Rankings: This week's CVE charts
How the CVEs on the board score, and why. How the score works.
Chart
Score against CVSS
Each dot is a CVE on the board. CVSS rates how bad a bug could be; the Index adds whether it is exploited, exposed and widely used.
- CVE-2026-63030 WordPress: score 92, CVSS 9.8, In CISA KEV
- CVE-2026-97229 GitLab: score 89, CVSS 10, In CISA KEV
- CVE-2026-119977 WordPress Foundation WordPress: score 88, CVSS 8.1, In CISA KEV
- CVE-2026-60004 Gitea · gitea.dev +1: score 85, CVSS 9.8, In CISA KEV
- CVE-2024-1086 Linux Kernel: score 84, CVSS 7.8, In CISA KEV
- CVE-2025-8110 Gogs · gogs.io/gogs: score 83, CVSS 8.7, In CISA KEV
- CVE-2026-118527 Ivanti Connect Secure: score 81, CVSS 4.3, In CISA KEV
- CVE-2020-1350 Microsoft Windows Server · Microsoft Windows Server,: score 80, CVSS 10, In CISA KEV
- CVE-2026-76519 Cisco Secure Email: score 80, CVSS 9.8, In CISA KEV
- CVE-2026-75650 Adobe Commerce · Adobe Magento Open Source: score 80, CVSS 10, In CISA KEV
- CVE-2017-7921 Hikvision Cameras: score 80, CVSS 9.8, In CISA KEV
- CVE-2025-32433 erlang otp: score 75, CVSS 10, In CISA KEV
- CVE-2026-19868 SonicWall SonicOS: score 75, CVSS 7.5, In CISA KEV
- CVE-2026-76461 Cisco Secure Email: score 75, CVSS 9.8, In CISA KEV
- CVE-2026-48356 Adobe Commerce · Adobe Magento Open Source: score 72, CVSS 9.3, In CISA KEV
- CVE-2026-33439 OpenIdentityPlatform OpenAM · org.openidentityplatform.open…: score 68, CVSS 9.3
- CVE-2026-33871 netty · io.netty:netty-codec-http2: score 66, CVSS 8.7
- CVE-2025-6934 wpopal Opal Estate Pro – Property Management and Submission: score 63, CVSS 9.8
- CVE-2026-105863 payloadcms payload · payload: score 63, CVSS 9.2
- CVE-2024-27834 Apple Safari · Apple iOS and iPadOS +3: score 61, CVSS 5.5, In CISA KEV
- CVE-2026-0264 Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1: score 61, CVSS 7.2
- CVE-2026-121426 nodemailer: score 60, CVSS 8.3
- CVE-2026-48705 Project-MONAI MONAI · monai: score 59, CVSS 9.3
- CVE-2026-100109 Security For WooCommerce: score 57, CVSS 9.8
- CVE-2026-118423 WP Libre Form: score 57, CVSS 10
- CVE-2026-120209 anji-plus AJ-Report: score 57, CVSS 9.3
- CVE-2026-58868 Google Android: score 57, CVSS 9.8
- CVE-2026-116779 signalwire freeswitch: score 57, CVSS 9.8
- CVE-2026-116512 wedevs Project Manager – AI Powered Project Management, Tas…: score 57, CVSS 9.8
- CVE-2026-122051 Edimax BR-6208AC: score 57, CVSS 10
- CVE-2026-111943 Go standard library crypto/x509 · stdlib +3: score 57, CVSS 6.8
- CVE-2026-14900 StylemixThemes Cost Calculator Builder PRO: score 57, CVSS 9.8
- CVE-2026-105192 LMCache: score 57, CVSS 9.8
- CVE-2026-114630 elextensions ELEX WordPress HelpDesk & Customer Ticketing S…: score 56, CVSS 9.1
- CVE-2026-98258 Linux: score 55, CVSS 7.8
- CVE-2026-98260 Linux: score 55, CVSS 7.8
- CVE-2026-44267 enspirit elo · @enspirit/elo: score 55, CVSS 9.8
- CVE-2026-44266 enspirit elo · @enspirit/elo: score 55, CVSS 9.8
- CVE-2026-120344 WAVLINK WN551X3-A: score 55, CVSS 10
- CVE-2026-120281 WAVLINK WN536AX6-A: score 55, CVSS 10
- CVE-2026-120280 WAVLINK WN536AX6-A: score 55, CVSS 10
- CVE-2026-120279 WAVLINK WN536AX6-A: score 55, CVSS 10
- CVE-2026-120277 WAVLINK WN536AX6-A: score 55, CVSS 10
- CVE-2026-120276 WAVLINK WN536AX6-A: score 55, CVSS 10
- CVE-2026-120195 WAVLINK WL-WN579A3-A: score 55, CVSS 10
- CVE-2026-113615 GS JWT Authentication for WP REST API: score 54, CVSS 9.8
- CVE-2026-86596 clavaque s2Member – Excellent for All Kinds of Memberships,…: score 54, CVSS 9.8
- CVE-2026-114550 libwebsockets: score 53, CVSS 8.1
- CVE-2026-10795 davidanderson UpdraftPlus: WP Backup & Migration Plugin: score 53, CVSS 8.1
- CVE-2026-116606 Barracuda Networks Barracuda Email Security Gateway: score 52, CVSS 9.3
- CVE-2026-56190 Microsoft Windows: score 52, CVSS 9.8
- CVE-2024-57521 SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in…: score 52, CVSS 10
- CVE-2026-103039 Gravity Forms: score 52, CVSS 9.8
- CVE-2026-49272 oauthlib: score 52, CVSS 8.5
- CVE-2026-54523 kyverno · github.com/kyverno/kyverno: score 50, CVSS 9.6
- CVE-2026-38595 An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted…: score 50, CVSS 9.8
- CVE-2026-120345 WAVLINK WN551X3-A: score 50, CVSS 10
- CVE-2026-120198 WAVLINK WL-WN530BE1-A: score 50, CVSS 10
- CVE-2026-120189 D-Link DIR-505: score 50, CVSS 10
- CVE-2026-114604 ardatan graphql-tools · @graphql-tools/utils: score 50, CVSS 8.4
- CVE-2026-99246 Linux: score 50, CVSS 8.1
- CVE-2026-102334 NginxProxyManager nginx-proxy-manager: score 49, CVSS 9.1
- CVE-2026-120019 boldgrid W3 Total Cache: score 49, CVSS 5.4
- CVE-2026-107406 NetScaler ADC · NetScaler Gateway: score 49, CVSS 9.5
- CVE-2026-121957 FreeRDP: score 49, CVSS 8.7
- CVE-2026-119736 Attendo: score 49, CVSS 8.8
- CVE-2026-120313 Jovancoding Network-AI: score 49, CVSS 8.7
- CVE-2026-120241 Ruijie RG-ES205GC · Ruijie RG-ES206GC-P +3: score 49, CVSS 8.7
- CVE-2026-123488 craftcms cms: score 48, CVSS 9.3
- CVE-2026-83844 Microsoft Paint: score 48, CVSS 8.1
- CVE-2026-123158 OpenBSD OpenSSH: score 48, CVSS 8.1
- CVE-2026-62911 Microsoft Exchange Server 2016 Cumulative Update · Micro… +1: score 48, CVSS 8
- CVE-2026-92693 pavel-odintsov fastnetmon: score 48, CVSS 8.2
- CVE-2026-63655 tsparticles · @tsparticles mcp-server: score 48, CVSS 7.5
- CVE-2026-63501 Agamnentzar ag-psd: score 48, CVSS 7.5
- CVE-2026-118487 Eclipse Foundation Eclipse Vert.x: score 48, CVSS 7.5
- CVE-2026-106804 A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_qos_npn module.: score 48, CVSS 7.5
- CVE-2026-106805 A resource exhaustion issue exists in Free5GC v4.2.3 during PFCP Session Establishment failure handling.: score 48, CVSS 7.5
- CVE-2026-106806 A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server.: score 48, CVSS 7.5
- CVE-2026-106808 OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM Nudm_UEAU Generate Authentication…: score 48, CVSS 7.5
- CVE-2026-117068 An integer underflow vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker…: score 48, CVSS 7.5
- CVE-2026-117069 An integer truncation vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker…: score 48, CVSS 7.5
- CVE-2026-54912 bytecodealliance wasm-micro-runtime: score 47, CVSS 8.8
- CVE-2026-54142 tinyhumansai openhuman: score 47, CVSS 8.7
- CVE-2026-121939 David-Crty Databasement: score 47, CVSS 9.2
- CVE-2026-75614 esa asn1scc: score 46, CVSS 8.1
- CVE-2026-121437 lepture mistune: score 46, CVSS 8.7
- CVE-2026-123859 snowflake-connector-python: score 46, CVSS 8.1
- CVE-2026-121224 Google Chrome: score 46, CVSS 8.1
- CVE-2026-121133 Google Chrome: score 46, CVSS 8.1
- CVE-2026-115290 Elasticsearch: score 45, CVSS 7.5
- CVE-2026-123198 LMFDB: score 45, CVSS 9.3
- CVE-2025-71457 vtenext: score 45, CVSS 9.3
- CVE-2026-121953 FreeRDP: score 45, CVSS 9.3
- CVE-2026-121952 FreeRDP: score 45, CVSS 9.3
- CVE-2026-63471 koxudaxi fastapi-code-generator: score 45, CVSS 9.3
- CVE-2026-63470 koxudaxi fastapi-code-generator: score 45, CVSS 9.3
- CVE-2026-38600 A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via…: score 45, CVSS 9.8
- CVE-2026-106803 A stack-based buffer overflow exists in Kamailio v6.1.3 and v6.1.4 in the ims_registrar_pcscf module.: score 45, CVSS 9.8
- CVE-2026-120442 xianhc ape-volo-admin: score 45, CVSS 9.3
Chart
What drives the top scores
The top 15 CVEs, with each score split into its parts.
- WordPressCVE-2026-63030Exploitation 40, Exposure 25, Reach 17, Severity 10, No patch 092
- GitLabCVE-2026-97229Exploitation 40, Exposure 25, Reach 14, Severity 10, No patch 089
- WordPress Foundation WordPressCVE-2026-119977Exploitation 40, Exposure 22, Reach 17, Severity 9.1, No patch 088
- Gitea · gitea.dev +1CVE-2026-60004Exploitation 40, Exposure 25, Reach 10, Severity 10, No patch 085
- Linux KernelCVE-2024-1086Exploitation 40, Exposure 15, Reach 20, Severity 8.8, No patch 084
- Gogs · gogs.io/gogsCVE-2025-8110Exploitation 40, Exposure 18, Reach 10, Severity 9.7, No patch 583
- Ivanti Connect SecureCVE-2026-118527Exploitation 40, Exposure 18, Reach 14, Severity 4.3, No patch 581
- Microsoft Windows Server · Microsoft Windows Server,CVE-2020-1350Exploitation 40, Exposure 25, Reach 0, Severity 10, No patch 580
- Cisco Secure EmailCVE-2026-76519Exploitation 40, Exposure 25, Reach 0, Severity 10, No patch 580
- Adobe Commerce · Adobe Magento Open SourceCVE-2026-75650Exploitation 40, Exposure 25, Reach 0, Severity 10, No patch 580
- Hikvision CamerasCVE-2017-7921Exploitation 40, Exposure 25, Reach 0, Severity 10, No patch 580
- erlang otpCVE-2025-32433Exploitation 40, Exposure 25, Reach 0, Severity 10, No patch 075
- SonicWall SonicOSCVE-2026-19868Exploitation 40, Exposure 22, Reach 0, Severity 7.5, No patch 575
- Cisco Secure EmailCVE-2026-76461Exploitation 40, Exposure 25, Reach 0, Severity 10, No patch 075
- Adobe Commerce · Adobe Magento Open SourceCVE-2026-48356Exploitation 40, Exposure 22, Reach 0, Severity 10, No patch 072