Critical CVEs
3,587 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-116366 |
9.5 | — | — | 2026-10-30 | An issue has been discovered in ClickHouse Server that, under certain conditions, could al | |
CVE-2026-119418 |
9.2 | — | — | 2026-10-30 | CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inj | |
CVE-2026-119419 |
9.2 | — | — | 2026-10-30 | CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inj | |
CVE-2026-119568 |
9.1 | — | — | 2026-10-30 | vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() | |
CVE-2026-119597 |
9.3 | — | — | 2026-10-30 | OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows | |
CVE-2026-110799 |
9.8 | — | — | 2026-10-30 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecom | |
CVE-2026-112905 |
9.0 | — | — | 2026-10-30 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecom | |
CVE-2026-119660 |
9.3 | — | — | 2026-10-30 | MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthent | |
CVE-2026-61728 |
9.9 | — | — | 2026-10-30 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security oper | |
CVE-2026-93327 |
9.4 | — | — | 2026-10-30 | A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud | |
CVE-2026-61737 |
9.8 | — | — | 2026-10-30 | ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a ha | |
CVE-2026-61738 |
10.0 | — | — | 2026-10-30 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security oper | |
CVE-2026-61729 |
9.4 | — | — | 2026-10-30 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security oper | |
CVE-2026-61730 |
9.3 | — | — | 2026-10-30 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security oper | |
CVE-2026-119706 |
9.3 | — | — | 2026-10-30 | InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution v | |
CVE-2026-119716 |
9.2 | — | — | 2026-10-30 | pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compiler.py that | |
CVE-2026-119717 |
9.2 | — | — | 2026-10-30 | pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_compiler.py that | |
CVE-2026-112816 |
10.0 | — | — | 2026-10-30 | Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.2 | |
CVE-2026-61826 |
10.0 | — | — | 2026-10-30 | Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_n | |
CVE-2026-118697 |
9.0 | — | — | 2026-10-30 | In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, | |
CVE-2026-119978 |
9.0 | — | — | 2026-10-30 | Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated us | |
CVE-2026-116386 |
9.8 | — | — | 2026-10-30 | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions. | |
CVE-2026-116852 |
9.1 | — | — | 2026-10-30 | Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions. | |
CVE-2026-119526 |
9.8 | — | — | 2026-10-30 | Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Inje | |
CVE-2026-39732 |
9.3 | — | — | 2026-10-30 | Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. | |
CVE-2026-39738 |
9.8 | — | — | 2026-10-30 | Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions. | |
CVE-2026-90888 |
9.8 | — | — | 2026-10-30 | Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions. | |
CVE-2026-78403 |
9.3 | — | — | 2026-10-30 | Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Key | |
CVE-2026-55598 |
9.1 | — | — | 2026-10-30 | PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0. | |
CVE-2026-61850 |
9.3 | — | — | 2026-10-30 | Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, | |
CVE-2026-116241 |
9.9 | — | — | 2026-10-30 | pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO c | |
CVE-2026-61620 |
9.8 | — | — | 2026-10-30 | HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications t | |
CVE-2026-117666 |
9.1 | — | — | 2026-10-30 | Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_v | |
CVE-2026-62863 |
9.6 | — | — | 2026-10-30 | MoLing is a computer-use and browser-use based MCP server. Prior to 0.5.0, when MoLing run | |
CVE-2026-62849 |
9.1 | — | — | 2026-10-30 | ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection | |
CVE-2026-62853 |
9.9 | — | — | 2026-10-30 | ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerS | |
CVE-2026-63377 |
9.8 | — | — | 2026-10-30 | TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tena |