Critical CVEs
3,297 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-105222 |
9.1 |
0.0019
|
8.5% | 2026-10-04 | The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verif | |
CVE-2026-25207 |
9.8 |
0.0019
|
8.4% | 2026-04-13 | Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. | |
CVE-2026-61097 |
9.6 |
0.0019
|
8.4% | 2026-07-21 | Vulnerability in the Oracle Banking Trade Finance Process Management product of Oracle Fin | |
CVE-2026-25205 |
9.8 |
0.0019
|
8.3% | 2026-04-13 | Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows out-of-bou | |
CVE-2026-42363 |
9.3 |
0.0019
|
8.1% | 2026-04-27 | An insufficient encryption vulnerability exists in the Device Authentication functionality | |
CVE-2026-63940 |
9.3 |
0.0019
|
8.1% | 2026-07-19 | In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Ignore Port | |
CVE-2026-61174 |
9.0 |
0.0019
|
8.2% | 2026-07-21 | Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (co | |
CVE-2026-44364 |
9.3 |
0.0019
|
8.0% | 2026-05-13 | MISP modules are autonomous modules that can be used to extend MISP for new services. In 3 | |
CVE-2026-11718 |
9.3 |
0.0019
|
8.0% | 2026-06-18 | An authentication bypass vulnerability exists in the generic opaque token validation path | |
CVE-2026-25206 |
9.1 |
0.0018
|
8.0% | 2026-04-13 | Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Expo | |
CVE-2026-61204 |
9.0 |
0.0018
|
7.9% | 2026-07-21 | Vulnerability in the PeopleSoft Enterprise FIN Program Management product of Oracle People | |
CVE-2026-25293 |
9.8 |
0.0018
|
7.7% | 2026-05-04 | Buffer overflow due to incorrect authorization in PLC FW | |
CVE-2026-109772 |
9.1 |
0.0018
|
7.6% | 2026-10-13 | Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firef | |
CVE-2026-6348 |
9.3 |
0.0018
|
7.5% | 2026-04-16 | WinMatrix agent developed by Simopro Technology has a Missing Authentication vulnerability | |
CVE-2026-15925 |
9.2 |
0.0018
|
7.2% | 2026-07-16 | Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7 | |
CVE-2026-116863 |
9.6 |
0.0018
|
7.2% | 2026-10-27 | Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newslett | |
CVE-2026-11717 |
9.3 |
0.0018
|
7.1% | 2026-06-18 | An authentication bypass vulnerability exists in the generic opaque token validation path | |
CVE-2026-117601 |
9.3 |
0.0018
|
7.1% | 2026-10-27 | Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mem | |
CVE-2026-32105 |
9.3 |
0.0017
|
6.8% | 2026-04-17 | xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement ver | |
CVE-2026-17666 |
9.1 |
0.0017
|
6.8% | 2026-07-30 | Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attack | |
CVE-2026-13433 |
9.6 |
0.0017
|
6.5% | 2026-08-12 | IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading | |
CVE-2026-54030 |
9.3 |
0.0017
|
6.0% | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.5 | |
CVE-2026-23559 |
9.4 |
0.0017
|
5.9% | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vul | |
CVE-2026-23560 |
9.4 |
0.0017
|
5.9% | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vul | |
CVE-2026-23561 |
9.4 |
0.0017
|
5.9% | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vul | |
CVE-2026-23562 |
9.4 |
0.0017
|
5.9% | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vul | |
CVE-2026-42486 |
9.4 |
0.0017
|
5.9% | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vul | |
CVE-2026-0082 |
10.0 |
0.0016
|
5.7% | 2026-06-17 | In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app acces | |
CVE-2026-41872 |
9.1 |
0.0016
|
5.1% | 2026-05-12 | "Kura Sushi Official App" provided by EPG, Inc. is vulnerable to improper certificate vali | |
CVE-2026-44592 |
9.4 |
0.0016
|
4.8% | 2026-05-14 | Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABL | |
CVE-2026-33867 |
9.1 |
0.0015
|
4.6% | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo | |
CVE-2026-0063 |
10.0 |
0.0015
|
4.6% | 2026-06-17 | In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable ca | |
CVE-2026-0071 |
10.0 |
0.0015
|
4.6% | 2026-06-17 | In SettingsLib, there is a possible missing permission check due to a logic error in the c | |
CVE-2026-8072 |
9.2 |
0.0015
|
4.3% | 2026-05-12 | Insecure generation of credentials in the local SAT (Technical Support) access functionali | |
CVE-2026-11535 |
9.4 |
0.0015
|
4.3% | 2026-06-12 | An unauthorized access vulnerability exists in the PcSuite APP. The vulnerability can be e | |
CVE-2026-7875 |
9.3 |
0.0015
|
4.0% | 2026-05-06 | NanoClaw version 1.2.0 and prior contains a host/container filesystem boundary vulnerabili | |
CVE-2026-44523 |
10.0 |
0.0015
|
4.0% | 2026-05-14 | Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or | |
CVE-2026-0081 |
10.0 |
0.0015
|
4.0% | 2026-06-17 | In NFC, there is a possible way to spoof an NFC event due to a missing permission check. T | |
CVE-2026-98464 |
9.3 |
0.0014
|
3.6% | 2026-10-18 | In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchron | |
CVE-2026-13385 |
9.5 |
0.0014
|
3.4% | 2026-07-15 | An Improper Validation of Integrity Check Value and Improper Certificate Validation in cer | |
CVE-2026-46913 |
9.3 |
0.0014
|
3.4% | 2026-06-17 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (componen | |
CVE-2026-28573 |
10.0 |
0.0014
|
3.2% | 2026-06-18 | In AndroidManifest.xml, there is a possible persistent denial of service due to a missing | |
CVE-2026-23556 |
9.4 |
0.0014
|
3.1% | 2026-07-09 | When oxenstored is tearing a domain down, the node data is cleaned up but the usage counts | |
CVE-2026-16416 |
9.3 |
0.0013
|
2.7% | 2026-07-21 | Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local at | |
CVE-2026-108014 |
9.1 |
0.0013
|
2.5% | 2026-10-27 | Private keys for eight eMudhra intermediate CA certificates have been compromised https:/ | |
CVE-2026-108015 |
9.1 |
0.0013
|
2.5% | 2026-10-27 | Private keys for eight eMudhra intermediate CA certificates have been compromised https:/ | |
CVE-2026-42193 |
9.1 |
0.0013
|
2.4% | 2026-05-08 | Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, th | |
CVE-2026-28575 |
10.0 |
0.0013
|
2.2% | 2026-06-17 | In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/ser | |
CVE-2026-0068 |
10.0 |
0.0012
|
2.1% | 2026-06-17 | In createSessionInternal of PackageInstallerService.java, there is a possible method to re | |
CVE-2026-28615 |
10.0 |
0.0012
|
2.1% | 2026-06-17 | In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permi |