Skip to main content
cve.nowby Sazabi
Rankings

Rankings: This year's CVE charts

How the CVEs on the board score, and why. How the score works.

Chart

Score against CVSS

Each dot is a CVE on the board. CVSS rates how bad a bug could be; the Index adds whether it is exploited, exposed and widely used.

02550751000246810CVSS base scorecve.now Index scoreCVE-2025-39682 Linux · :linux_kernel:: score 95, CVSS 9.8CVE-2026-104935 Ivanti Connect Secure: score 94, CVSS 8.6CVE-2026-10520 ivanti Sentry: score 94, CVSS 10CVE-2026-1281 Ivanti Endpoint Manager Mobile: score 94, CVSS 9.8CVE-2025-59718 Fortinet FortiSwitchManager · Fortinet FortiOS +1: score 94, CVSS 9.1CVE-2026-63030 WordPress: score 92, CVSS 9.8CVE-2026-111497 Google Brotli · node +7: score 92, CVSS 9.2CVE-2026-48710 Kludex starlette · starlette: score 92, CVSS 6.5CVE-2026-45321 @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82: score 92, CVSS 9.6CVE-2025-55182 Meta react-server-dom-webpack · Meta react-server-dom-tu… +4: score 92, CVSS 10CVE-2026-87491 Google Chrome: score 91, CVSS 8.8CVE-2026-85046 Google Chrome: score 91, CVSS 8.8CVE-2026-59822 BerriAI litellm · litellm: score 91, CVSS 8.8CVE-2025-62593 ray-project ray · ray: score 91, CVSS 9.4CVE-2026-11645 Google Chrome: score 91, CVSS 8.8CVE-2026-42208 BerriAI litellm · litellm: score 91, CVSS 9.3CVE-2026-1340 Ivanti Endpoint Manager Mobile: score 91, CVSS 9.8CVE-2026-5281 Google Chrome: score 91, CVSS 8.8CVE-2026-3909 Google Chrome: score 91, CVSS 8.8CVE-2026-3910 Google Chrome: score 91, CVSS 8.8CVE-2026-2441 Google Chrome: score 91, CVSS 8.8CVE-2025-14174 Google Chrome: score 91, CVSS 8.8CVE-2025-13223 Google Chrome: score 91, CVSS 8.8CVE-2026-64849 mlflow: score 90, CVSS 9.3CVE-2026-1603 Ivanti Endpoint Manager: score 90, CVSS 8.6CVE-2026-24858 Fortinet FortiWeb · Fortinet FortiNAC-F +4: score 90, CVSS 9.4CVE-2025-54313 eslint-config-prettier · eslint-plugin-prettier +4: score 90, CVSS 7.5CVE-2026-97229 GitLab: score 89, CVSS 10CVE-2026-109618 PHP Group PHP: score 89, CVSS 9.2CVE-2026-109619 PHP Group PHP: score 89, CVSS 9.2CVE-2026-104286 Fortinet FortiMail: score 89, CVSS 9.8CVE-2026-88771 Citrix NetScaler ADC · Citrix NetScaler Gateway: score 89, CVSS 9.5CVE-2019-1068 Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems…: score 89, CVSS 8.8CVE-2026-0300 Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1: score 89, CVSS 9.3CVE-2026-21643 Fortinet FortiClientEMS: score 89, CVSS 9.1CVE-2026-119977 WordPress Foundation WordPress: score 88, CVSS 8.1CVE-2026-87902 WordPress: score 88, CVSS 8.1CVE-2025-11953 @react-native-community/cli-server-api · @react-native-comm…: score 88, CVSS 9.8CVE-2025-14847 MongoDB Server: score 88, CVSS 8.7CVE-2026-0770 Langflow: score 87, CVSS 9.8CVE-2026-42271 BerriAI litellm · litellm: score 87, CVSS 8.7CVE-2025-31125 vitejs vite · vite: score 87, CVSS 5.3CVE-2026-88772 Citrix NetScaler ADC · Citrix NetScaler Gateway: score 86, CVSS 9.5CVE-2026-85706 GitLab: score 86, CVSS 10CVE-2026-59310 VMware Cloud Foundation · VMware vSphere Foundation +3: score 86, CVSS 9.8CVE-2026-60137 WordPress: score 86, CVSS 5.9CVE-2026-60004 Gitea · gitea.dev +1: score 85, CVSS 9.8CVE-2026-25089 Fortinet FortiSandbox: score 85, CVSS 9.1CVE-2026-39808 Fortinet FortiSandbox: score 85, CVSS 9.1CVE-2026-9082 Drupal core · drupal +1: score 85, CVSS 9.8CVE-2026-0257 Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1: score 85, CVSS 7.8CVE-2026-35616 Fortinet FortiClientEMS: score 85, CVSS 9.1CVE-2025-64446 Fortinet FortiWeb: score 85, CVSS 9.4CVE-2024-1086 Linux Kernel: score 84, CVSS 7.8CVE-2026-46300 Linux: score 84, CVSS 7.8CVE-2025-39964 Linux: score 84, CVSS 7.8CVE-2026-53266 Linux: score 84, CVSS 8.8CVE-2025-25249 Fortinet FortiSwitchManager · Fortinet FortiOS: score 84, CVSS 7.4CVE-2026-53362 Linux: score 84, CVSS 7.8CVE-2026-42897 Microsoft Exchange Server 2016 Cumulative Update · Micro… +1: score 84, CVSS 8.1CVE-2026-6973 Ivanti Endpoint Manager Mobile: score 84, CVSS 7.2CVE-2026-31431 Linux: score 84, CVSS 7.8CVE-2026-22719 VMware Aria Operations · VMware Cloud Foundation Operati… +2: score 84, CVSS 8.1CVE-2021-22175 GitLab: score 84, CVSS 6.8CVE-2023-4911 glibc · Red Hat Enterprise Linux +1: score 84, CVSS 7.8CVE-2025-8110 Gogs · gogs.io/gogs: score 83, CVSS 8.7CVE-2022-0995 kernel: score 83, CVSS 7.8CVE-2022-0492 kernel: score 83, CVSS 7.8CVE-2026-39987 marimo-team marimo · marimo: score 83, CVSS 9.3CVE-2021-39935 GitLab: score 83, CVSS 6.8CVE-2018-14634 The Linux Foundation kernel: score 83, CVSS 7.8CVE-2026-111357 Ivanti Connect Secure: score 82, CVSS 7CVE-2026-0322 Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1: score 82, CVSS 8.6CVE-2025-34291 Langflow: score 82, CVSS 9.4CVE-2025-32432 craftcms cms · craftcms/cms: score 82, CVSS 10CVE-2026-118527 Ivanti Connect Secure: score 81, CVSS 4.3CVE-2016-3081 org.apache.struts:struts2-core: score 81, CVSS 8.1CVE-2025-68686 Fortinet FortiOS: score 81, CVSS 5.3CVE-2023-21529 Microsoft Exchange Server 2013 Cumulative Update · Micro… +1: score 81, CVSS 8.8CVE-2026-33017 langflow-ai langflow · langflow: score 81, CVSS 9.3CVE-2025-54068 livewire · livewire/livewire: score 81, CVSS 9.2CVE-2020-1350 Microsoft Windows Server · Microsoft Windows Server,: score 80, CVSS 10CVE-2026-76519 Cisco Secure Email: score 80, CVSS 9.8CVE-2026-75650 Adobe Commerce · Adobe Magento Open Source: score 80, CVSS 10CVE-2017-7921 Hikvision Cameras: score 80, CVSS 9.8CVE-2025-61624 Fortinet FortiOS · Fortinet FortiProxy +2: score 80, CVSS 5.4CVE-2026-102764 BeyondTrust Remote Support: score 80, CVSS 9.3CVE-2015-3306 The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.: score 80, CVSS 10CVE-2021-3199 Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /..: score 80, CVSS 9.8CVE-2026-76504 Cisco Catalyst SD-WAN Manager: score 80, CVSS 9.8CVE-2026-71362 Adobe Commerce · Adobe Magento Open Source: score 80, CVSS 9.1CVE-2026-19490 NetScaler ADC · NetScaler Gateway: score 80, CVSS 9.3CVE-2021-23758 AjaxPro.2 · AjaxNetProfessional: score 80, CVSS 8.1CVE-2026-34486 Apache Software Foundation Apache Tomcat · org.apache.to… +1: score 80, CVSS 7.5CVE-2026-56290 JoomlaCK.fr Page Builder CK extension for Joomla: score 80, CVSS 10CVE-2026-48282 Adobe ColdFusion: score 80, CVSS 10CVE-2026-48908 joomshaper.net SP Page Builder extension for Joomla: score 80, CVSS 10CVE-2026-24061 GNU Inetutils: score 80, CVSS 9.8CVE-2025-68613 n8n-io n8n · n8n: score 80, CVSS 10CVE-2025-20393 Cisco Secure Email: score 80, CVSS 10
In CISA KEVOther

Chart

What drives the top scores

The top 15 CVEs, with each score split into its parts.

  1. Linux · :linux_kernel:CVE-2025-39682Exploitation 40, Exposure 25, Reach 20, Severity 10, No patch 095
  2. Ivanti Connect SecureCVE-2026-104935Exploitation 40, Exposure 25, Reach 14, Severity 9.6, No patch 594
  3. ivanti SentryCVE-2026-10520Exploitation 40, Exposure 25, Reach 14, Severity 10, No patch 594
  4. Ivanti Endpoint Manager MobileCVE-2026-1281Exploitation 40, Exposure 25, Reach 14, Severity 10, No patch 594
  5. Fortinet FortiSwitchManager · Fortinet FortiOS +1CVE-2025-59718Exploitation 40, Exposure 25, Reach 14, Severity 10, No patch 594
  6. WordPressCVE-2026-63030Exploitation 40, Exposure 25, Reach 17, Severity 10, No patch 092
  7. Google Brotli · node +7CVE-2026-111497Exploitation 40, Exposure 22, Reach 20, Severity 10, No patch 092
  8. Kludex starlette · starletteCVE-2026-48710Exploitation 40, Exposure 25, Reach 20, Severity 6.5, No patch 092
  9. @tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82CVE-2026-45321Exploitation 40, Exposure 22, Reach 20, Severity 9.6, No patch 092
  10. Meta react-server-dom-webpack · Meta react-server-dom-tu… +4CVE-2025-55182Exploitation 40, Exposure 25, Reach 17, Severity 10, No patch 092
  11. Google ChromeCVE-2026-87491Exploitation 40, Exposure 22, Reach 20, Severity 8.8, No patch 091
  12. Google ChromeCVE-2026-85046Exploitation 40, Exposure 22, Reach 20, Severity 8.8, No patch 091
  13. BerriAI litellm · litellmCVE-2026-59822Exploitation 40, Exposure 22, Reach 20, Severity 8.8, No patch 091
  14. ray-project ray · rayCVE-2025-62593Exploitation 40, Exposure 25, Reach 16, Severity 10, No patch 091
  15. Google ChromeCVE-2026-11645Exploitation 40, Exposure 22, Reach 20, Severity 8.8, No patch 091
ExploitationExposureReachSeverityNo patch
Rankings: Charts of the cve.now Index | cve.now