Skip to main content
cve.nowby Sazabi
Rankings

Rankings: Worst CVEs of 2026-W45

The worst CVEs published or escalated Nov 2, 2026 to Nov 8, 2026, ranked by the cve.now Index as the week closed. Movement is against the week before. How the score works.

  1. 1New92Remote code execution via REST API batch routeWordPress · wordpress-multisite · CVE-2026-63030KEVExploit publicNucleiFix availableExploit published
  2. 2▼189Remote code execution in CI/CD regex handlingGitLab · CVE-2026-97229KEVExploit publicNucleiFix availableExploit published
  3. 3New88Remote code execution via race in core upgrade installerWordPress Foundation WordPress · CVE-2026-119977KEVExploit publicFix availableExploit published
  4. 4New86Remote code execution in Syslog serviceVMware Cloud Foundation · VMware vSphere Foundation +3 · CVE-2026-59310KEVFix availableEPSS crossed 10%
  5. 5New84Privilege escalation in netfilter nf_tablesLinux Kernel · CVE-2024-1086KEVExploit publicFix availableExploit published
  6. 6New83File overwrite in file update API via symlinksGogs · gogs.io/gogs · CVE-2025-8110KEVExploit publicNucleiNo patch listed yetExploit published
  7. 7New81Authenticated remote file upload via predictable filenamesIvanti Connect Secure · CVE-2026-118527KEVNo patch listed yetPublished
  8. 8New80Remote code execution in DNS serverMicrosoft Windows Server · Microsoft Windows Server, · CVE-2020-1350KEVExploit publicNo patch listed yetExploit published
  9. 9New80Remote file write and root execution in file reputationCisco Secure Email · CVE-2026-76519KEVExploit publicNo patch listed yetExploit published
  10. 10New80Remote code execution in template engineAdobe Commerce · Adobe Magento Open Source · CVE-2026-75650KEVNucleiNo patch listed yetEPSS crossed 10%
  11. 11New80Data leak via authentication bypass in web serverHikvision Cameras · CVE-2017-7921KEVExploit publicNucleiNo patch listed yetExploit published
  12. 12New79Information disclosure in Remote Access VPNcheckpoint Check Point Quantum Gateway, Spark Gateway and C… · CVE-2024-24919KEVExploit publicNucleiNo patch listed yetExploit published
  13. 13New77Local privilege escalation to root in guest toolsVMware VCF operations · VMware tools +4 · CVE-2025-41244KEVFix availableProvisionalEPSS crossed 10%
  14. 14New75Pre-auth remote code execution in SSH servererlang otp · CVE-2025-32433KEVExploit publicFix availableExploit published
  15. 15New75Authentication bypass in SSLVPN serviceSonicWall SonicOS · CVE-2026-19868KEVNo patch listed yetProvisionalPublished
  16. 16New75Remote code execution via SQL injection in email parsingCisco Secure Email · CVE-2026-76461KEVExploit publicFix availableExploit published
  17. 17▼772Remote code execution via unrestricted file uploadAdobe Commerce · Adobe Magento Open Source · CVE-2026-48356KEVExploit publicFix availableExploit published
  18. 18New68Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAMOpenIdentityPlatform OpenAM · org.openidentityplatform.open… · CVE-2026-33439Exploit publicNucleiFix availableExploit published
  19. 19New67Privilege escalation via user token validationjfrog artifactory · CVE-2026-42016KEVExploit publicFix availableExploit published
  20. 20New66Denial of service in HTTP/2 CONTINUATION handlingnetty · io.netty:netty-codec-http2 · CVE-2026-33871Exploit publicFix availableExploit published
  21. 21New63Payload authentication token field handling issuepayloadcms payload · payload · CVE-2026-105863Exploit publicFix availableExploit published
  22. 22New61Auth bypass in Pointer AuthenticationApple Safari · Apple iOS and iPadOS +3 · CVE-2024-27834KEVFix availableAdded to KEV
  23. 23New61Unauthenticated code execution in DNS proxy and DNS serverPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1 · CVE-2026-0264Exploit publicFix availableExploit published
  24. 24New60Recipient allow list bypass in addressparsernodemailer · CVE-2026-121426Fix availablePublished
  25. 25New59Denial of service and data corruption in DICOM parsingProject-MONAI MONAI · monai · CVE-2026-48705Fix availablePublished

2026-W44