Critical CVEs
3,393 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-118332 |
9.6 |
0.0027
|
19.6% | 2026-10-27 | Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a | |
CVE-2026-118342 |
9.6 |
0.0027
|
19.6% | 2026-10-27 | Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote at | |
CVE-2026-118355 |
9.6 |
0.0027
|
19.6% | 2026-10-27 | Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a rem | |
CVE-2026-39324 |
9.3 |
0.0027
|
19.2% | 2026-04-07 | Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, | |
CVE-2026-79868 |
9.6 |
0.0027
|
19.2% | 2026-10-22 | Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an un | |
CVE-2026-79870 |
9.6 |
0.0027
|
19.2% | 2026-10-22 | An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauth | |
CVE-2026-33875 |
9.3 |
0.0027
|
19.1% | 2026-03-27 | Gematik Authenticator securely authenticates users for login to digital health application | |
CVE-2026-40910 |
9.1 |
0.0027
|
19.1% | 2026-04-21 | frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass | |
CVE-2026-34205 |
9.6 |
0.0027
|
19.0% | 2026-03-27 | Home Assistant is open source home automation software that puts local control and privacy | |
CVE-2026-12048 |
9.3 |
0.0027
|
19.0% | 2026-06-19 | Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. | |
CVE-2026-3325 |
10.0 |
0.0027
|
18.9% | 2026-04-29 | SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” parameter of | |
CVE-2026-46911 |
9.6 |
0.0027
|
18.8% | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Project Costing product of Oracle JD Edwards | |
CVE-2026-46912 |
9.3 |
0.0027
|
18.9% | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen | |
CVE-2026-14411 |
9.6 |
0.0027
|
18.9% | 2026-07-01 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.4 | |
CVE-2026-72785 |
9.3 |
0.0027
|
18.8% | 2026-08-11 | Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A co | |
CVE-2026-81212 |
10.0 |
0.0027
|
18.8% | 2026-10-20 | IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an a | |
CVE-2026-115693 |
9.1 |
0.0027
|
18.9% | 2026-10-26 | Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an | |
CVE-2026-33771 |
9.1 |
0.0026
|
18.4% | 2026-04-09 | A Weak Password Requirements vulnerability in the password management function of Juniper | |
CVE-2026-44547 |
9.6 |
0.0026
|
18.2% | 2026-05-12 | ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE | |
CVE-2026-6512 |
9.1 |
0.0026
|
18.4% | 2026-05-14 | The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versi | |
CVE-2026-47413 |
9.6 |
0.0026
|
18.3% | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versi | |
CVE-2026-47416 |
9.6 |
0.0026
|
18.3% | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versi | |
CVE-2026-17749 |
9.6 |
0.0026
|
18.2% | 2026-07-30 | Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7 | |
CVE-2025-30046 |
9.0 |
0.0026
|
18.2% | 2026-10-23 | In the CGM CLININET application server, multiple processes responsible for HL7 communicati | |
CVE-2026-85614 |
9.2 |
0.0026
|
18.2% | 2026-09-04 | OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerabili | |
CVE-2026-22093 |
9.5 |
0.0026
|
17.9% | 2026-07-13 | The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not valid | |
CVE-2026-79862 |
9.6 |
0.0026
|
17.9% | 2026-10-22 | Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow a | |
CVE-2026-79863 |
9.6 |
0.0026
|
17.9% | 2026-10-22 | Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow a | |
CVE-2026-44699 |
9.1 |
0.0026
|
17.6% | 2026-05-15 | LibJWT is a C JSON Web Token Library. From 3.0.0 to 3.3.2, libjwt accepts an RSA JWK that | |
CVE-2026-7321 |
9.6 |
0.0026
|
17.5% | 2026-04-28 | Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component. T | |
CVE-2026-5735 |
9.8 |
0.0026
|
17.3% | 2026-04-07 | Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs | |
CVE-2026-41153 |
9.8 |
0.0026
|
17.4% | 2026-04-17 | In JetBrains Junie before 252.549.29 command execution was possible via malicious project | |
CVE-2026-42300 |
9.3 |
0.0026
|
17.4% | 2026-05-12 | DevGuard provides vulnerability management for the full software supply chain. Prior to 1. | |
CVE-2026-55486 |
9.3 |
0.0026
|
17.4% | 2026-10-23 | The Goobi viewer is a web application that allows digitised material to be displayed in a | |
CVE-2026-93903 |
9.4 |
0.0026
|
17.3% | 2026-09-30 | 1 PoC | LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validati |
CVE-2026-16419 |
9.6 |
0.0026
|
17.1% | 2026-07-21 | Out of bounds read and write in ANGLE in Google Chrome on Android prior to 150.0.7871.182 | |
CVE-2026-6911 |
9.3 |
0.0025
|
17.1% | 2026-04-24 | Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to fo | |
CVE-2026-4320 |
9.3 |
0.0025
|
17.0% | 2026-05-18 | Authorization Bypass vulnerability in Creartia's ICMS software could allow an attacker to | |
CVE-2026-114820 |
9.1 |
0.0025
|
16.8% | 2026-10-24 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edi | |
CVE-2026-5779 |
9.4 |
0.0025
|
16.7% | 2026-04-28 | An insecure direct object reference (IDOR) vulnerability in MphRx's Minerva V3.6.0, specif | |
CVE-2026-16822 |
9.3 |
0.0025
|
16.7% | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to impersonate | |
CVE-2026-25208 |
9.8 |
0.0025
|
16.5% | 2026-04-13 | Integer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.Thi | |
CVE-2026-25209 |
9.1 |
0.0025
|
16.5% | 2026-04-13 | Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Expo | |
CVE-2026-12315 |
9.1 |
0.0025
|
16.5% | 2026-06-16 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox | |
CVE-2026-12440 |
9.6 |
0.0025
|
16.5% | 2026-06-17 | Use after free in DigitalCredentials in Google Chrome on Windows prior to 149.0.7827.155 a | |
CVE-2026-14571 |
9.1 |
0.0025
|
16.5% | 2026-10-28 | A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a | |
CVE-2026-44351 |
9.1 |
0.0025
|
16.4% | 2026-05-13 | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.2.4, a critical aut | |
CVE-2026-15747 |
9.1 |
0.0025
|
16.3% | 2026-07-14 | Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the | |
CVE-2026-81694 |
9.3 |
0.0025
|
16.4% | 2026-08-27 | openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from unt | |
CVE-2026-44231 |
9.1 |
0.0025
|
16.2% | 2026-07-20 | RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to |