Skip to main content
cve.nowby Sazabi
Menu
Rankings

Rankings

CVEs and the packages they hit, scored 0-100 on exploitation, exposure, reach, severity and patch status. How the score works.

The worst CVEs published or escalated Nov 2 to Nov 8, ranked by the cve.now Index as the week closed. Movement is against the week before.

  1. 1New92Remote code execution via REST API batch routeWordPress · wordpress-multisite · CVE-2026-63030KEVExploit publicNucleiFix availableExploit published
  2. 2▼189Remote code execution in CI/CD regex handlingGitLab · CVE-2026-97229KEVExploit publicNucleiFix availableExploit published
  3. 3New88Remote code execution via race in core upgrade installerWordPress Foundation WordPress · CVE-2026-119977KEVExploit publicFix availableExploit published
  4. 4New86Remote code execution in Syslog serviceVMware Cloud Foundation · VMware vSphere Foundation +3 · CVE-2026-59310KEVFix availableEPSS crossed 10%
  5. 5New84Privilege escalation in netfilter nf_tablesLinux Kernel · CVE-2024-1086KEVExploit publicFix availableExploit published
  6. 6New83File overwrite in file update API via symlinksGogs · gogs.io/gogs · CVE-2025-8110KEVExploit publicNucleiNo patch listed yetExploit published
  7. 7New81Authenticated remote file upload via predictable filenamesIvanti Connect Secure · CVE-2026-118527KEVNo patch listed yetPublished
  8. 8New80Remote code execution in DNS serverMicrosoft Windows Server · Microsoft Windows Server, · CVE-2020-1350KEVExploit publicNo patch listed yetExploit published
  9. 9New80Remote file write and root execution in file reputationCisco Secure Email · CVE-2026-76519KEVExploit publicNo patch listed yetExploit published
  10. 10New80Remote code execution in template engineAdobe Commerce · Adobe Magento Open Source · CVE-2026-75650KEVNucleiNo patch listed yetEPSS crossed 10%
  11. 11New80Data leak via authentication bypass in web serverHikvision Cameras · CVE-2017-7921KEVExploit publicNucleiNo patch listed yetExploit published
  12. 12New79Information disclosure in Remote Access VPNcheckpoint Check Point Quantum Gateway, Spark Gateway and C… · CVE-2024-24919KEVExploit publicNucleiNo patch listed yetExploit published
  13. 13New77Local privilege escalation to root in guest toolsVMware VCF operations · VMware tools +4 · CVE-2025-41244KEVFix availableProvisionalEPSS crossed 10%
  14. 14New75Pre-auth remote code execution in SSH servererlang otp · CVE-2025-32433KEVExploit publicFix availableExploit published
  15. 15New75Authentication bypass in SSLVPN serviceSonicWall SonicOS · CVE-2026-19868KEVNo patch listed yetProvisionalPublished
  16. 16New75Remote code execution via SQL injection in email parsingCisco Secure Email · CVE-2026-76461KEVExploit publicFix availableExploit published
  17. 17▼772Remote code execution via unrestricted file uploadAdobe Commerce · Adobe Magento Open Source · CVE-2026-48356KEVExploit publicFix availableExploit published
  18. 18New68Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAMOpenIdentityPlatform OpenAM · org.openidentityplatform.open… · CVE-2026-33439Exploit publicNucleiFix availableExploit published
  19. 19New67Privilege escalation via user token validationjfrog artifactory · CVE-2026-42016KEVExploit publicFix availableExploit published
  20. 20New66Denial of service in HTTP/2 CONTINUATION handlingnetty · io.netty:netty-codec-http2 · CVE-2026-33871Exploit publicFix availableExploit published
  21. 21New63Payload authentication token field handling issuepayloadcms payload · payload · CVE-2026-105863Exploit publicFix availableExploit published
  22. 22New61Auth bypass in Pointer AuthenticationApple Safari · Apple iOS and iPadOS +3 · CVE-2024-27834KEVFix availableAdded to KEV
  23. 23New61Unauthenticated code execution in DNS proxy and DNS serverPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1 · CVE-2026-0264Exploit publicFix availableExploit published
  24. 24New60Recipient allow list bypass in addressparsernodemailer · CVE-2026-121426Fix availablePublished
  25. 25New59Denial of service and data corruption in DICOM parsingProject-MONAI MONAI · monai · CVE-2026-48705Fix availablePublished

2026-W44