Skip to main content
cve.nowby Sazabi
Back

Rankings: This month's trending CVEs

The CVEs gaining the most attention in the window: new GitHub proof-of-concept repos, new references and EPSS rises. Attention sets the order only; each row keeps its cve.now Index score. How this view works.

Severity
    Technology
      Ecosystem
        1. 189Remote code execution in out-of-memory handlingPHP Group PHP · CVE-2026-109618+15 PoC repos+30 referencesEPSS +100 ptsKEVExploit publicNucleiFix availableGaining attention
        2. 265Local root access in chroot handlingSudo project Sudo · CVE-2025-32463+70 PoC repos+74 referencesKEVExploit publicFix availableGaining attention
        3. 389Remote code execution via stale global statePHP Group PHP · CVE-2026-109619+1 PoC repo+11 referencesEPSS +100 ptsKEVNucleiFix availableGaining attention
        4. 492Out-of-bounds write in decompression decoderGoogle Brotli · node +7 · CVE-2026-111497+5 PoC repos+15 referencesEPSS +82 ptsKEVExploit publicFix availableGaining attention
        5. 575Pre-auth remote code execution in SSH servererlang otp · CVE-2025-32433+43 PoC repos+54 referencesKEVExploit publicFix availableGaining attention
        6. 677Unauthenticated file access in web application rootAtlassian Bamboo Data Center · Atlassian Bitbucket Data… +6 · CVE-2026-21589EPSS +97 ptsKEVNucleiNo patch listed yetGaining attention
        7. 784Memory corruption in algif_aead AEAD socketsLinux · CVE-2026-31431EPSS +94 ptsKEVFix availableGaining attention
        8. 864rxrpc: Also unshare DATA/RESPONSE packets when paged frags are presentLinux · CVE-2026-43500EPSS +91 ptsExploit publicNo patch listed yetGaining attention
        9. 980Encryption bypass in EncryptInterceptorApache Software Foundation Apache Tomcat · org.apache.to… +1 · CVE-2026-34486EPSS +91 ptsKEVFix availableProvisionalGaining attention
        10. 1052xfrm: esp: avoid in-place decrypt on shared skb fragsLinux · CVE-2026-43284EPSS +91 ptsExploit publicFix availableGaining attention
        11. 1194Remote command execution via authentication bypassIvanti Connect Secure · CVE-2026-104935EPSS +88 ptsKEVNo patch listed yetGaining attention
        12. 1277Unauthenticated takeover in Updates Environment ManagementOracle PeopleSoft Enterprise PeopleTools · CVE-2026-35273EPSS +87 ptsKEVNo patch listed yetProvisionalGaining attention
        13. 1371Memory overread in SAML identity providerNetScaler ADC · NetScaler Gateway · CVE-2026-3055EPSS +87 ptsKEVFix availableProvisionalGaining attention
        14. 1485Unauthenticated code execution in management serverFortinet FortiClientEMS · CVE-2026-35616EPSS +84 ptsKEVFix availableGaining attention
        15. 1591SQL injection in Proxy API key verificationBerriAI litellm · litellm · CVE-2026-42208EPSS +83 ptsKEVFix availableGaining attention
        16. 1677Remote code execution via Jolokia MBeansApache Software Foundation Apache ActiveMQ Broker · Apac… +3 · CVE-2026-34197EPSS +82 ptsKEVFix availableGaining attention
        17. 1789Unauthenticated remote code execution in network applianceCitrix NetScaler ADC · Citrix NetScaler Gateway · CVE-2026-88771EPSS +80 ptsKEVFix availableGaining attention
        18. 1875Remote OS command injection in replication receiverAhsayCBS · CVE-2026-105134EPSS +79 ptsKEVFix availableGaining attention
        19. 1972Auth bypass in API system password checkAhsayCBS · CVE-2026-105133EPSS +79 ptsKEVFix availableGaining attention
        20. 2072Unauthenticated SQL injection in password reset endpointMetabase · CVE-2026-72898EPSS +79 ptsKEVFix availableGaining attention
        21. 2150Windows Netlogon Remote Code Execution VulnerabilityMicrosoft Windows Server · CVE-2026-41089EPSS +78 ptsFix availableGaining attention
        22. 2280Unauthorized file operations in internal messagingBeyondTrust Remote Support · CVE-2026-102764EPSS +78 ptsKEVNucleiNo patch listed yetGaining attention
        23. 2376Authentication bypass in VPN remote accesscheckpoint Quantum Security Gateway · checkpoint Spark Fire… · CVE-2026-50751EPSS +78 ptsKEVNo patch listed yetProvisionalGaining attention
        24. 2467Remote code execution via unsafe deserializationMicrosoft SharePoint Enterprise Server · Microsoft SharePoi… · CVE-2026-45659EPSS +77 ptsKEVFix availableProvisionalGaining attention
        25. 2586Remote code execution via memory overflowCitrix NetScaler ADC · Citrix NetScaler Gateway · CVE-2026-88772EPSS +75 ptsKEVFix availableGaining attention
        26. 2675Remote code execution in IKE service extensionsMicrosoft Windows · CVE-2026-33824EPSS +75 ptsKEVFix availableGaining attention
        27. 2775Auth bypass in OIDC login from missing JWT signature checksSimpleHelp · CVE-2026-48558EPSS +75 ptsKEVFix availableGaining attention
        28. 2875Remote command execution in proxy.phpCollabora Online - Built-in CODE Server · CVE-2026-110447+1 referenceEPSS +73 ptsKEVNucleiFix availableGaining attention
        29. 2985SQL injection in the database query layerDrupal core · drupal +1 · CVE-2026-9082EPSS +73 ptsKEVExploit publicFix availableGaining attention
        30. 3072Improper access control allows unauthorized system changesUbiquiti UniFi OS Server · Ubiquiti UDM +29 · CVE-2026-34908EPSS +73 ptsKEVFix availableProvisionalGaining attention
        31. 3189Remote code execution in CI/CD regex handlingGitLab · CVE-2026-97229+2 PoC repos+5 referencesEPSS +65 ptsKEVExploit publicNucleiFix availableGaining attention
        32. 3277Code execution via path traversal in management servercheckpoint Quantum Security Management · CVE-2026-93616EPSS +72 ptsKEVNo patch listed yetProvisionalGaining attention
        33. 3353Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST APIRocketGenius Gravity SMTP · CVE-2026-4020EPSS +71 ptsNucleiNo patch listed yetGaining attention
        34. 3481Remote code execution in public flow build endpointlangflow-ai langflow · langflow · CVE-2026-33017EPSS +71 ptsKEVFix availableGaining attention
        35. 3584Spoofing via XSS in web page generationMicrosoft Exchange Server 2016 Cumulative Update · Micro… +1 · CVE-2026-42897EPSS +70 ptsKEVFix availableProvisionalGaining attention
        36. 3677Unauthenticated code execution in file upload handlerjoomlacontenteditor.net Joomla Content Editor (JCE) extensi… · CVE-2026-48907EPSS +69 ptsKEVNo patch listed yetProvisionalGaining attention
        37. 3772Unauthorized file read via path traversalUbiquiti UniFi OS Server · Ubiquiti Express +29 · CVE-2026-34909EPSS +67 ptsKEVFix availableProvisionalGaining attention
        38. 3868Ghost has a SQL Injection in its Content APITryGhost Ghost · ghost · CVE-2026-26980EPSS +66 ptsExploit publicNucleiFix availableGaining attention
        39. 3966Spoofing of trusted UI elements in the shellMicrosoft Windows · CVE-2026-32202EPSS +66 ptsKEVExploit publicFix availableGaining attention
        40. 4063NGINX ngx_http_rewrite_module vulnerabilityF5 NGINX Plus · F5 NGINX Open Source · CVE-2026-42945EPSS +64 ptsFix availableGaining attention
        41. 4192Security check bypass via unvalidated Host headerKludex starlette · starlette · CVE-2026-48710EPSS +63 ptsKEVFix availableGaining attention
        42. 4280Data leak via authentication bypass in web serverHikvision Cameras · CVE-2017-7921+27 PoC repos+34 referencesKEVExploit publicNucleiNo patch listed yetGaining attention
        43. 4383Pre-auth code execution via terminal WebSocketmarimo-team marimo · marimo · CVE-2026-39987EPSS +61 ptsKEVFix availableGaining attention
        44. 4475Authentication bypass in web management interfaceCisco Identity Services Engine Software · Cisco ISE Passive… · CVE-2026-76460EPSS +61 ptsKEVFix availableGaining attention
        45. 4559Denial of service in antimalware scanningMicrosoft Defender Antimalware Platform · CVE-2026-45498EPSS +61 ptsKEVFix availableProvisionalGaining attention
        46. 4677Secret theft in compromised GitHub Actions supply chainaquasecurity setup-trivy · aquasecurity trivy-action +6 · CVE-2026-33634EPSS +58 ptsKEVFix availableGaining attention
        47. 4755EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)Progress ShareFile Storage Zones Controller · CVE-2026-2699EPSS +55 ptsNucleiNo patch listed yetGaining attention
        48. 4848Denial of service in HTTP.sysMicrosoft Windows · CVE-2026-49160EPSS +55 ptsFix availableGaining attention
        49. 4972Remote code execution via unrestricted file uploadAdobe Commerce · Adobe Magento Open Source · CVE-2026-48356+2 PoC repos+5 referencesEPSS +46 ptsKEVExploit publicFix availableGaining attention
        50. 5038RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC)Progress ShareFile Storage Zones Controller · CVE-2026-2701EPSS +51 ptsNo patch listed yetGaining attention