Critical CVEs
3,393 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-72577 |
9.8 |
0.0127
|
69.8% | 2026-08-10 | Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote | |
CVE-2025-29229 |
9.8 |
0.0127
|
69.8% | 2025-12-23 | linksys E5600 V1.1.0.26 is vulnerable to command injection in the function ddnsStatus. | |
CVE-2026-1115 |
9.6 |
0.0126
|
69.6% | 2026-04-10 | A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social feature of | |
CVE-2026-48276 |
10.0 |
0.0126
|
69.5% | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of | |
CVE-2026-48283 |
10.0 |
0.0126
|
69.5% | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Unrestricted Upload of | |
CVE-2026-44416 |
9.8 |
0.0124
|
69.1% | 2026-08-10 | Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry componen | |
CVE-2026-73519 |
9.3 |
0.0124
|
69.1% | 2026-08-12 | WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into | |
CVE-2026-41926 |
9.3 |
0.0123
|
69.0% | 2026-05-04 | WDR201A WiFi Extender (HW V2.1, FW LFMZX28040922V1.02) contains an OS command injection vu | |
CVE-2026-70554 |
9.3 |
0.0123
|
68.9% | 2026-08-04 | MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated atta | |
CVE-2026-42779 |
9.8 |
0.0123
|
68.8% | 2026-05-01 | The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the o | |
CVE-2026-88131 |
9.8 |
0.0123
|
68.7% | 2026-10-08 | Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker t | |
CVE-2026-43515 |
9.1 |
0.0122
|
68.6% | 2026-05-12 | Improper Authorization vulnerability when multiple method constraints define an HTTP metho | |
CVE-2026-71471 |
9.0 |
0.0122
|
68.5% | 2026-08-12 | A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the | |
CVE-2026-55799 |
9.8 |
0.0122
|
68.5% | 2026-08-10 | Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 | |
CVE-2026-76578 |
9.8 |
0.0121
|
68.2% | 2026-09-07 | A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authenticatio | |
CVE-2026-8592 |
9.8 |
0.0120
|
68.0% | 2026-06-25 | OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect A | |
CVE-2026-8660 |
9.8 |
0.0120
|
68.0% | 2026-06-25 | OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin | |
CVE-2026-8665 |
9.8 |
0.0120
|
68.0% | 2026-06-25 | OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plu | |
CVE-2026-8666 |
9.8 |
0.0120
|
68.0% | 2026-06-25 | OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Trace | |
CVE-2026-110879 |
9.8 |
0.0120
|
68.0% | 2026-10-28 | jackson-databind validates the outer class of a class-name type ID but accepts attacker-se | |
CVE-2026-97749 |
9.8 |
0.0120
|
68.0% | 2026-10-13 | Double free in Microsoft Office Outlook allows an unauthorized attacker to execute code ov | |
CVE-2026-42898 |
9.9 |
0.0119
|
68.0% | 2026-05-12 | Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-pr | |
CVE-2026-55450 |
9.3 |
0.0119
|
67.9% | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1. | |
CVE-2026-52715 |
9.3 |
0.0119
|
67.8% | 2026-06-16 | Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions. | |
CVE-2025-63334 |
9.8 |
0.0118
|
67.6% | 2025-11-05 | PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote code execu | |
CVE-2026-22599 |
9.3 |
0.0118
|
67.6% | 2026-05-14 | Strapi is an open source headless content management system. In versions on the 4.x branch | |
CVE-2025-50526 |
9.8 |
0.0118
|
67.5% | 2025-12-23 | Netgear EX8000 V1.0.0.126 was discovered to contain a command injection vulnerability via | |
CVE-2026-104252 |
9.8 |
0.0117
|
67.4% | 2026-10-13 | Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 an | |
CVE-2026-88156 |
9.8 |
0.0117
|
67.4% | 2026-10-13 | Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to | |
CVE-2026-97016 |
9.8 |
0.0117
|
67.4% | 2026-10-13 | Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to | |
CVE-2026-26015 |
10.0 |
0.0117
|
67.3% | 2026-04-29 | DocsGPT is a GPT-powered chat for documentation. From version 0.15.0 to before version 0.1 | |
CVE-2026-48286 |
10.0 |
0.0117
|
67.2% | 2026-06-30 | Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Inco | |
CVE-2026-27302 |
10.0 |
0.0117
|
67.2% | 2026-08-11 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that | |
CVE-2026-71398 |
10.0 |
0.0117
|
67.2% | 2026-08-11 | Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that | |
CVE-2026-35435 |
10.0 |
0.0116
|
67.2% | 2026-05-07 | Improper access control in Azure AI Foundry M365 published agents allows an unauthorized a | |
CVE-2026-79864 |
9.6 |
0.0116
|
67.2% | 2026-10-22 | Command injection vulnerabilities exist in the affected interface of AOS-10 that could all | |
CVE-2026-51785 |
9.8 |
0.0115
|
66.8% | 2026-07-31 | An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute ar | |
CVE-2026-68771 |
9.3 |
0.0115
|
66.7% | 2026-07-31 | ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDatase | |
CVE-2026-66909 |
9.8 |
0.0115
|
66.8% | 2026-08-06 | Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using na | |
CVE-2026-100886 |
9.3 |
0.0115
|
66.7% | 2026-09-27 | A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build2026 | |
CVE-2026-44590 |
9.3 |
0.0114
|
66.6% | 2026-05-27 | Sherlock hunts down social media accounts by username across social networks. Prior to 0.1 | |
CVE-2026-53421 |
9.8 |
0.0114
|
66.5% | 2026-07-20 | Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administ | |
CVE-2026-42613 |
9.4 |
0.0114
|
66.4% | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, the Login::register() method in | |
CVE-2026-70300 |
9.8 |
0.0113
|
66.3% | 2026-10-13 | Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to | |
CVE-2026-83693 |
9.8 |
0.0113
|
66.3% | 2026-10-13 | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to e | |
CVE-2026-83770 |
9.8 |
0.0113
|
66.3% | 2026-10-13 | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to exec | |
CVE-2026-48316 |
10.0 |
0.0112
|
66.2% | 2026-07-06 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validati | |
CVE-2026-53921 |
9.8 |
0.0112
|
66.2% | 2026-10-23 | 2 PoC | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to ve |
CVE-2026-63767 |
9.3 |
0.0112
|
66.0% | 2026-07-20 | ktransformers through 0.6.3, fixed in commit def0f93, contains an unauthenticated pickle d | |
CVE-2026-69264 |
9.4 |
0.0111
|
65.9% | 2026-08-04 | Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFil |