Critical CVEs
3,393 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-54860 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. | |
CVE-2026-61991 |
10.0 | — | — | 2026-10-29 | Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions. | |
CVE-2026-61992 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions. | |
CVE-2026-61997 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions. | |
CVE-2026-61998 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions. | |
CVE-2026-62001 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions. | |
CVE-2026-62002 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions. | |
CVE-2026-62003 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in Mission <= 1.22 versions. | |
CVE-2026-62004 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. | |
CVE-2026-62005 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. | |
CVE-2026-62006 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in Nuts <= 1.12 versions. | |
CVE-2026-62008 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. | |
CVE-2026-62009 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions. | |
CVE-2026-62010 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. | |
CVE-2026-62011 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. | |
CVE-2026-62012 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions. | |
CVE-2026-62013 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions. | |
CVE-2026-62014 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. | |
CVE-2026-62015 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. | |
CVE-2026-62016 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | |
CVE-2026-62017 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions. | |
CVE-2026-62018 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. | |
CVE-2026-62131 |
9.8 | — | — | 2026-10-29 | Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions. | |
CVE-2026-93680 |
9.8 | — | — | 2026-10-29 | 1 PoC | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security res |
CVE-2026-110186 |
9.8 | — | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary c | |
CVE-2026-90865 |
9.0 | — | — | 2026-10-29 | An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to | |
CVE-2026-90866 |
9.1 | — | — | 2026-10-29 | A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0 | |
CVE-2026-90868 |
9.9 | — | — | 2026-10-29 | An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to | |
CVE-2026-84295 |
10.0 | — | — | 2026-10-29 | Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and | |
CVE-2026-90863 |
9.1 | — | — | 2026-10-29 | Missing authorization in the administrative interface of Progress Software WS_FTP Server v | |
CVE-2026-90864 |
9.1 | — | — | 2026-10-29 | A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0 | |
CVE-2026-111732 |
9.3 | — | — | 2026-10-29 | P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data le | |
CVE-2026-112256 |
9.2 | — | — | 2026-10-29 | Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanc | |
CVE-2026-107032 |
9.1 | — | — | 2026-10-29 | Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unautho | |
CVE-2026-119128 |
9.1 | — | — | 2026-10-29 | ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V | |
CVE-2026-119145 |
9.4 | — | — | 2026-10-29 | Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability bec | |
CVE-2026-107058 |
9.8 | — | — | 2026-10-29 | An issue in Shelter versionCode 445 allows attackers to register their own auth_key and ex | |
CVE-2026-118762 |
9.3 | — | — | 2026-10-29 | Monkeytype is a minimalistic and customizable typing test. Prior to 26.43.0, the .github/w | |
CVE-2026-118769 |
9.2 | — | — | 2026-10-29 | Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function bot | |
CVE-2026-103093 |
9.4 | — | — | 2026-10-29 | ServiceNow has remediated a sandbox escape security issue that was identified in the Servi | |
CVE-2026-61707 |
9.0 | — | — | 2026-10-29 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security oper | |
CVE-2026-61645 |
9.1 | — | — | 2026-10-29 | Docat is a tool for hosting versioned static documentation. In the affected implementation | |
CVE-2023-22793 |
9.3 | — | — | 2026-10-29 | A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE |