Skip to main content
cve.nowby Sazabi
Back

Rankings: All-time worst-case CVEs

The CVEs that could do the most harm once exploited, published or escalated in the window, scored 0 to 100 on severity, reach, exposure and how far public exploit code has come. No CISA confirmation needed. How this view works.

Severity
    Technology
      Ecosystem
        1. 1100Crash or data corruption in TLS receive pathLinux · :linux_kernel: · CVE-2025-39682KEVFix availableAdded to KEV
        2. 2100Authorization Bypass in Next.js Middlewarevercel next.js · next · CVE-2025-29927Exploit publicNucleiFix availableExploit published
        3. 3100Potential SQL injection via _connector keyword argument in QuerySet and Q objectsdjangoproject django · django · CVE-2025-64459Exploit publicFix availableExploit published
        4. 498Memory corruption in IPv4 TCP connection handlingLinux · CVE-2026-98432Exploit publicFix availableExploit published
        5. 594Out-of-bounds write in decompression decoderGoogle Brotli · node +7 · CVE-2026-111497KEVExploit publicFix availableExploit published
        6. 694Next.js: Unauthenticated Remote Code Execution on windows-hosted serversvercel next.js · next · CVE-2026-75604Exploit publicFix availablePublished
        7. 793Remote root takeover in web UICisco IOS XE Software · CVE-2023-20198KEVNo patch listed yetPublished
        8. 893Code execution via SQL injection in REST API batch endpointWordPress · CVE-2026-63030KEVExploit publicNucleiFix availableExploit published
        9. 993Pre-auth remote code execution in server function endpointsMeta react-server-dom-webpack · Meta react-server-dom-tu… +4 · CVE-2025-55182KEVExploit publicNucleiFix availableExploit published
        10. 1093Remote code execution in JNDI lookupsApache Software Foundation Apache Log4j2 · org.apache.lo… +4 · CVE-2021-44228KEVExploit publicNucleiFix availableExploit published
        11. 1193SQL injection in Proxy API key verificationBerriAI litellm · litellm · CVE-2026-42208KEVFix availablePublished
        12. 1293Remote code execution via unsecured actuator endpointSpring Cloud Gateway · org.springframework.cloud:spring-clo… · CVE-2022-22947KEVFix availableAdded to KEV
        13. 1393WordPress Plugin WP-Property <= 1.35.0 PHP File UploadWP-Property WordPress Plugin · CVE-2012-10027Exploit publicNo patch listed yetPublished
        14. 1493WordPress Plugin Advanced Custom Fields <= 3.5.1 Remote File InclusionAdvanced Custom Fields WordPress Plugin · CVE-2012-10025Exploit publicNo patch listed yetPublished
        15. 1593WordPress Pie Register Plugin ≤ 3.7.1.4 Authentication Bypass RCEGenetech Solutions WordPress Pie Register Plugin · CVE-2025-34077Exploit publicNucleiNo patch listed yetExploit published
        16. 1693Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processingrails · activestorage · CVE-2026-66066Exploit publicFix availablePublished
        17. 1793Remote code execution in admission controllerkubernetes ingress-nginx · k8s.io/ingress-nginx · CVE-2025-1974Exploit publicNucleiFix availableExploit published
        18. 1892Sandbox escape in ANGLE and GPU componentsGoogle Chrome · CVE-2025-6558KEVFix availableAdded to KEV
        19. 1991Remote code execution in Reporting ServicesMicrosoft SQL Server · CVE-2020-0618KEVNo patch listed yetProvisionalAdded to KEV
        20. 2091Code execution via argument injection in CGI modulePHP Group PHP · CVE-2024-4577KEVFix availableProvisionalAdded to KEV
        21. 2191Code execution via crafted routing expressionsSpring Cloud Function · org.springframework.cloud:spring-cl… · CVE-2022-22963KEVFix availableAdded to KEV
        22. 2291Remote code execution in property binderSpring by Pivotal Spring Framework · org.springframework.da… · CVE-2018-1273KEVFix availableProvisionalAdded to KEV
        23. 2391Path traversal and code execution in URL mappingApache Software Foundation Apache HTTP Server · CVE-2021-42013KEVFix availableAdded to KEV
        24. 2490Malware in @tanstack/* npm packages steals credentials@tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82 · CVE-2026-45321KEVFix availableAdded to KEV
        25. 2590Remote code execution in V8 JavaScript engineGoogle Chrome · CVE-2024-4947KEVFix availableAdded to KEV
        26. 2690Sandbox escape via use-after-free in VisualsGoogle Chrome · CVE-2024-4671KEVFix availableProvisionalAdded to KEV
        27. 2790Sandbox escape via integer overflow in SkiaGoogle Chrome · CVE-2023-6345KEVFix availableAdded to KEV
        28. 2890Sandbox escape from integer overflow in SkiaGoogle Chrome · CVE-2023-2136KEVFix availableAdded to KEV
        29. 2990Sandbox escape via heap overflow in GPU componentGoogle Chrome · electron · CVE-2022-4135KEVFix availableAdded to KEV
        30. 3090Sandbox escape in Mojo from insufficient data validationGoogle Chrome · CVE-2022-3075KEVFix availableProvisionalPublished
        31. 3190Heap buffer overflow in FreeType font renderingGoogle Chrome · CefSharp.Common +3 · CVE-2020-15999KEVFix availableAdded to KEV
        32. 3290Sandbox escape via heap buffer overflow in UIGoogle Chrome · CVE-2020-16010KEVFix availableProvisionalAdded to KEV
        33. 3390Sandbox escape in site isolationGoogle Chrome · CefSharp.Common +3 · CVE-2020-16017KEVFix availableProvisionalAdded to KEV
        34. 3490Sandbox escape in Indexed DB APIGoogle Chrome · CVE-2021-30633KEVFix availableAdded to KEV
        35. 3590Sandbox escape via use-after-free in PortalsGoogle Chrome · CVE-2021-37973KEVFix availableAdded to KEV
        36. 3690Remote code execution via DNS rebinding in browser checksray-project ray · ray · CVE-2025-62593KEVFix availableAdded to KEV
        37. 3790Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API.ray · CVE-2023-48022Exploit publicNucleiNo patch listed yetPublished
        38. 3890Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapterspayloadcms payload · @payloadcms/drizzle · CVE-2026-25544Exploit publicFix availableExploit published
        39. 3988Auth bypass in MCP Streamable HTTP endpointBerriAI litellm · litellm · CVE-2026-59822KEVFix availableAdded to KEV
        40. 4088Remote code execution in Metro dev server@react-native-community/cli-server-api · @react-native-comm… · CVE-2025-11953KEVFix availableAdded to KEV
        41. 4188Unauthenticated access in experimental APIApache Airflow · apache-airflow · CVE-2020-13927KEVFix availableProvisionalAdded to KEV
        42. 4288Ray Command Injection in cpu_profile Parameterray-project/ray · ray · CVE-2023-6019Exploit publicFix availableProvisionalExploit published
        43. 4387Remote code execution in out-of-memory handlingPHP Group PHP · CVE-2026-109618KEVExploit publicNucleiFix availableAdded to KEV
        44. 4487Remote code execution via stale global statePHP Group PHP · CVE-2026-109619KEVNucleiFix availableAdded to KEV
        45. 4585Unauthenticated command injection as root in serverivanti Sentry · CVE-2026-10520KEVNo patch listed yetAdded to KEV
        46. 4685Unauthenticated remote code execution in MDM serverIvanti Endpoint Manager Mobile · CVE-2026-1281KEVNo patch listed yetPublished
        47. 4785Auth bypass in SAML single sign-on loginFortinet FortiSwitchManager · Fortinet FortiOS +1 · CVE-2025-59718KEVNo patch listed yetAdded to KEV
        48. 4885Remote code execution via out-of-bounds writeFortinet FortiOS · Fortinet FortiProxy · CVE-2024-21762KEVNo patch listed yetPublished
        49. 4985Authentication bypass in web applicationIvanti EPMM · CVE-2023-35082KEVNo patch listed yetProvisionalAdded to KEV
        50. 5085Authentication bypass in access controlsIvanti Endpoint Manager Mobile · CVE-2023-35078KEVNo patch listed yetPublished