Skip to main content
cve.nowby Sazabi
Menu

Rankings

CVEs and the packages they hit, scored 0-100 on exploitation, exposure, reach, severity and patch status. How the score works.

CVEs published or escalated in the last 7 days, ranked by the cve.now Index.

  1. 1New92Heap corruption in V8 via type confusionGoogle Chrome · CVE-2021-30563KEVExploit publicFix availableExploit published
  2. 2New92Sandboxed remote code execution in XML handlingGoogle Chrome · CVE-2026-125350KEVExploit publicFix availableProvisionalExploit published
  3. 3▲186Remote code execution in Syslog serviceVMware Cloud Foundation · VMware vSphere Foundation +3 · CVE-2026-59310KEVFix availableEPSS crossed 10%
  4. 4New85Auth bypass in loopback trust via proxy headersgpustack · CVE-2026-102895KEVFix availableAdded to KEV
  5. 5▲380Remote code execution in DNS serverMicrosoft Windows Server · Microsoft Windows Server, · CVE-2020-1350KEVExploit publicNo patch listed yetExploit published
  6. 6▲380Remote file write and root execution in file reputationCisco Secure Email · CVE-2026-76519KEVExploit publicNo patch listed yetExploit published
  7. 7▲380Remote code execution in template engineAdobe Commerce · Adobe Magento Open Source · CVE-2026-75650KEVNucleiNo patch listed yetEPSS crossed 10%
  8. 8▲479Information disclosure in Remote Access VPNcheckpoint Check Point Quantum Gateway, Spark Gateway and C… · CVE-2024-24919KEVExploit publicNucleiNo patch listed yetExploit published
  9. 9▲477Local privilege escalation to root in guest toolsVMware VCF operations · VMware tools +4 · CVE-2025-41244KEVFix availableProvisionalEPSS crossed 10%
  10. 10New75Authentication bypass in global configuration restoreBarracuda Networks Barracuda Email Security Gateway · CVE-2026-116606KEVExploit publicNucleiFix availableAdded to KEV
  11. 11New75Auth bypass in Screen SharingApple macOS · CVE-2026-65400KEVFix availableEPSS crossed 10%
  12. 12New75Command injection via inbound SIP MESSAGE requestssignalwire freeswitch · CVE-2026-116779KEVExploit publicFix availableAdded to KEV
  13. 13New75Authorization bypass gives admin access in file exchangeIBM Aspera Faspex · CVE-2026-123218KEVFix availableAdded to KEV
  14. 14–75Pre-auth remote code execution in SSH servererlang otp · CVE-2025-32433KEVExploit publicFix availableExploit published
  15. 15–75Authentication bypass in SSLVPN serviceSonicWall SonicOS · CVE-2026-19868KEVNo patch listed yetPublished
  16. 16–75Remote code execution via SQL injection in email parsingCisco Secure Email · CVE-2026-76461KEVExploit publicFix availableExploit published
  17. 17New73Root command injection in timezone fieldBarracuda Networks Barracuda Email Security Gateway · Ba… +4 · CVE-2026-111560KEVNo patch listed yetAdded to KEV
  18. 18New73Unauthenticated file disclosure in OCI XML parserCisco BroadWorks · CVE-2026-20320KEVFix availableAdded to KEV
  19. 19▼272Remote code execution via unrestricted file uploadAdobe Commerce · Adobe Magento Open Source · CVE-2026-48356KEVExploit publicFix availableExploit published
  20. 20New71Remote code execution in web content processingApple Safari · Apple iOS and iPadOS +1 · CVE-2022-32893KEVFix availableEPSS crossed 10%
  21. 21New71Password auth bypass in sshd with musl libcOpenBSD OpenSSH · CVE-2026-123158KEVExploit publicFix availableEPSS crossed 10%
  22. 22New69Spoofing in OutlookMicrosoft 365 Apps for Enterprise · Microsoft Office LTSC · CVE-2026-124194KEVFix availableProvisionalPublished
  23. 23▼467Privilege escalation via user token validationjfrog artifactory · CVE-2026-42016KEVExploit publicFix availableExploit published
  24. 24New66Remote code execution in regex compilationGitLab · CVE-2026-110264Exploit publicFix availableExploit published
  25. 25▼566Denial of service in HTTP/2 CONTINUATION handlingnetty · io.netty:netty-codec-http2 · CVE-2026-33871Exploit publicFix availableExploit published
  26. 26New66Prototype pollution in mergeIncrementalResult helperardatan graphql-tools · @graphql-tools/utils · CVE-2026-114604Fix availablePublished
  27. 27New64Denial of service via prototype pollution in data mergingAutomattic mongoose · mongoose · CVE-2026-125117Fix availableProvisionalPublished
  28. 28New63Local privilege escalation in system softwareApple macOS · Apple iOS and iPadOS · CVE-2023-41992KEVFix availableEPSS crossed 10%
  29. 29New63Remote code execution in output encodingFortinet FortiManager · Fortinet FortiAnalyzer +1 · CVE-2026-126170Exploit publicNo patch listed yetProvisionalExploit published
  30. 30New63Code execution in origin validation logicFortinet FortiClientMac · Fortinet FortiClientWindows +1 · CVE-2026-121529Exploit publicNo patch listed yetProvisionalExploit published
  31. 31New62File type restriction bypass in file conversionOpenwave Messaging (Ireland) Limited Webtop Media Transcoder · CVE-2026-111793KEVFix availableAdded to KEV
  32. 32New62Remote code execution in Samba samrRed Hat Enterprise Linux · Red Hat OpenShift Container Plat… · CVE-2026-4408No patch listed yetEPSS crossed 10%
  33. 33New61Remote code execution in server componentsreact · react-server-dom-parcel +2 · CVE-2026-126187Exploit publicFix availableProvisionalExploit published
  34. 34▼1161Unauthenticated code execution in DNS proxy and DNS serverPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1 · CVE-2026-0264Exploit publicFix availableExploit published
  35. 35New60WordPress Elementor Pro plugin <= 4.2.1 - Arbitrary File Upload vulnerabilityElementor Pro · CVE-2026-32475Exploit publicNucleiNo patch listed yetExploit published
  36. 36New60Path traversal in resources API exposes JWT secretsignalk-server · @signalk resources-provider +1 · CVE-2026-123807Fix availableProvisionalPublished
  37. 37New60Denial of service in SQLite query APInuxt content · @nuxt/content · CVE-2026-102650Fix availablePublished
  38. 38New59Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a…Google Chrome · CVE-2025-10891Exploit publicFix availableExploit published
  39. 39New59Sandbox escape in MojoGoogle Chrome · CVE-2025-4609Exploit publicFix availableExploit published
  40. 40▼1559Denial of service and data corruption in DICOM parsingProject-MONAI MONAI · monai · CVE-2026-48705Fix availablePublished
  41. 41New58Code injection via H2 in database connection poolsApache Software Foundation Apache NiFi · nifi +3 · CVE-2023-34468Exploit publicFix availableExploit published
  42. 42New58Unauthenticated SQL injection in element search endpointcraftcms cms · CVE-2026-123488Exploit publicNucleiFix availableExploit published
  43. 43New58Out-of-bounds read in GF(2^m) curve parametersOpenSSL · CVE-2024-9143Fix availableEPSS crossed 10%
  44. 44New58Memory leak in krb5 GSS-RPC client causes denial of serviceRed Hat Enterprise Linux · Red Hat Hardened Images · CVE-2026-112314No patch listed yetProvisionalPublished
  45. 45New58Arbitrary file read in web.NewHandleresm-dev esm.sh · github.com/esm-dev/esm.sh/web · CVE-2026-102657Fix availablePublished
  46. 46New58Path traversal in MCP read_file enables arbitrary file readvitali87 code-graph-rag · code-graph-rag · CVE-2026-77604Fix availablePublished
  47. 47New57Unauthenticated remote code execution in settings savingConfection WordPress Cable · CVE-2026-115252Exploit publicNo patch listed yetProvisionalExploit published
  48. 48New57Privilege escalation in temporary user creationSecurity For WooCommerce · CVE-2026-100109Exploit publicNo patch listed yetExploit published
  49. 49New57Remote code execution via unrestricted form file uploadWP Libre Form · CVE-2026-118423Exploit publicNo patch listed yetExploit published
  50. 50New57Authentication bypass leading to RCE via share-tokenanji-plus AJ-Report · CVE-2026-120209Exploit publicNo patch listed yetExploit published

Past weeks: 2026-W45, 2026-W44

Chart

Score against CVSS

Each dot is a CVE on the board. CVSS rates how bad a bug could be; the Index adds whether it is exploited, exposed and widely used.

02550751000246810CVSS base scorecve.now Index scoreCVE-2021-30563 Google Chrome: score 92, CVSS 8.8CVE-2026-125350 Google Chrome: score 92, CVSS 8.8CVE-2026-59310 VMware Cloud Foundation · VMware vSphere Foundation +3: score 86, CVSS 9.8CVE-2026-102895 gpustack: score 85, CVSS 9.8CVE-2020-1350 Microsoft Windows Server · Microsoft Windows Server,: score 80, CVSS 10CVE-2026-76519 Cisco Secure Email: score 80, CVSS 9.8CVE-2026-75650 Adobe Commerce · Adobe Magento Open Source: score 80, CVSS 10CVE-2024-24919 checkpoint Check Point Quantum Gateway, Spark Gateway and C…: score 79, CVSS 8.6CVE-2025-41244 VMware VCF operations · VMware tools +4: score 77, CVSS 7.8CVE-2026-116606 Barracuda Networks Barracuda Email Security Gateway: score 75, CVSS 9.3CVE-2026-65400 Apple macOS: score 75, CVSS 9.8CVE-2026-116779 signalwire freeswitch: score 75, CVSS 9.8CVE-2026-123218 IBM Aspera Faspex: score 75, CVSS 9.8CVE-2025-32433 erlang otp: score 75, CVSS 10CVE-2026-19868 SonicWall SonicOS: score 75, CVSS 7.5CVE-2026-76461 Cisco Secure Email: score 75, CVSS 9.8CVE-2026-111560 Barracuda Networks Barracuda Email Security Gateway · Ba… +4: score 73, CVSS 8.6CVE-2026-20320 Cisco BroadWorks: score 73, CVSS 7.5CVE-2026-48356 Adobe Commerce · Adobe Magento Open Source: score 72, CVSS 9.3CVE-2022-32893 Apple Safari · Apple iOS and iPadOS +1: score 71, CVSS 8.8CVE-2026-123158 OpenBSD OpenSSH: score 71, CVSS 8.1CVE-2026-124194 Microsoft 365 Apps for Enterprise · Microsoft Office LTSC: score 69, CVSS 6.5CVE-2026-42016 jfrog artifactory: score 67, CVSS 8.1CVE-2026-110264 GitLab: score 66, CVSS 10CVE-2026-33871 netty · io.netty:netty-codec-http2: score 66, CVSS 8.7CVE-2026-114604 ardatan graphql-tools · @graphql-tools/utils: score 66, CVSS 8.4CVE-2026-125117 Automattic mongoose · mongoose: score 64, CVSS 8.2CVE-2023-41992 Apple macOS · Apple iOS and iPadOS: score 63, CVSS 7.8CVE-2026-126170 Fortinet FortiManager · Fortinet FortiAnalyzer +1: score 63, CVSS 9.8CVE-2026-121529 Fortinet FortiClientMac · Fortinet FortiClientWindows +1: score 63, CVSS 9.1CVE-2026-111793 Openwave Messaging (Ireland) Limited Webtop Media Transcoder: score 62, CVSS 4.3CVE-2026-4408 Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…: score 62, CVSS 9CVE-2026-126187 react · react-server-dom-parcel +2: score 61, CVSS 9.5CVE-2026-0264 Palo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1: score 61, CVSS 7.2CVE-2026-32475 Elementor Pro: score 60, CVSS 9CVE-2026-123807 signalk-server · @signalk resources-provider +1: score 60, CVSS 9.8CVE-2026-102650 nuxt content · @nuxt/content: score 60, CVSS 7.5CVE-2025-10891 Google Chrome: score 59, CVSS 8.8CVE-2025-4609 Google Chrome: score 59, CVSS 9.6CVE-2026-48705 Project-MONAI MONAI · monai: score 59, CVSS 9.3CVE-2023-34468 Apache Software Foundation Apache NiFi · nifi +3: score 58, CVSS 8.8CVE-2026-123488 craftcms cms: score 58, CVSS 9.3CVE-2024-9143 OpenSSL: score 58, CVSS 8.8CVE-2026-112314 Red Hat Enterprise Linux · Red Hat Hardened Images: score 58, CVSS 7.5CVE-2026-102657 esm-dev esm.sh · github.com/esm-dev/esm.sh/web: score 58, CVSS 7.5CVE-2026-77604 vitali87 code-graph-rag · code-graph-rag: score 58, CVSS 7.5CVE-2026-115252 Confection WordPress Cable: score 57, CVSS 10CVE-2026-100109 Security For WooCommerce: score 57, CVSS 9.8CVE-2026-118423 WP Libre Form: score 57, CVSS 10CVE-2026-120209 anji-plus AJ-Report: score 57, CVSS 9.3CVE-2026-58868 Google Android: score 57, CVSS 9.8CVE-2026-116512 wedevs Project Manager – AI Powered Project Management, Tas…: score 57, CVSS 9.8CVE-2026-122051 Edimax BR-6208AC: score 57, CVSS 10CVE-2026-111943 Go standard library crypto/x509 · stdlib +3: score 57, CVSS 6.8CVE-2024-25420 org.igniterealtime.openfire:xmppserver: score 56, CVSS 7.2CVE-2026-43499 Linux · :linux_kernel:: score 56, CVSS 7.8CVE-2026-114630 elextensions ELEX WordPress HelpDesk & Customer Ticketing S…: score 56, CVSS 9.1CVE-2026-123816 pyload · pyload-ng: score 56, CVSS 8.1CVE-2026-89324 XTemos Basel Post Types: score 54, CVSS 9.8CVE-2026-94074 NSquared Simply Schedule Appointments: score 54, CVSS 6.5CVE-2026-95597 codemstory 워드프레스 결제 심플페이: score 54, CVSS 6.5CVE-2026-113615 GS JWT Authentication for WP REST API: score 54, CVSS 9.8CVE-2026-114550 libwebsockets: score 53, CVSS 8.1CVE-2026-125107 julianhille MuhammaraJS · muhammara: score 53, CVSS 7.5CVE-2026-106713 An issue in FreeReels for Android version 2.3.11 allows a remote attacker to obtain sensitive information via the…: score 53, CVSS 7.5CVE-2026-111768 modelcontextprotocol typescript-sdk · @modelcontextproto… +3: score 53, CVSS 7.5CVE-2026-105425 Ivanti Sentry · Ivanti Endpoint Manager Mobile: score 52, CVSS 7.2CVE-2026-66613 Crocoblock. Jetimpex JetEngine: score 52, CVSS 9.8CVE-2026-49272 oauthlib: score 52, CVSS 8.5CVE-2026-80914 Linux: score 51, CVSS 8.8CVE-2026-39732 Ivijan-Stefan Stipic Transliterator: score 51, CVSS 9.3CVE-2026-33050 geonode: score 50, CVSS 8.8CVE-2026-68524 Apache Software Foundation Apache OFBiz: score 50, CVSS 7.5CVE-2026-73802 Gitea Runner · gitea.com/gitea/runner: score 50, CVSS 8.8CVE-2026-123966 Tenda AC19: score 50, CVSS 10CVE-2026-71397 elixir-grpc grpc_server · grpc_server: score 50, CVSS 8.2CVE-2026-112902 python-pillow Pillow · pillow: score 50, CVSS 8.3CVE-2026-102334 NginxProxyManager nginx-proxy-manager: score 49, CVSS 9.1CVE-2026-124561 D-Link DIR-878: score 49, CVSS 8.7CVE-2026-126082 rails: score 49, CVSS 9.8CVE-2026-121653 ivanti Endpoint Manager: score 49, CVSS 9.8CVE-2026-123569 sveltejs devalue · devalue: score 49, CVSS 8.7CVE-2026-123566 sveltejs devalue · devalue: score 49, CVSS 8.7CVE-2026-123562 sveltejs devalue · devalue: score 49, CVSS 8.7CVE-2026-85726 chartbrew: score 48, CVSS 7.5CVE-2026-85708 chartbrew: score 48, CVSS 7.5CVE-2026-102359 yuzutech kroki: score 48, CVSS 7.5CVE-2026-92697 pavel-odintsov fastnetmon: score 48, CVSS 7.5CVE-2026-92693 pavel-odintsov fastnetmon: score 48, CVSS 8.2CVE-2026-93424 pavel-odintsov fastnetmon: score 48, CVSS 7.5CVE-2026-92695 pavel-odintsov fastnetmon: score 48, CVSS 8.2CVE-2026-65983 openemr: score 48, CVSS 7.5CVE-2026-54912 bytecodealliance wasm-micro-runtime: score 47, CVSS 8.8CVE-2026-54142 tinyhumansai openhuman: score 47, CVSS 8.7CVE-2026-123874 nodejs node: score 47, CVSS 7.5CVE-2026-123865 nodejs node: score 47, CVSS 7.5CVE-2026-123863 nodejs node: score 47, CVSS 8.2CVE-2026-126080 rails · activesupport: score 47, CVSS 7.5CVE-2026-116945 Microsoft SQL Server: score 47, CVSS 9.8CVE-2026-124576 BeikeShop: score 46, CVSS 6.9
In CISA KEVOther

Chart

What drives the top scores

The top 15 CVEs, with each score split into its parts.

  1. Google ChromeCVE-2021-30563Exploitation 40, Exposure 22, Reach 20, Severity 9.8, No patch 092
  2. Google ChromeCVE-2026-125350Exploitation 40, Exposure 22, Reach 20, Severity 9.8, No patch 092
  3. VMware Cloud Foundation · VMware vSphere Foundation +3CVE-2026-59310Exploitation 40, Exposure 22, Reach 14, Severity 9.8, No patch 086
  4. gpustackCVE-2026-102895Exploitation 40, Exposure 25, Reach 10, Severity 10, No patch 085
  5. Microsoft Windows Server · Microsoft Windows Server,CVE-2020-1350Exploitation 40, Exposure 25, Reach 0, Severity 10, No patch 580
  6. Cisco Secure EmailCVE-2026-76519Exploitation 40, Exposure 25, Reach 0, Severity 10, No patch 580
  7. Adobe Commerce · Adobe Magento Open SourceCVE-2026-75650Exploitation 40, Exposure 25, Reach 0, Severity 10, No patch 580
  8. checkpoint Check Point Quantum Gateway, Spark Gateway and C…CVE-2024-24919Exploitation 40, Exposure 25, Reach 0, Severity 8.6, No patch 579
  9. VMware VCF operations · VMware tools +4CVE-2025-41244Exploitation 40, Exposure 15, Reach 14, Severity 7.8, No patch 077
  10. Barracuda Networks Barracuda Email Security GatewayCVE-2026-116606Exploitation 40, Exposure 25, Reach 0, Severity 10, No patch 075
  11. Apple macOSCVE-2026-65400Exploitation 40, Exposure 25, Reach 0, Severity 10, No patch 075
  12. signalwire freeswitchCVE-2026-116779Exploitation 40, Exposure 25, Reach 0, Severity 10, No patch 075
  13. IBM Aspera FaspexCVE-2026-123218Exploitation 40, Exposure 25, Reach 0, Severity 10, No patch 075
  14. erlang otpCVE-2025-32433Exploitation 40, Exposure 25, Reach 0, Severity 10, No patch 075
  15. SonicWall SonicOSCVE-2026-19868Exploitation 40, Exposure 22, Reach 0, Severity 7.5, No patch 575
ExploitationExposureReachSeverityNo patch