Skip to main content
cve.nowby Sazabi
Back

Rankings: This week's trending CVEs

The CVEs gaining the most attention in the window: new GitHub proof-of-concept repos, new references and EPSS rises. Attention sets the order only; each row keeps its cve.now Index score. How this view works.

Severity
    Technology
      Ecosystem
        1. 165Local root access in chroot handlingSudo project Sudo · CVE-2025-32463+70 PoC repos+74 referencesKEVExploit publicFix availableGaining attention
        2. 275Pre-auth remote code execution in SSH servererlang otp · CVE-2025-32433+43 PoC repos+54 referencesKEVExploit publicFix availableGaining attention
        3. 380Data leak via authentication bypass in web serverHikvision Cameras · CVE-2017-7921+27 PoC repos+34 referencesKEVExploit publicNucleiNo patch listed yetGaining attention
        4. 480Unauthorized file operations in internal messagingBeyondTrust Remote Support · CVE-2026-102764EPSS +59 ptsKEVNucleiNo patch listed yetGaining attention
        5. 580Remote code execution in template engineAdobe Commerce · Adobe Magento Open Source · CVE-2026-75650+7 PoC repos+9 referencesEPSS +30 ptsKEVNucleiNo patch listed yetGaining attention
        6. 689Remote code execution in out-of-memory handlingPHP Group PHP · CVE-2026-109618+15 PoC repos+30 referencesKEVExploit publicNucleiFix availableGaining attention
        7. 789Remote code execution in CI/CD regex handlingGitLab · CVE-2026-97229+2 PoC repos+5 referencesEPSS +38 ptsKEVExploit publicNucleiFix availableGaining attention
        8. 848Password auth bypass in sshd with musl libcOpenBSD OpenSSH · CVE-2026-123158+19 PoC repos+23 referencesEPSS +1 ptsExploit publicFix availableProvisionalGaining attention
        9. 969Memory corruption in IPv4 TCP connection handlingLinux · CVE-2026-98432+18 PoC repos+23 referencesExploit publicFix availableGaining attention
        10. 1080Remote code execution in DNS serverMicrosoft Windows Server · Microsoft Windows Server, · CVE-2020-1350+16 PoC repos+17 referencesKEVExploit publicNo patch listed yetGaining attention
        11. 1155Use-after-free in POSIX CPU timers during execLinux · CVE-2026-98260+14 PoC repos+14 referencesExploit publicFix availableGaining attention
        12. 1292Out-of-bounds write in decompression decoderGoogle Brotli · node +7 · CVE-2026-111497+5 PoC repos+15 referencesKEVExploit publicFix availableGaining attention
        13. 1375Remote code execution via SQL injection in email parsingCisco Secure Email · CVE-2026-76461+4 PoC repos+6 referencesEPSS +10 ptsKEVExploit publicFix availableGaining attention
        14. 1438Remote command execution in certificate deployment targetZohocorp ManageEngine Key Manager Plus · CVE-2026-77690EPSS +15 ptsFix availableGaining attention
        15. 1588Remote code execution via race in core upgrade installerWordPress Foundation WordPress · CVE-2026-119977+5 PoC repos+7 referencesEPSS +1 ptsKEVExploit publicFix availableGaining attention
        16. 1689Remote code execution via stale global statePHP Group PHP · CVE-2026-109619+1 PoC repo+11 referencesKEVNucleiFix availableGaining attention
        17. 1737PackageKit vulnerable to TOCTOU Race on Transaction Flags leads to arbitrary package installation as rootPackageKit · CVE-2026-41651+1 PoC repo+11 referencesExploit publicFix availableGaining attention
        18. 1866Denial of service in HTTP/2 CONTINUATION handlingnetty · io.netty:netty-codec-http2 · CVE-2026-33871+1 PoC repo+11 referencesExploit publicFix availableGaining attention
        19. 1962Server-side request forgery in media serverPlex Media Server · CVE-2026-96655+2 referencesEPSS +9 ptsKEVNucleiFix availableGaining attention
        20. 2048Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routesvercel next.js · next · CVE-2026-45109+11 referencesFix availableGaining attention
        21. 2184Privilege escalation in skbuff shared-frag handlingLinux · CVE-2026-46300+10 referencesKEVExploit publicFix availableGaining attention
        22. 2262Internal network access via SSRF in media serverPlex Media Server · CVE-2026-96652EPSS +10 ptsKEVNucleiFix availableGaining attention
        23. 2360Remote code execution via race in signal handlingOpenSSH · Red Hat Enterprise Linux +1 · CVE-2024-6409+10 referencesNo patch listed yetGaining attention
        24. 2443Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processingRed Hat Enterprise Linux · Red Hat OpenShift Container P… +7 · CVE-2026-4424+10 referencesNo patch listed yetGaining attention
        25. 2533KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTELinux · CVE-2026-23401+10 referencesFix availableGaining attention
        26. 2632Memory corruption via double free in PVRDMALinux · CVE-2026-46189+10 referencesFix availableGaining attention
        27. 2729Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handlingRed Hat Enterprise Linux · CVE-2026-33999+10 referencesNo patch listed yetGaining attention
        28. 2829Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruptionRed Hat Enterprise Linux · CVE-2026-34001+10 referencesNo patch listed yetGaining attention
        29. 2929Xorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory accessRed Hat Enterprise Linux · CVE-2026-34003+10 referencesNo patch listed yetGaining attention
        30. 3028Postgresql: buffer overrun from integer overflow in array modificationRed Hat Advanced Cluster Security · Red Hat Enterprise L… +4 · CVE-2023-5869+10 referencesFix availableGaining attention
        31. 3172Remote code execution via unrestricted file uploadAdobe Commerce · Adobe Magento Open Source · CVE-2026-48356+2 PoC repos+5 referencesEPSS +2 ptsKEVExploit publicFix availableGaining attention
        32. 3232Use-after-free in rxrpc after failed skb unshareLinux · CVE-2026-45998+9 referencesFix availableGaining attention
        33. 3359braces through 3.0.3 Stack Overflow via Deeply Nested Patternsmicromatch braces · braces · CVE-2026-93687+3 PoC repos+5 referencesNo patch listed yetGaining attention
        34. 3420icmp: fix NULL pointer dereference in icmp_tag_validation()Linux · CVE-2026-23398+2 PoC repos+6 referencesFix availableGaining attention
        35. 3580Remote file write and root execution in file reputationCisco Secure Email · CVE-2026-76519+1 PoC repo+3 referencesEPSS +4 ptsKEVExploit publicNo patch listed yetGaining attention
        36. 3643Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchiveRed Hat Enterprise Linux · Red Hat OpenShift Container P… +6 · CVE-2026-4111+8 referencesNo patch listed yetGaining attention
        37. 3789Code execution via SQL injection in endpoint serverFortinet FortiClientEMS · CVE-2026-21643+2 PoC repos+5 referencesKEVNucleiFix availableGaining attention
        38. 3865Remote code execution in CockpitRed Hat Enterprise Linux · CVE-2026-4631+2 PoC repos+5 referencesExploit publicNucleiFix availableGaining attention
        39. 3971Unauthenticated remote code execution in management consoleTrend Micro Apex One · CVE-2025-54948EPSS +7 ptsKEVFix availableGaining attention
        40. 4049vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command executionpatriksimek vm2 · vm2 · CVE-2026-44007+7 referencesFix availableGaining attention
        41. 4138Gnutls: gnutls: denial of service via dtls packet reordering vulnerabilitygnutls · Red Hat Enterprise Linux +7 · CVE-2026-42009+7 referencesFix availableGaining attention
        42. 4270Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account TakeoverFlowiseAI Flowise · flowise · CVE-2025-58434EPSS +6 ptsExploit publicNucleiFix availableGaining attention
        43. 4357Remote code execution via unrestricted form file uploadWP Libre Form · CVE-2026-118423+3 PoC repos+3 referencesExploit publicNo patch listed yetProvisionalGaining attention
        44. 4448Remote code execution in image parsingMicrosoft Paint · CVE-2026-83844+3 PoC repos+3 referencesExploit publicFix availableGaining attention
        45. 4520xfrm: ah6: validate routing header segments_leftLinux · CVE-2026-80844+3 PoC repos+3 referencesFix availableGaining attention
        46. 4661vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`patriksimek vm2 · vm2 · CVE-2026-44008+6 referencesFix availableGaining attention
        47. 4761vm2: Sandbox Breakout Through Null Proto Exceptionpatriksimek vm2 · vm2 · CVE-2026-44009+6 referencesFix availableGaining attention
        48. 4853Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)Red Hat RESTEasy · Red Hat Build of Apache Camel 3.33.4… +12 · CVE-2026-89059+6 referencesFix availableGaining attention
        49. 4944Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard configRed Hat RESTEasy · Red Hat Build of Apache Camel 3.33.4… +12 · CVE-2026-89058+6 referencesFix availableGaining attention
        50. 5032crypto: authencesn - reject short ahash digests during instance creationLinux · CVE-2026-46033+6 referencesFix availableGaining attention