Dashboard / Critical

Critical CVEs

3,477 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.

CVE CVSS EPSS Percentile Published Flags Description
CVE-2026-76527 9.8
0.0013
2.9% 2026-10-21 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has
CVE-2026-16416 9.3
0.0013
2.7% 2026-07-21 Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.182 allowed a local at
CVE-2026-108014 9.1
0.0013
2.5% 2026-10-27 Private keys for eight eMudhra intermediate CA certificates have been compromised https:/
CVE-2026-108015 9.1
0.0013
2.5% 2026-10-27 Private keys for eight eMudhra intermediate CA certificates have been compromised https:/
CVE-2026-42193 9.1
0.0013
2.4% 2026-05-08 Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, th
CVE-2026-28575 10.0
0.0013
2.2% 2026-06-17 In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/ser
CVE-2026-0068 10.0
0.0012
2.1% 2026-06-17 In createSessionInternal of PackageInstallerService.java, there is a possible method to re
CVE-2026-28615 10.0
0.0012
2.1% 2026-06-17 In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permi
CVE-2026-0064 10.0
0.0012
2.0% 2026-06-17 In multiple places, there is a possible persistent denial of service due to resource exhau
CVE-2026-0083 10.0
0.0012
1.9% 2026-06-17 In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race conditi
CVE-2026-28587 10.0
0.0011
1.5% 2026-06-17 In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive in
CVE-2026-8470 9.1
0.0011
1.3% 2026-08-05 IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0
CVE-2025-30054 9.3
0.0010
0.8% 2026-10-23 CGM CLININET is vulnerable to local privilege escalation. The service that processes incom
CVE-2026-77055 9.3
0.0009
0.5% 2026-10-26 boneIO black_debian_images gives the boneio service account excessive privileges, includin
CVE-2026-116116 9.3
0.0009
0.4% 2026-10-26 A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. Affected is an unknown
CVE-2026-115964 9.3 — — 2026-10-29 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulne
CVE-2026-97854 9.3 — — 2026-10-29 Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command in
CVE-2026-119050 9.2 — — 2026-10-29 Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows
CVE-2026-107015 9.1 — — 2026-10-29 Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers t
CVE-2026-104317 9.8 — — 2026-10-29 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the me
CVE-2026-104339 9.8 — — 2026-10-29 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary c
CVE-2026-18894 9.8 — — 2026-10-29 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existin
CVE-2026-54856 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.
CVE-2026-54857 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.
CVE-2026-54858 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.
CVE-2026-54859 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.
CVE-2026-54860 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.
CVE-2026-61991 10.0 — &mdash; 2026-10-29 Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.
CVE-2026-61992 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.
CVE-2026-61997 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.
CVE-2026-61998 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.
CVE-2026-62001 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.
CVE-2026-62002 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.
CVE-2026-62003 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Mission <= 1.22 versions.
CVE-2026-62004 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.
CVE-2026-62005 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.
CVE-2026-62006 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.
CVE-2026-62008 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.
CVE-2026-62009 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.
CVE-2026-62010 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.
CVE-2026-62011 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.
CVE-2026-62012 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.
CVE-2026-62013 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.
CVE-2026-62014 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.
CVE-2026-62015 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.
CVE-2026-62016 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.
CVE-2026-62017 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.
CVE-2026-62018 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.
CVE-2026-62131 9.8 — &mdash; 2026-10-29 Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.
CVE-2026-93680 9.8 — &mdash; 2026-10-29 1 PoC IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security res