Critical CVEs
3,393 CVEs with CVSS 9.0+ severity, ranked by exploitation probability.
| CVE | CVSS | EPSS | Percentile | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-52680 |
9.8 |
0.0111
|
65.8% | 2026-07-30 | Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart file | |
CVE-2026-22738 |
9.8 |
0.0111
|
65.8% | 2026-03-27 | In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-suppl | |
CVE-2026-41252 |
9.8 |
0.0111
|
65.8% | 2026-07-20 | xrdp is an open source RDP server. Versions 0.10.6 and prior contain a missing bounds chec | |
CVE-2026-100202 |
9.8 |
0.0111
|
65.7% | 2026-10-13 | Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to | |
CVE-2026-100219 |
9.8 |
0.0111
|
65.7% | 2026-10-13 | Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a ne | |
CVE-2026-73601 |
9.0 |
0.0110
|
65.6% | 2026-08-13 | Flowise versions before 3.1.3 contain a remote code execution vulnerability in the Custom | |
CVE-2026-41939 |
9.3 |
0.0110
|
65.5% | 2026-07-29 | Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bun | |
CVE-2026-18588 |
9.3 |
0.0110
|
65.5% | 2026-08-03 | A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the func | |
CVE-2026-75784 |
9.3 |
0.0110
|
65.5% | 2026-08-18 | A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is t | |
CVE-2026-97814 |
9.8 |
0.0109
|
65.4% | 2026-10-13 | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to exec | |
CVE-2026-70096 |
9.8 |
0.0109
|
65.2% | 2026-10-13 | Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attack | |
CVE-2026-83578 |
9.8 |
0.0109
|
65.2% | 2026-10-13 | Integer underflow (wrap or wraparound) in Windows PowerShell allows an unauthorized attack | |
CVE-2026-44024 |
9.8 |
0.0109
|
65.2% | 2026-07-08 | Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, | |
CVE-2026-83517 |
9.8 |
0.0108
|
65.2% | 2026-10-13 | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized at | |
CVE-2026-83519 |
9.8 |
0.0108
|
65.2% | 2026-10-13 | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to e | |
CVE-2026-83780 |
9.8 |
0.0108
|
65.2% | 2026-10-13 | Use after free in Windows CCFFilter Driver allows an unauthorized attacker to execute code | |
CVE-2026-83910 |
9.8 |
0.0108
|
65.2% | 2026-10-13 | Out-of-bounds write in RPC Runtime allows an unauthorized attacker to execute code over a | |
CVE-2026-49819 |
9.8 |
0.0108
|
65.0% | 2026-08-13 | UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing- | |
CVE-2026-51947 |
9.8 |
0.0107
|
64.9% | 2026-07-01 | An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (f | |
CVE-2026-33598 |
9.1 |
0.0107
|
64.9% | 2026-04-22 | A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDoma | |
CVE-2026-71957 |
9.3 |
0.0107
|
64.8% | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_20260211004 | |
CVE-2026-71958 |
9.3 |
0.0107
|
64.8% | 2026-08-08 | D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_20260211004 | |
CVE-2026-70147 |
9.8 |
0.0107
|
64.8% | 2026-10-13 | Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized a | |
CVE-2026-70153 |
9.8 |
0.0107
|
64.8% | 2026-10-13 | Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized a | |
CVE-2026-70157 |
9.8 |
0.0106
|
64.5% | 2026-10-13 | Heap-based buffer overflow in Windows System Information Console allows an unauthorized at | |
CVE-2026-100222 |
9.8 |
0.0106
|
64.5% | 2026-10-13 | Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker | |
CVE-2026-97805 |
9.8 |
0.0106
|
64.5% | 2026-10-13 | Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker | |
CVE-2026-65770 |
10.0 |
0.0105
|
64.3% | 2026-08-20 | Improper neutralization of argument delimiters in a command ('argument injection') in Azur | |
CVE-2026-96320 |
9.8 |
0.0105
|
64.2% | 2026-10-13 | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execu | |
CVE-2026-82119 |
9.8 |
0.0105
|
64.1% | 2026-10-27 | OS Command Injection Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: | |
CVE-2026-65761 |
9.3 |
0.0104
|
64.1% | 2026-07-23 | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension | |
CVE-2026-73240 |
9.8 |
0.0104
|
64.0% | 2026-08-12 | Specifically crafted inputs may lead to git argument injection in Apache Allura. This iss | |
CVE-2026-33568 |
9.1 |
0.0104
|
64.0% | 2026-10-20 | A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionali | |
CVE-2026-40627 |
9.1 |
0.0104
|
64.0% | 2026-10-20 | An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality | |
CVE-2026-38450 |
9.8 |
0.0104
|
63.9% | 2026-07-14 | An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execu | |
CVE-2026-47208 |
10.0 |
0.0104
|
63.9% | 2026-06-12 | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a | |
CVE-2026-12046 |
9.5 |
0.0104
|
63.8% | 2026-06-19 | Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/clos | |
CVE-2026-48330 |
10.0 |
0.0104
|
63.8% | 2026-08-03 | Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements | |
CVE-2026-14261 |
9.1 |
0.0103
|
63.8% | 2026-07-09 | A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code | |
CVE-2026-5366 |
9.9 |
0.0103
|
63.8% | 2026-06-20 | Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of | |
CVE-2026-41315 |
9.3 |
0.0103
|
63.7% | 2026-05-14 | mdserver-web is a simple Linux panel. From 0.18.0 to 0.18.4, mdserver-web has a front-end | |
CVE-2026-65974 |
9.9 |
0.0103
|
63.6% | 2026-08-17 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and | |
CVE-2026-48315 |
9.3 |
0.0103
|
63.6% | 2026-06-30 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validati | |
CVE-2026-28323 |
9.8 |
0.0103
|
63.5% | 2026-07-30 | SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerabi | |
CVE-2026-67192 |
9.2 |
0.0103
|
63.5% | 2026-07-29 | Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnera | |
CVE-2026-114625 |
9.4 |
0.0103
|
63.5% | 2026-10-22 | KEV | Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allo |
CVE-2026-59115 |
9.9 |
0.0102
|
63.4% | 2026-08-06 | '.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized atta | |
CVE-2026-63509 |
9.9 |
0.0102
|
63.4% | 2026-08-20 | Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privi | |
CVE-2026-24227 |
9.8 |
0.0102
|
63.3% | 2026-07-14 | NVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of | |
CVE-2026-76008 |
10.0 |
0.0102
|
63.3% | 2026-08-19 | A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_ |