Skip to main content
cve.nowby Sazabi
Rankings

Rankings: This month's CVE charts

How the CVEs on the board score, and why. How the score works.

Chart

Score against CVSS

Each dot is a CVE on the board. CVSS rates how bad a bug could be; the Index adds whether it is exploited, exposed and widely used.

02550751000246810CVSS base scorecve.now Index scoreCVE-2026-104935 Ivanti Connect Secure: score 94, CVSS 8.6CVE-2026-63030 WordPress: score 92, CVSS 9.8CVE-2026-111497 Google Brotli · node +7: score 92, CVSS 9.2CVE-2026-97229 GitLab: score 89, CVSS 10CVE-2026-109618 PHP Group PHP: score 89, CVSS 9.2CVE-2026-109619 PHP Group PHP: score 89, CVSS 9.2CVE-2026-119977 WordPress Foundation WordPress: score 88, CVSS 8.1CVE-2026-60004 Gitea · gitea.dev +1: score 85, CVSS 9.8CVE-2024-1086 Linux Kernel: score 84, CVSS 7.8CVE-2026-46300 Linux: score 84, CVSS 7.8CVE-2025-8110 Gogs · gogs.io/gogs: score 83, CVSS 8.7CVE-2026-111357 Ivanti Connect Secure: score 82, CVSS 7CVE-2026-0322 Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1: score 82, CVSS 8.6CVE-2026-118527 Ivanti Connect Secure: score 81, CVSS 4.3CVE-2020-1350 Microsoft Windows Server · Microsoft Windows Server,: score 80, CVSS 10CVE-2026-76519 Cisco Secure Email: score 80, CVSS 9.8CVE-2026-75650 Adobe Commerce · Adobe Magento Open Source: score 80, CVSS 10CVE-2017-7921 Hikvision Cameras: score 80, CVSS 9.8CVE-2025-61624 Fortinet FortiOS · Fortinet FortiProxy +2: score 80, CVSS 5.4CVE-2026-102764 BeyondTrust Remote Support: score 80, CVSS 9.3CVE-2026-76418 Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof…: score 79, CVSS 8.6CVE-2026-21589 Atlassian Bamboo Data Center · Atlassian Bitbucket Data… +6: score 77, CVSS 9.3CVE-2025-32433 erlang otp: score 75, CVSS 10CVE-2026-19868 SonicWall SonicOS: score 75, CVSS 7.5CVE-2026-76461 Cisco Secure Email: score 75, CVSS 9.8CVE-2026-41709 VMware Cloud Foundation · VMware vSphere Foundation +2: score 75, CVSS 2.7CVE-2026-110447 Collabora Online - Built-in CODE Server: score 75, CVSS 9.2CVE-2026-105134 AhsayCBS: score 75, CVSS 10CVE-2026-48356 Adobe Commerce · Adobe Magento Open Source: score 72, CVSS 9.3CVE-2026-96654 Plex Media Server: score 72, CVSS 6.9CVE-2026-105133 AhsayCBS: score 72, CVSS 6.9CVE-2026-96951 Microsoft Edge · Microsoft Outlook.com +1: score 72, CVSS 8.8CVE-2026-98432 Linux: score 69, CVSS 9.8CVE-2026-114625 Arista Networks VeloCloud Orchestrator: score 68, CVSS 9.9CVE-2026-96656 Plex Media Server: score 68, CVSS 8.6CVE-2026-33439 OpenIdentityPlatform OpenAM · org.openidentityplatform.open…: score 68, CVSS 9.3CVE-2026-119283 authlib joserfc · joserfc: score 68, CVSS 7.5CVE-2026-119196 pyasn1: score 68, CVSS 7.5CVE-2026-118782 digitalbazaar forge · node-forge: score 68, CVSS 7.5CVE-2026-33871 netty · io.netty:netty-codec-http2: score 66, CVSS 8.7CVE-2026-114509 laravel framework · laravel/framework: score 65, CVSS 9.2CVE-2026-118665 ardatan graphql-tools · @graphql-tools executor-legacy-ws +1: score 65, CVSS 8.2CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition for Apache… +1: score 64, CVSS 7.8CVE-2026-114143 BinaryMuse toml-node · toml: score 64, CVSS 8.7CVE-2026-114136 encode django-rest-framework · djangorestframework: score 64, CVSS 7.5CVE-2026-114102 cthackers adm-zip · adm-zip: score 64, CVSS 8.7CVE-2026-112896 python-pillow Pillow · pillow: score 64, CVSS 8.8CVE-2026-112894 python-pillow Pillow · pillow: score 64, CVSS 8.7CVE-2026-112405 python-pillow Pillow · pillow: score 64, CVSS 8.7CVE-2026-112404 python-pillow Pillow · pillow: score 64, CVSS 8.8CVE-2026-112402 python-pillow Pillow · pillow: score 64, CVSS 8.7CVE-2026-112397 python-pillow Pillow · pillow: score 64, CVSS 8.7CVE-2026-112400 python-pillow Pillow · pillow: score 64, CVSS 8.7CVE-2026-112399 python-pillow Pillow · pillow: score 64, CVSS 8.7CVE-2026-110869 nodemailer: score 64, CVSS 8.7CVE-2026-110859 gitpython-developers GitPython · gitpython: score 64, CVSS 8.7CVE-2026-110856 gitpython-developers GitPython · gitpython: score 64, CVSS 8.7CVE-2026-110936 Siemens Software Center: score 63, CVSS 6.7CVE-2025-6934 wpopal Opal Estate Pro – Property Management and Submission: score 63, CVSS 9.8CVE-2026-105863 payloadcms payload · payload: score 63, CVSS 9.2CVE-2026-119195 pyasn1: score 63, CVSS 7.5CVE-2026-119194 pyasn1: score 63, CVSS 7.5CVE-2026-119187 digitalbazaar forge · node-forge: score 63, CVSS 7.5CVE-2026-118779 digitalbazaar forge · node-forge: score 63, CVSS 7.5CVE-2026-118772 hapijs joi · @hapi joi +2: score 63, CVSS 7.5CVE-2026-75508 graphql-python graphql-core · graphql-core: score 63, CVSS 7.5CVE-2026-96640 python-pillow Pillow · pillow: score 63, CVSS 8.2CVE-2026-114144 BinaryMuse toml-node · toml: score 63, CVSS 7.5CVE-2026-111758 markdown-it: score 63, CVSS 7.5CVE-2026-112893 python-pillow Pillow · pillow: score 63, CVSS 8.2CVE-2026-112392 python-pillow Pillow · pillow: score 63, CVSS 8.2CVE-2026-112390 python-pillow Pillow · pillow: score 63, CVSS 8.2CVE-2026-111759 markdown-it: score 63, CVSS 7.5CVE-2026-96652 Plex Media Server: score 62, CVSS 4.3CVE-2026-96655 Plex Media Server: score 62, CVSS 4.3CVE-2026-29000 pac4j-jwt · org.pac4j:pac4j-jwt: score 62, CVSS 9.3CVE-2026-18963 Red Hat build of Keycloak · Red Hat JBoss Enterprise App… +2: score 62, CVSS 9.1CVE-2026-112403 python-pillow Pillow · pillow: score 62, CVSS 9.2CVE-2026-112398 python-pillow Pillow · pillow: score 62, CVSS 9.2CVE-2026-112393 python-pillow Pillow · pillow: score 62, CVSS 9.2CVE-2024-27834 Apple Safari · Apple iOS and iPadOS +3: score 61, CVSS 5.5CVE-2026-0264 Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1: score 61, CVSS 7.2CVE-2026-116692 mlflow: score 61, CVSS 9.8CVE-2026-115905 zip-rs zip2 · zip: score 61, CVSS 10CVE-2026-112897 python-pillow Pillow · pillow: score 61, CVSS 8.7CVE-2026-107722 nearform fast-jwt · fast-jwt: score 61, CVSS 9.8CVE-2026-93680 IBM Langflow OSS: score 60, CVSS 9.8CVE-2026-121426 nodemailer: score 60, CVSS 8.3CVE-2026-119190 digitalbazaar forge · node-forge: score 60, CVSS 7.4CVE-2026-115924 danielgatis rembg · rembg: score 60, CVSS 8.6CVE-2026-115775 twisted: score 60, CVSS 8.7CVE-2026-114615 authlib: score 60, CVSS 7.4CVE-2026-114104 cthackers adm-zip · adm-zip: score 60, CVSS 8.2CVE-2026-111756 follow-redirects: score 60, CVSS 8.2CVE-2026-53995 mlflow: score 60, CVSS 8.8CVE-2026-111755 follow-redirects: score 60, CVSS 8.2CVE-2026-78162 Apache Software Foundation org.apache.camel:camel-hazelcast: score 60, CVSS 10CVE-2026-110872 nodemailer: score 60, CVSS 8.2CVE-2026-101895 angular · @angular/ platform-server +1: score 60, CVSS 8.7CVE-2026-109956 nltk: score 60, CVSS 8.3
In CISA KEVOther

Chart

What drives the top scores

The top 15 CVEs, with each score split into its parts.

  1. Ivanti Connect SecureCVE-2026-104935Exploitation 40, Exposure 25, Reach 14, Severity 9.6, No patch 594
  2. WordPressCVE-2026-63030Exploitation 40, Exposure 25, Reach 17, Severity 10, No patch 092
  3. Google Brotli · node +7CVE-2026-111497Exploitation 40, Exposure 22, Reach 20, Severity 10, No patch 092
  4. GitLabCVE-2026-97229Exploitation 40, Exposure 25, Reach 14, Severity 10, No patch 089
  5. PHP Group PHPCVE-2026-109618Exploitation 40, Exposure 22, Reach 17, Severity 10, No patch 089
  6. PHP Group PHPCVE-2026-109619Exploitation 40, Exposure 22, Reach 17, Severity 10, No patch 089
  7. WordPress Foundation WordPressCVE-2026-119977Exploitation 40, Exposure 22, Reach 17, Severity 9.1, No patch 088
  8. Gitea · gitea.dev +1CVE-2026-60004Exploitation 40, Exposure 25, Reach 10, Severity 10, No patch 085
  9. Linux KernelCVE-2024-1086Exploitation 40, Exposure 15, Reach 20, Severity 8.8, No patch 084
  10. LinuxCVE-2026-46300Exploitation 40, Exposure 15, Reach 20, Severity 8.8, No patch 084
  11. Gogs · gogs.io/gogsCVE-2025-8110Exploitation 40, Exposure 18, Reach 10, Severity 9.7, No patch 583
  12. Ivanti Connect SecureCVE-2026-111357Exploitation 40, Exposure 15, Reach 14, Severity 8, No patch 582
  13. Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1CVE-2026-0322Exploitation 40, Exposure 18, Reach 14, Severity 9.6, No patch 082
  14. Ivanti Connect SecureCVE-2026-118527Exploitation 40, Exposure 18, Reach 14, Severity 4.3, No patch 581
  15. Microsoft Windows Server · Microsoft Windows Server,CVE-2020-1350Exploitation 40, Exposure 25, Reach 0, Severity 10, No patch 580
ExploitationExposureReachSeverityNo patch