 |
9.4 |
0.0030
|
22.4% | 2026-04-06 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-29200 |
9.9 |
0.0030
|
22.4% | 2026-05-04 | A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions f | |
CVE-2026-48242 |
9.2 |
0.0030
|
22.3% | 2026-05-21 | Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials ( | |
CVE-2026-39530 |
9.3 |
0.0030
|
22.2% | 2026-06-15 | Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions. | |
CVE-2026-46395 |
9.3 |
0.0029
|
22.1% | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0 | |
CVE-2026-39511 |
9.3 |
0.0029
|
22.1% | 2026-06-15 | Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions. | |
CVE-2026-105779 |
9.1 |
0.0029
|
22.1% | 2026-10-27 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements | |
CVE-2026-42727 |
9.3 |
0.0029
|
22.0% | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-45750 |
9.0 |
0.0029
|
22.0% | 2026-06-05 | Termix is a web-based server management platform with SSH terminal, tunneling, and file ed | |
CVE-2026-15721 |
9.8 |
0.0029
|
22.1% | 2026-08-04 | Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics | |
CVE-2026-79867 |
9.6 |
0.0029
|
22.0% | 2026-10-22 | Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an un | |
CVE-2026-79869 |
9.6 |
0.0029
|
22.0% | 2026-10-22 | Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an u | |
CVE-2026-49002 |
9.1 |
0.0029
|
21.8% | 2026-05-27 | Access control failure means that an application does not effectively check user access pe | |
CVE-2026-39502 |
9.3 |
0.0029
|
21.8% | 2026-06-15 | Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions. | |
CVE-2026-13872 |
9.1 |
0.0029
|
21.8% | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android p | |
CVE-2025-66844 |
9.1 |
0.0029
|
21.6% | 2025-12-15 | In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig t | |
CVE-2024-25181 |
9.1 |
0.0029
|
21.6% | 2025-12-29 | A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Se | |
CVE-2026-45439 |
9.3 |
0.0029
|
21.7% | 2026-06-15 | Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions. | |
CVE-2026-14387 |
9.6 |
0.0029
|
21.7% | 2026-07-01 | Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker | |
CVE-2026-16375 |
9.8 |
0.0029
|
21.6% | 2026-07-21 | Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Fi | |
CVE-2026-50086 |
9.8 |
0.0029
|
21.6% | 2026-06-12 | The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups aga | |
CVE-2026-49067 |
9.3 |
0.0029
|
21.4% | 2026-06-15 | Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions. | |
CVE-2026-49776 |
9.3 |
0.0029
|
21.4% | 2026-06-15 | Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: | |
CVE-2026-52693 |
9.3 |
0.0029
|
21.4% | 2026-06-15 | Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions. | |
CVE-2026-12205 |
9.1 |
0.0029
|
21.4% | 2026-06-15 | Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to pr | |
CVE-2026-54186 |
9.3 |
0.0029
|
21.4% | 2026-06-17 | Unauthenticated SQL Injection in JobSearch <= 3.2.9 versions. | |
CVE-2026-43914 |
9.8 |
0.0029
|
21.4% | 2026-05-11 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a | |
CVE-2026-12411 |
9.6 |
0.0029
|
21.4% | 2026-06-26 | Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows | |
CVE-2026-91354 |
9.9 |
0.0029
|
21.1% | 2026-10-20 | Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (com | |
CVE-2026-6768 |
9.8 |
0.0029
|
21.0% | 2026-04-21 | Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Fi | |
CVE-2026-6919 |
9.6 |
0.0029
|
21.0% | 2026-04-23 | Use after free in DevTools in Google Chrome prior to 147.0.7727.117 allowed a remote attac | |
CVE-2026-52705 |
9.0 |
0.0029
|
21.0% | 2026-06-17 | Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 vers | |
CVE-2026-16387 |
9.8 |
0.0028
|
20.9% | 2026-07-21 | Site isolation issue in the Networking component. This vulnerability was fixed in Firefox | |
CVE-2026-39441 |
9.3 |
0.0028
|
20.8% | 2026-06-15 | Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions. | |
CVE-2026-39512 |
9.3 |
0.0028
|
20.8% | 2026-06-15 | Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions. | |
CVE-2026-39519 |
9.3 |
0.0028
|
20.8% | 2026-06-15 | Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions. | |
CVE-2026-40771 |
9.3 |
0.0028
|
20.8% | 2026-06-15 | Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions. | |
CVE-2026-40798 |
9.3 |
0.0028
|
20.8% | 2026-06-15 | Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions. | |
CVE-2026-42381 |
9.3 |
0.0028
|
20.8% | 2026-06-15 | Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions. | |
CVE-2026-42386 |
9.3 |
0.0028
|
20.8% | 2026-06-15 | Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions. | |
CVE-2026-42639 |
9.3 |
0.0028
|
20.8% | 2026-06-15 | Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions. | |
CVE-2026-42665 |
9.3 |
0.0028
|
20.8% | 2026-06-15 | Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions. |