Critical CVEs
3,297 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-0064 |
10.0 |
0.0012
|
2.0% | 2026-06-17 | In multiple places, there is a possible persistent denial of service due to resource exhau | |
CVE-2026-0083 |
10.0 |
0.0012
|
1.9% | 2026-06-17 | In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race conditi | |
CVE-2026-28587 |
10.0 |
0.0011
|
1.5% | 2026-06-17 | In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive in | |
CVE-2026-8470 |
9.1 |
0.0011
|
1.3% | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0 | |
CVE-2025-30054 |
9.3 |
0.0010
|
0.8% | 2026-10-23 | CGM CLININET is vulnerable to local privilege escalation. The service that processes incom | |
CVE-2026-77055 |
9.3 |
0.0009
|
0.5% | 2026-10-26 | boneIO black_debian_images gives the boneio service account excessive privileges, includin | |
CVE-2026-116116 |
9.3 |
0.0009
|
0.4% | 2026-10-26 | A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown | |
CVE-2019-15598 |
9.8 | — | — | 2019-12-18 | A Code Injection exists in treekill on Windows which allows a remote code execution when a | |
CVE-2020-21012 |
9.8 | — | — | 2021-10-01 | Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL | |
CVE-2021-25827 |
9.8 | — | — | 2023-06-28 | Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-F | |
CVE-2020-37282 |
9.3 | — | — | 2026-10-14 | office-converter through 1.0.2 contains an OS command injection vulnerability that allows | |
CVE-2016-20101 |
9.2 | — | — | 2026-10-20 | Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability | |
CVE-2021-48014 |
9.3 | — | — | 2026-10-22 | FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer desi | |
CVE-2021-48016 |
9.3 | — | — | 2026-10-22 | DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where | |
CVE-2026-103780 |
9.8 | — | — | 2026-10-28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 relea | |
CVE-2026-103792 |
9.6 | — | — | 2026-10-28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through | |
CVE-2026-103799 |
9.6 | — | — | 2026-10-28 | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through | |
CVE-2026-112197 |
9.4 | — | — | 2026-10-28 | Vulnerability due to a lack of authentication in critical functions of the NoviGest Deskto | |
CVE-2026-114278 |
9.8 | — | — | 2026-10-28 | The che-machine-exec service constructs a shell command by concatenating user-controlled i | |
CVE-2026-111411 |
9.3 | — | — | 2026-10-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-115607 |
9.3 | — | — | 2026-10-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-115904 |
9.6 | — | — | 2026-10-28 | Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Lin | |
CVE-2026-67074 |
9.1 | — | — | 2026-10-28 | HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . It may allow attacke | |
CVE-2026-105420 |
9.4 | — | — | 2026-10-28 | Wing FTP Server does not verify user's base folder. An attacker with admin privileges can | |
CVE-2026-115968 |
9.8 | — | — | 2026-10-28 | Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimat | |
CVE-2026-44179 |
9.9 | — | — | 2026-10-28 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content | |
CVE-2026-103406 |
9.8 | — | — | 2026-10-28 | An Improper Neutralization of Special Elements used in an OS Command vulnerability in the | |
CVE-2026-103409 |
9.8 | — | — | 2026-10-28 | A Missing authentication for critical function vulnerability in Juniper Networks Session S | |
CVE-2026-118264 |
9.1 | — | — | 2026-10-28 | Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware sel | |
CVE-2026-117574 |
9.1 | — | — | 2026-10-28 | A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can ex | |
CVE-2026-63190 |
9.4 | — | — | 2026-10-28 | FearlessCMS is a flat-file `content` management system centered on simplicity and open sou | |
CVE-2026-118690 |
9.3 | — | — | 2026-10-28 | Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows | |
CVE-2026-61564 |
10.0 | — | — | 2026-10-28 | AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint | |
CVE-2026-61567 |
10.0 | — | — | 2026-10-28 | AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/vide | |
CVE-2026-118579 |
9.3 | — | — | 2026-10-28 | A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the func | |
CVE-2020-37281 |
9.2 | — | — | 2026-10-14 | Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability th | |
CVE-2018-25254 |
9.3 | — | — | 2026-04-04 | NICO-FTP 3.0.1.19 contains a structured exception handler buffer overflow vulnerability th | |
CVE-2026-66088 |
9.4 | — | — | 2026-10-29 | In openEQUELLA before 2026.1, the system.execute() function available to the scripting eng | |
CVE-2026-109516 |
9.8 | — | — | 2026-10-29 | The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication B | |
CVE-2026-42922 |
9.8 | — | — | 2026-10-29 | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version | |
CVE-2026-103693 |
9.0 | — | — | 2026-10-29 | The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before | |
CVE-2026-113616 |
9.8 | — | — | 2026-10-29 | The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-t | |
CVE-2026-113617 |
9.9 | — | — | 2026-10-29 | The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a us | |
CVE-2026-115245 |
9.8 | — | — | 2026-10-29 | The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploade | |
CVE-2026-114358 |
9.3 | — | — | 2026-10-29 | This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation | |
CVE-2026-115964 |
9.3 | — | — | 2026-10-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne | |
CVE-2026-97854 |
9.8 | — | — | 2026-10-29 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command in |