Critical CVEs
3,393 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-115933 |
9.9 |
0.0025
|
16.3% | 2026-10-24 | Postiz signs its session, invitation and password reset tokens with one shared secret and | |
CVE-2026-14390 |
9.6 |
0.0025
|
16.1% | 2026-07-01 | Use after free in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker | |
CVE-2026-18847 |
9.8 |
0.0025
|
16.0% | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest cred | |
CVE-2026-9037 |
9.3 |
0.0025
|
15.8% | 2026-05-28 | A firmware update mechanism in the affected charging controller fails to validate the auth | |
CVE-2026-62643 |
10.0 |
0.0025
|
15.9% | 2026-07-14 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sh | |
CVE-2026-52842 |
9.3 |
0.0025
|
15.9% | 2026-07-15 | Lightpanda is a headless browser designed for AI and automation. Prior to 0.3.1, Lightpand | |
CVE-2026-34950 |
9.1 |
0.0024
|
15.8% | 2026-04-06 | fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publ | |
CVE-2026-40903 |
9.1 |
0.0024
|
15.8% | 2026-04-21 | goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED | |
CVE-2026-42747 |
9.3 |
0.0024
|
15.8% | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-12316 |
9.1 |
0.0024
|
15.8% | 2026-06-16 | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox | |
CVE-2026-13882 |
9.6 |
0.0024
|
15.6% | 2026-06-30 | Race in USB in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had comp | |
CVE-2026-79873 |
9.3 |
0.0024
|
15.6% | 2026-10-22 | Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauth | |
CVE-2026-79874 |
9.3 |
0.0024
|
15.6% | 2026-10-22 | An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker | |
CVE-2026-14152 |
9.6 |
0.0024
|
15.5% | 2026-06-30 | Out of bounds read and write in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a re | |
CVE-2026-14397 |
9.6 |
0.0024
|
15.5% | 2026-07-01 | Out of bounds write in ANGLE in Google Chrome on Mac prior to 150.0.7871.46 allowed a remo | |
CVE-2026-87095 |
9.1 |
0.0024
|
15.4% | 2026-10-21 | Sensitive information disclosure and manipulation due to improper authorization checks. Th | |
CVE-2026-79866 |
9.6 |
0.0024
|
15.3% | 2026-10-22 | An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8. Succ | |
CVE-2026-75625 |
9.1 |
0.0024
|
15.3% | 2026-08-18 | Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 | |
CVE-2023-24215 |
9.1 |
0.0024
|
15.1% | 2026-05-18 | Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 al | |
CVE-2026-7428 |
9.2 |
0.0024
|
15.1% | 2026-05-12 | Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB | |
CVE-2026-90465 |
9.4 |
0.0024
|
14.7% | 2026-10-27 | A missing authentication vulnerability in the FireCluster Sync processing allows an attack | |
CVE-2026-42755 |
9.3 |
0.0024
|
14.7% | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-64993 |
9.1 |
0.0024
|
14.7% | 2026-08-06 | Dell RVTools versions prior to 4.8.1, contains an improper certificate validation vulnerab | |
CVE-2026-115216 |
9.1 |
0.0024
|
14.6% | 2026-10-27 | In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is dis | |
CVE-2026-115607 |
9.3 |
0.0024
|
14.7% | 2026-10-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-117574 |
9.1 |
0.0024
|
14.7% | 2026-10-28 | A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can ex | |
CVE-2026-103693 |
9.0 |
0.0024
|
14.6% | 2026-10-29 | The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before | |
CVE-2026-40114 |
10.0 |
0.0024
|
14.5% | 2026-04-09 | PraisonAI is a multi-agent teams system. Prior to 4.5.128, the /api/v1/runs endpoint accep | |
CVE-2026-8511 |
9.6 |
0.0023
|
14.4% | 2026-05-14 | Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to | |
CVE-2026-39574 |
9.3 |
0.0023
|
14.4% | 2026-06-16 | Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions. | |
CVE-2026-54809 |
9.3 |
0.0023
|
14.4% | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-44726 |
9.1 |
0.0023
|
14.4% | 2026-06-23 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw | |
CVE-2026-52843 |
9.3 |
0.0023
|
14.4% | 2026-07-15 | Lightpanda is a headless browser designed for AI and automation. Prior to 0.2.9, Lightpand | |
CVE-2026-55953 |
9.1 |
0.0023
|
14.3% | 2026-07-27 | The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher s | |
CVE-2026-54630 |
9.6 |
0.0023
|
14.3% | 2026-10-23 | Part-DB is an open source inventory management system for electronic components. Prior to | |
CVE-2026-58426 |
9.6 |
0.0023
|
14.3% | 2026-07-03 | Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read | |
CVE-2026-90717 |
9.1 |
0.0023
|
14.2% | 2026-10-28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through | |
CVE-2026-40089 |
9.9 |
0.0023
|
14.1% | 2026-04-09 | Sonicverse is a Self-hosted Docker Compose stack for live radio streaming. The Sonicverse | |
CVE-2026-34841 |
9.8 |
0.0023
|
14.1% | 2026-04-06 | Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affe | |
CVE-2026-40446 |
9.8 |
0.0023
|
14.0% | 2026-04-13 | Access of resource using incompatible type ('type confusion') vulnerability in Samsung Ope | |
CVE-2026-53407 |
9.8 |
0.0023
|
13.9% | 2026-06-12 | Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version 7 | |
CVE-2026-79876 |
9.3 |
0.0023
|
14.0% | 2026-10-22 | A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 c | |
CVE-2026-55981 |
9.6 |
0.0023
|
14.0% | 2026-10-23 | A firmware verification vulnerability in Creative Sound Blaster Katana could allow an atta | |
CVE-2026-16381 |
9.1 |
0.0023
|
13.9% | 2026-07-21 | Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed i | |
CVE-2026-79875 |
9.3 |
0.0023
|
13.8% | 2026-10-22 | A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially a | |
CVE-2026-40111 |
9.3 |
0.0023
|
13.7% | 2026-04-09 | PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he memory hooks executor | |
CVE-2026-42761 |
9.3 |
0.0023
|
13.8% | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-54815 |
9.3 |
0.0023
|
13.8% | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-54819 |
9.3 |
0.0023
|
13.8% | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-56073 |
9.3 |
0.0023
|
13.8% | 2026-06-19 | Cap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification |