Skip to main content
cve.nowby Sazabi
Back

Rankings: This month's worst-case CVEs

The CVEs that could do the most harm once exploited, published or escalated in the window, scored 0 to 100 on severity, reach, exposure and how far public exploit code has come. No CISA confirmation needed. How this view works.

Severity
    Technology
      Ecosystem
        1. 198Memory corruption in IPv4 TCP connection handlingLinux · CVE-2026-98432Exploit publicFix availableExploit published
        2. 294Out-of-bounds write in decompression decoderGoogle Brotli · node +7 · CVE-2026-111497KEVExploit publicFix availableExploit published
        3. 393Code execution via SQL injection in REST API batch endpointWordPress · CVE-2026-63030KEVExploit publicNucleiFix availableExploit published
        4. 487Remote code execution in out-of-memory handlingPHP Group PHP · CVE-2026-109618KEVExploit publicNucleiFix availableAdded to KEV
        5. 587Remote code execution via stale global statePHP Group PHP · CVE-2026-109619KEVNucleiFix availableAdded to KEV
        6. 685Remote code execution in CI/CD regex handlingGitLab · CVE-2026-97229KEVExploit publicNucleiFix availableExploit published
        7. 782Remote command execution via authentication bypassIvanti Connect Secure · CVE-2026-104935KEVNo patch listed yetPublished
        8. 879Remote code execution via race in core upgrade installerWordPress Foundation WordPress · CVE-2026-119977KEVExploit publicFix availableExploit published
        9. 975Remote code execution in diffpatch API via Git hooksGitea · gitea.dev +1 · CVE-2026-60004KEVExploit publicNucleiFix availableExploit published
        10. 1075Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAMOpenIdentityPlatform OpenAM · org.openidentityplatform.open… · CVE-2026-33439Exploit publicNucleiFix availableExploit published
        11. 1175Authentication bypass in JwtAuthenticatorpac4j-jwt · org.pac4j:pac4j-jwt · CVE-2026-29000Exploit publicFix availableExploit published
        12. 1275Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypassRed Hat build of Keycloak · Red Hat JBoss Enterprise App… +2 · CVE-2026-18963Exploit publicFix availableExploit published
        13. 1375Pillow: Heap buffer overflow in ImagingJpegDecodepython-pillow Pillow · pillow · CVE-2026-112403Proof of conceptFix availablePublished
        14. 1475Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code executionpython-pillow Pillow · pillow · CVE-2026-112398Proof of conceptFix availablePublished
        15. 1575Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIOpython-pillow Pillow · pillow · CVE-2026-112393Proof of conceptFix availablePublished
        16. 1672Payload authentication token field handling issuepayloadcms payload · payload · CVE-2026-105863Exploit publicFix availableExploit published
        17. 1772Remote code execution in scorer deserializationmlflow · CVE-2026-116692Proof of conceptFix availablePublished
        18. 1872zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File…zip-rs zip2 · zip · CVE-2026-115905Proof of conceptFix availablePublished
        19. 1972fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusionnearform fast-jwt · fast-jwt · CVE-2026-107722Proof of conceptFix availablePublished
        20. 2071Authentication bypass in TokenGuardlaravel framework · laravel/framework · CVE-2026-114509Exploit publicNucleiFix availableExploit published
        21. 2170Privilege escalation in netfilter nf_tablesLinux Kernel · CVE-2024-1086KEVExploit publicFix availableExploit published
        22. 2270Privilege escalation in skbuff shared-frag handlingLinux · CVE-2026-46300KEVExploit publicFix availableAdded to KEV
        23. 2370Authenticated remote code execution in management interfacePalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1 · CVE-2026-0322KEVFix availablePublished
        24. 2470toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()BinaryMuse toml-node · toml · CVE-2026-114143Proof of conceptFix availablePublished
        25. 2570adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Eventcthackers adm-zip · adm-zip · CVE-2026-114102Proof of conceptFix availablePublished
        26. 2670Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds readpython-pillow Pillow · pillow · CVE-2026-112896Proof of conceptFix availablePublished
        27. 2770Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)python-pillow Pillow · pillow · CVE-2026-112894Proof of conceptFix availablePublished
        28. 2870Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0python-pillow Pillow · pillow · CVE-2026-112405Proof of conceptFix availablePublished
        29. 2970Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixelspython-pillow Pillow · pillow · CVE-2026-112404Proof of conceptFix availablePublished
        30. 3070Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transformpython-pillow Pillow · pillow · CVE-2026-112402Proof of conceptFix availablePublished
        31. 3170Pillow: Out-of-bounds access in _imagingmorph on a zero-width imagepython-pillow Pillow · pillow · CVE-2026-112397Proof of conceptFix availablePublished
        32. 3270Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoSpython-pillow Pillow · pillow · CVE-2026-112400Proof of conceptFix availablePublished
        33. 3370Pillow: APNG background disposal allocates full canvas before decompression bomb checkpython-pillow Pillow · pillow · CVE-2026-112399Proof of conceptFix availablePublished
        34. 3470Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection Regexesnodemailer · CVE-2026-110869Proof of conceptFix availablePublished
        35. 3570GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Namegitpython-developers GitPython · gitpython · CVE-2026-110859Proof of conceptFix availablePublished
        36. 3670GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_dategitpython-developers GitPython · gitpython · CVE-2026-110856Proof of conceptFix availablePublished
        37. 3768Code execution via path traversal in packet handlingFortinet FortiSIEM · CVE-2026-106173Proof of conceptFix availablePublished
        38. 3868Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secretstriggerdotdev trigger.dev · trigger.dev · CVE-2026-114087Proof of conceptFix availablePublished
        39. 3968Unauthenticated remote code execution in regex compilerGitLab · CVE-2026-110264Proof of conceptFix availablePublished
        40. 4066Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustionpython-pillow Pillow · pillow · CVE-2026-96640Proof of conceptFix availablePublished
        41. 4166Pillow: Invalid free in FreeType glyph rendering when a stroker is activepython-pillow Pillow · pillow · CVE-2026-112893Proof of conceptFix availablePublished
        42. 4266Pillow: NULL dereference in ImagingExpand via rank filters on zero-size imagespython-pillow Pillow · pillow · CVE-2026-112392Proof of conceptFix availablePublished
        43. 4366Pillow: Infinite loop in MIC n_frames when the embedded TIFFpython-pillow Pillow · pillow · CVE-2026-112390Proof of conceptFix availablePublished
        44. 4466Unauthenticated code execution in DNS proxy and DNS serverPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1 · CVE-2026-0264Exploit publicFix availableExploit published
        45. 4565Denial of service in HTTP/2 CONTINUATION handlingnetty · io.netty:netty-codec-http2 · CVE-2026-33871Exploit publicFix availableExploit published
        46. 4665Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG stripspython-pillow Pillow · pillow · CVE-2026-112897Proof of conceptFix availablePublished
        47. 4763File overwrite in file update API via symlinksGogs · gogs.io/gogs · CVE-2025-8110KEVExploit publicNucleiNo patch listed yetExploit published
        48. 4863Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13digitalbazaar forge · node-forge · CVE-2026-119190Proof of conceptFix availablePublished
        49. 4963Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Treetwisted · CVE-2026-115775Proof of conceptFix availablePublished
        50. 5063Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keysauthlib · CVE-2026-114615Proof of conceptFix availablePublished