Critical CVEs
3,393 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-48886 |
9.3 |
0.0028
|
20.8% | 2026-06-15 | Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions. | |
CVE-2026-22332 |
9.3 |
0.0028
|
20.8% | 2026-06-17 | Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions. | |
CVE-2026-49084 |
9.3 |
0.0028
|
20.8% | 2026-06-17 | Unauthenticated SQL Injection in JetEngine < 3.8.9.1 versions. | |
CVE-2026-54187 |
9.3 |
0.0028
|
20.8% | 2026-06-17 | Unauthenticated SQL Injection in JetEngine <= 3.8.10.1 versions. | |
CVE-2026-54811 |
9.3 |
0.0028
|
20.8% | 2026-06-17 | Unauthenticated SQL Injection in WP eMember < v10.9.4 versions. | |
CVE-2026-54812 |
9.3 |
0.0028
|
20.8% | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-46872 |
9.0 |
0.0028
|
20.7% | 2026-06-17 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise | |
CVE-2026-55740 |
9.3 |
0.0028
|
20.7% | 2026-06-18 | Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30 | |
CVE-2026-63687 |
9.1 |
0.0028
|
20.7% | 2026-08-06 | Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the aut | |
CVE-2026-116163 |
9.1 |
0.0028
|
20.7% | 2026-10-25 | Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication byp | |
CVE-2026-34727 |
9.1 |
0.0028
|
20.6% | 2026-04-10 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC c | |
CVE-2026-42523 |
9.0 |
0.0028
|
20.6% | 2026-04-29 | Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL as part | |
CVE-2026-75926 |
9.3 |
0.0028
|
20.6% | 2026-08-18 | Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that c | |
CVE-2026-10141 |
9.1 |
0.0028
|
20.6% | 2026-10-20 | A Unsigned Firmware vulnerability exists in the boa Firmware Update functionality of X2000 | |
CVE-2026-49774 |
9.9 |
0.0028
|
20.4% | 2026-06-16 | Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD | |
CVE-2026-14382 |
9.6 |
0.0028
|
20.4% | 2026-07-01 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.4 | |
CVE-2026-46713 |
9.2 |
0.0028
|
20.4% | 2026-08-03 | Misskey is an open source, federated social media platform. Versions 12.37.0 and later, bu | |
CVE-2026-34562 |
9.0 |
0.0028
|
20.3% | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-6760 |
9.8 |
0.0028
|
20.3% | 2026-04-21 | Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Fi | |
CVE-2026-44442 |
9.9 |
0.0028
|
20.4% | 2026-05-13 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, cert | |
CVE-2026-9739 |
9.4 |
0.0028
|
20.4% | 2026-05-27 | Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta p | |
CVE-2026-65583 |
9.1 |
0.0028
|
20.3% | 2026-08-06 | Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens withou | |
CVE-2026-34987 |
9.0 |
0.0028
|
20.3% | 2026-04-09 | Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, W | |
CVE-2026-41583 |
9.3 |
0.0028
|
20.2% | 2026-05-08 | ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to | |
CVE-2026-48881 |
9.1 |
0.0028
|
20.3% | 2026-06-15 | Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions. | |
CVE-2026-42799 |
9.8 |
0.0028
|
20.1% | 2026-04-30 | Out-of-bounds read vulnerability in ASR Kestrel (nr_fw modules) allows Overflow Buffers. | |
CVE-2026-0126 |
9.8 |
0.0028
|
20.1% | 2026-06-16 | In WC-Radio, there is a possible out of bounds write due to a missing bounds check. This c | |
CVE-2026-14044 |
9.6 |
0.0028
|
20.1% | 2026-06-30 | Use after free in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker | |
CVE-2026-115214 |
9.8 |
0.0028
|
20.1% | 2026-10-25 | The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the use | |
CVE-2026-42748 |
9.9 |
0.0028
|
20.1% | 2026-05-27 | Unrestricted Upload of File with Dangerous Type vulnerability in WPify WPify Woo Czech wpi | |
CVE-2026-9487 |
9.1 |
0.0028
|
20.0% | 2026-08-03 | XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_si | |
CVE-2026-7874 |
9.1 |
0.0027
|
19.9% | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow disclosure of all stored creden | |
CVE-2026-17709 |
9.6 |
0.0027
|
20.0% | 2026-07-30 | Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker | |
CVE-2026-17711 |
9.6 |
0.0027
|
20.0% | 2026-07-30 | Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker | |
CVE-2026-17855 |
9.6 |
0.0027
|
20.0% | 2026-07-30 | Race in DevTools in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker | |
CVE-2026-34563 |
9.0 |
0.0027
|
19.8% | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-34565 |
9.0 |
0.0027
|
19.8% | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-34566 |
9.0 |
0.0027
|
19.8% | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-34567 |
9.0 |
0.0027
|
19.8% | 2026-04-01 | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular arch | |
CVE-2026-34179 |
9.1 |
0.0027
|
19.7% | 2026-04-09 | In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certif | |
CVE-2026-28185 |
9.8 |
0.0027
|
19.8% | 2026-08-13 | Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions. | |
CVE-2026-89035 |
9.1 |
0.0027
|
19.8% | 2026-10-21 | MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebF | |
CVE-2026-40750 |
9.9 |
0.0027
|
19.7% | 2026-06-16 | Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Onlin | |
CVE-2026-107685 |
9.1 |
0.0027
|
19.7% | 2026-10-23 | Improper Certificate Validation vulnerability in the WebSocket streaming client in agentji | |
CVE-2026-42864 |
9.9 |
0.0027
|
19.6% | 2026-05-11 | FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firef | |
CVE-2026-118308 |
9.6 |
0.0027
|
19.6% | 2026-10-27 | Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to | |
CVE-2026-118309 |
9.6 |
0.0027
|
19.6% | 2026-10-27 | Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allo | |
CVE-2026-118310 |
9.6 |
0.0027
|
19.6% | 2026-10-27 | Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 a | |
CVE-2026-118312 |
9.6 |
0.0027
|
19.6% | 2026-10-27 | Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attack | |
CVE-2026-118316 |
9.6 |
0.0027
|
19.6% | 2026-10-27 | Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote a |