Skip to main content
cve.nowby Sazabi
Back

Rankings: This year's worst-case CVEs

The CVEs that could do the most harm once exploited, published or escalated in the window, scored 0 to 100 on severity, reach, exposure and how far public exploit code has come. No CISA confirmation needed. How this view works.

Severity
    Technology
      Ecosystem
        1. 1100Crash or data corruption in TLS receive pathLinux · :linux_kernel: · CVE-2025-39682KEVFix availableAdded to KEV
        2. 2100Potential SQL injection via _connector keyword argument in QuerySet and Q objectsdjangoproject django · django · CVE-2025-64459Exploit publicFix availableExploit published
        3. 398Memory corruption in IPv4 TCP connection handlingLinux · CVE-2026-98432Exploit publicFix availableExploit published
        4. 494Out-of-bounds write in decompression decoderGoogle Brotli · node +7 · CVE-2026-111497KEVExploit publicFix availableExploit published
        5. 594Next.js: Unauthenticated Remote Code Execution on windows-hosted serversvercel next.js · next · CVE-2026-75604Exploit publicFix availablePublished
        6. 693Code execution via SQL injection in REST API batch endpointWordPress · CVE-2026-63030KEVExploit publicNucleiFix availableExploit published
        7. 793Pre-auth remote code execution in server function endpointsMeta react-server-dom-webpack · Meta react-server-dom-tu… +4 · CVE-2025-55182KEVExploit publicNucleiFix availableExploit published
        8. 893SQL injection in Proxy API key verificationBerriAI litellm · litellm · CVE-2026-42208KEVFix availablePublished
        9. 993Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processingrails · activestorage · CVE-2026-66066Exploit publicFix availablePublished
        10. 1090Malware in @tanstack/* npm packages steals credentials@tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82 · CVE-2026-45321KEVFix availableAdded to KEV
        11. 1190Remote code execution via DNS rebinding in browser checksray-project ray · ray · CVE-2025-62593KEVFix availableAdded to KEV
        12. 1290Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapterspayloadcms payload · @payloadcms/drizzle · CVE-2026-25544Exploit publicFix availableExploit published
        13. 1388Auth bypass in MCP Streamable HTTP endpointBerriAI litellm · litellm · CVE-2026-59822KEVFix availableAdded to KEV
        14. 1488Remote code execution in Metro dev server@react-native-community/cli-server-api · @react-native-comm… · CVE-2025-11953KEVFix availableAdded to KEV
        15. 1587Remote code execution in out-of-memory handlingPHP Group PHP · CVE-2026-109618KEVExploit publicNucleiFix availableAdded to KEV
        16. 1687Remote code execution via stale global statePHP Group PHP · CVE-2026-109619KEVNucleiFix availableAdded to KEV
        17. 1785Unauthenticated command injection as root in serverivanti Sentry · CVE-2026-10520KEVNo patch listed yetAdded to KEV
        18. 1885Unauthenticated remote code execution in MDM serverIvanti Endpoint Manager Mobile · CVE-2026-1281KEVNo patch listed yetPublished
        19. 1985Auth bypass in SAML single sign-on loginFortinet FortiSwitchManager · Fortinet FortiOS +1 · CVE-2025-59718KEVNo patch listed yetAdded to KEV
        20. 2085Remote code execution in CI/CD regex handlingGitLab · CVE-2026-97229KEVExploit publicNucleiFix availableExploit published
        21. 2185Unauthenticated file write via web request handlingFortinet FortiMail · CVE-2026-104286KEVFix availablePublished
        22. 2285Unauthenticated remote code execution in network applianceCitrix NetScaler ADC · Citrix NetScaler Gateway · CVE-2026-88771KEVFix availablePublished
        23. 2385Remote code execution in User-ID authentication portalPalo Alto Networks Cloud NGFW · Palo Alto Networks PAN-OS +1 · CVE-2026-0300KEVFix availablePublished
        24. 2485Code execution via SQL injection in endpoint serverFortinet FortiClientEMS · CVE-2026-21643KEVNucleiFix availableAdded to KEV
        25. 2585Arbitrary file read in repository commits APIGitLab · CVE-2026-85706KEVFix availableProvisionalPublished
        26. 2684Unauthenticated full-read SSRF in webhook deliverymlflow · CVE-2026-64849KEVFix availableAdded to KEV
        27. 2783Remote code execution in V8 via out-of-bounds writeGoogle Chrome · CVE-2026-87491KEVFix availableProvisionalPublished
        28. 2883Remote code execution in V8 sandboxGoogle Chrome · CVE-2026-85046KEVFix availableProvisionalAdded to KEV
        29. 2983Out-of-bounds read in V8 enables sandboxed code executionGoogle Chrome · CVE-2026-11645KEVFix availableProvisionalAdded to KEV
        30. 3083Unauthenticated remote code execution via code injectionIvanti Endpoint Manager Mobile · CVE-2026-1340KEVNo patch listed yetProvisionalAdded to KEV
        31. 3183Code execution via use-after-free in DawnGoogle Chrome · CVE-2026-5281KEVFix availableProvisionalPublished
        32. 3283Memory corruption in Skia graphics libraryGoogle Chrome · CVE-2026-3909KEVFix availableProvisionalAdded to KEV
        33. 3383Remote code execution in V8 JavaScript engineGoogle Chrome · CVE-2026-3910KEVFix availableProvisionalAdded to KEV
        34. 3483Sandboxed code execution via CSS use-after-freeGoogle Chrome · CVE-2026-2441KEVFix availableProvisionalAdded to KEV
        35. 3583Out-of-bounds memory access in ANGLEGoogle Chrome · CVE-2025-14174KEVFix availableProvisionalPublished
        36. 3683Remote memory corruption in V8 via type confusionGoogle Chrome · CVE-2025-13223KEVFix availableProvisionalAdded to KEV
        37. 3783Remote code execution in Syslog serviceVMware Cloud Foundation · VMware vSphere Foundation +3 · CVE-2026-59310KEVFix availableAdded to KEV
        38. 3882Remote command execution via authentication bypassIvanti Connect Secure · CVE-2026-104935KEVNo patch listed yetPublished
        39. 3981Python-Multipart has Arbitrary File Write via Non-Default ConfigurationKludex python-multipart · python-multipart · CVE-2026-24486Exploit publicFix availableExploit published
        40. 4080Memory read in zlib compressed protocol header lengthMongoDB Server · CVE-2025-14847KEVFix availableAdded to KEV
        41. 4180Remote code execution via memory overflowCitrix NetScaler ADC · Citrix NetScaler Gateway · CVE-2026-88772KEVFix availablePublished
        42. 4280Path traversal in request handling allows admin commandsFortinet FortiWeb · CVE-2025-64446KEVFix availablePublished
        43. 4380vLLM leaks a heap address when PIL throws an errorvllm-project vllm · vllm · CVE-2026-22778Exploit publicNucleiFix availablePublished
        44. 4480The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution…apscheduler · CVE-2026-31072Proof of conceptNo patch listed yetPublished
        45. 4580scanf %mc off-by-one heap buffer overflowThe GNU C Library glibc · CVE-2026-5450Proof of conceptNo patch listed yetPublished
        46. 4680A vulnerability was identified in OpenAI Codex CLI v0.23.0 and before that enables code execution through malicious MCP (Model Context…@openai/codex · CVE-2025-61260Proof of conceptNo patch listed yetPublished
        47. 4780Handlebars: JavaScript Injection via AST Type Confusion in compile (Program.blockParams)handlebars-lang handlebars.js · handlebars · CVE-2026-106446Proof of conceptFix availablePublished
        48. 4880Handlebars: JavaScript Injection via Own Property Check Bypasshandlebars-lang handlebars.js · handlebars · CVE-2026-106445Proof of conceptFix availablePublished
        49. 4980Tinypool: Prototype Pollution Gadget to RCE in run() optionstinylibs tinypool · tinypool · CVE-2026-104849Proof of conceptFix availablePublished
        50. 5080PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guardjpadilla pyjwt · pyjwt · CVE-2026-102268Proof of conceptFix availablePublished