Skip to main content
cve.nowby Sazabi
Back

Rankings: This week's worst CVEs

CVEs scored 0-100 on exploitation, exposure, reach, severity and patch status. How the score works.

Severity
    Technology
      Ecosystem
        1. 192Code execution via SQL injection in REST API batch endpointWordPress · CVE-2026-63030KEVExploit publicNucleiFix availableExploit published
        2. 289Remote code execution in CI/CD regex handlingGitLab · CVE-2026-97229KEVExploit publicNucleiFix availableExploit published
        3. 388Remote code execution via race in core upgrade installerWordPress Foundation WordPress · CVE-2026-119977KEVExploit publicFix availableExploit published
        4. 485Remote code execution in diffpatch API via Git hooksGitea · gitea.dev +1 · CVE-2026-60004KEVExploit publicNucleiFix availableExploit published
        5. 584Privilege escalation in netfilter nf_tablesLinux Kernel · CVE-2024-1086KEVExploit publicFix availableExploit published
        6. 683File overwrite in file update API via symlinksGogs · gogs.io/gogs · CVE-2025-8110KEVExploit publicNucleiNo patch listed yetExploit published
        7. 781Authenticated remote file upload via predictable filenamesIvanti Connect Secure · CVE-2026-118527KEVNo patch listed yetPublished
        8. 880Remote code execution in DNS serverMicrosoft Windows Server · Microsoft Windows Server, · CVE-2020-1350KEVExploit publicNo patch listed yetExploit published
        9. 980Remote file write and root execution in file reputationCisco Secure Email · CVE-2026-76519KEVExploit publicNo patch listed yetExploit published
        10. 1080Remote code execution in template engineAdobe Commerce · Adobe Magento Open Source · CVE-2026-75650KEVNucleiNo patch listed yetEPSS crossed 10%
        11. 1180An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530…Hikvision Cameras · CVE-2017-7921KEVExploit publicNucleiNo patch listed yetExploit published
        12. 1275Pre-auth remote code execution in SSH servererlang otp · CVE-2025-32433KEVExploit publicFix availableExploit published
        13. 1375Authentication bypass in SSLVPN serviceSonicWall SonicOS · CVE-2026-19868KEVNo patch listed yetProvisionalPublished
        14. 1475Remote code execution via SQL injection in email parsingCisco Secure Email · CVE-2026-76461KEVExploit publicFix availableExploit published
        15. 1572Remote code execution via unrestricted file uploadAdobe Commerce · Adobe Magento Open Source · CVE-2026-48356KEVExploit publicFix availableExploit published
        16. 1668Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAMOpenIdentityPlatform OpenAM · org.openidentityplatform.open… · CVE-2026-33439Exploit publicNucleiFix availableExploit published
        17. 1766Denial of service in HTTP/2 CONTINUATION handlingnetty · io.netty:netty-codec-http2 · CVE-2026-33871Exploit publicFix availableExploit published
        18. 1863Unauthenticated privilege escalation in user registrationwpopal Opal Estate Pro – Property Management and Submission · CVE-2025-6934Exploit publicNucleiNo patch listed yetExploit published
        19. 1963Payload authentication token field handling issuepayloadcms payload · payload · CVE-2026-105863Exploit publicFix availableExploit published
        20. 2061Auth bypass in Pointer AuthenticationApple Safari · Apple iOS and iPadOS +3 · CVE-2024-27834KEVFix availableAdded to KEV
        21. 2161Unauthenticated code execution in DNS proxy and DNS serverPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1 · CVE-2026-0264Exploit publicFix availableExploit published
        22. 2260Recipient allow list bypass in addressparsernodemailer · CVE-2026-121426Fix availablePublished
        23. 2359Denial of service and data corruption in DICOM parsingProject-MONAI MONAI · monai · CVE-2026-48705Fix availableProvisionalPublished
        24. 2457Privilege escalation in temporary user creationSecurity For WooCommerce · CVE-2026-100109Exploit publicNo patch listed yetProvisionalExploit published
        25. 2557Remote code execution via unrestricted form file uploadWP Libre Form · CVE-2026-118423Exploit publicNo patch listed yetProvisionalExploit published
        26. 2657Authentication bypass leading to RCE via share-tokenanji-plus AJ-Report · CVE-2026-120209Exploit publicNo patch listed yetExploit published
        27. 2757Remote code execution in FrameDecoderGoogle Android · CVE-2026-58868Exploit publicNo patch listed yetExploit published
        28. 2857Command injection via inbound SIP MESSAGE requestssignalwire freeswitch · CVE-2026-116779Exploit publicFix availableProvisionalExploit published
        29. 2957Unauthenticated remote code execution via 'id' parameterwedevs Project Manager – AI Powered Project Management, Tas… · CVE-2026-116512Exploit publicNo patch listed yetExploit published
        30. 3057Unauthenticated command injection in /goform/mpEdimax BR-6208AC · CVE-2026-122051Exploit publicNo patch listed yetProvisionalExploit published
        31. 3157Distrust compromised intermediate certificates in crypto/x509Go standard library crypto/x509 · stdlib +3 · CVE-2026-111943Exploit publicFix availableExploit published
        32. 3257Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' ParameterStylemixThemes Cost Calculator Builder PRO · CVE-2026-14900Exploit publicNo patch listed yetExploit published
        33. 3357Unauthenticated RCE in multiprocess pickle decodingLMCache · CVE-2026-105192Exploit publicFix availableExploit published
        34. 3456Unauthenticated file deletion via ticket attachmentselextensions ELEX WordPress HelpDesk & Customer Ticketing S… · CVE-2026-114630Exploit publicNo patch listed yetProvisionalExploit published
        35. 3555Use-after-free in CPU timersLinux · CVE-2026-98258Exploit publicFix availableExploit published
        36. 3655Use-after-free in POSIX CPU timers during execLinux · CVE-2026-98260Exploit publicFix availableExploit published
        37. 3755Sandbox escape to code execution in JavaScript emitterenspirit elo · @enspirit/elo · CVE-2026-44267Fix availablePublished
        38. 3855Remote code execution in Ruby backendenspirit elo · @enspirit/elo · CVE-2026-44266Fix availablePublished
        39. 3955Command injection in WireGuard CLI group handlingWAVLINK WN551X3-A · CVE-2026-120344No patch listed yetPublished
        40. 4055Remote code execution in OpenVPN handlerWAVLINK WN536AX6-A · CVE-2026-120281No patch listed yetPublished
        41. 4155Command injection in WireGuard client group handlerWAVLINK WN536AX6-A · CVE-2026-120280No patch listed yetPublished
        42. 4255OS command injection in openvpn_cli handlerWAVLINK WN536AX6-A · CVE-2026-120279No patch listed yetPublished
        43. 4355OS command injection in WireGuard CLI group handlerWAVLINK WN536AX6-A · CVE-2026-120277No patch listed yetPublished
        44. 4455Command injection in router web management ioos componentWAVLINK WN536AX6-A · CVE-2026-120276No patch listed yetPublished
        45. 4555OS command injection in initial setup wizardWAVLINK WL-WN579A3-A · CVE-2026-120195No patch listed yetPublished
        46. 4654Privilege escalation via SQL injection in REST routesGS JWT Authentication for WP REST API · CVE-2026-113615Exploit publicNo patch listed yetProvisionalExploit published
        47. 4754Remote code execution via IPN item_name parameterclavaque s2Member – Excellent for All Kinds of Memberships,… · CVE-2026-86596Exploit publicNo patch listed yetProvisionalExploit published
        48. 4853libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerabilitylibwebsockets · CVE-2026-114550Exploit publicNo patch listed yetExploit published
        49. 4953UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpcdavidanderson UpdraftPlus: WP Backup & Migration Plugin · CVE-2026-10795Exploit publicNo patch listed yetExploit published
        50. 5052Authentication bypass in global configuration restoreBarracuda Networks Barracuda Email Security Gateway · CVE-2026-116606Exploit publicFix availableExploit published