Skip to main content
cve.nowby Sazabi
Back

Rankings: All-time worst CVEs

CVEs scored 0-100 on exploitation, exposure, reach, severity and patch status. How the score works.

Severity
    Technology
      Ecosystem
        1. 196Memory corruption in V8 JavaScript engineGoogle Chrome prior to 54.0.2840.90 for Linux, and 54.0.284… · CVE-2016-5198KEVNo patch listed yetProvisionalAdded to KEV
        2. 295Crash or data corruption in TLS receive pathLinux · :linux_kernel: · CVE-2025-39682KEVFix availableAdded to KEV
        3. 394Remote command execution via authentication bypassIvanti Connect Secure · CVE-2026-104935KEVNo patch listed yetPublished
        4. 494Unauthenticated command injection as root in serverivanti Sentry · CVE-2026-10520KEVNo patch listed yetAdded to KEV
        5. 594Unauthenticated remote code execution in MDM serverIvanti Endpoint Manager Mobile · CVE-2026-1281KEVNo patch listed yetPublished
        6. 694Auth bypass in SAML single sign-on loginFortinet FortiSwitchManager · Fortinet FortiOS +1 · CVE-2025-59718KEVNo patch listed yetAdded to KEV
        7. 794Remote code execution in Reporting ServicesMicrosoft SQL Server · CVE-2020-0618KEVNo patch listed yetProvisionalAdded to KEV
        8. 894Remote code execution via out-of-bounds writeFortinet FortiOS · Fortinet FortiProxy · CVE-2024-21762KEVNo patch listed yetPublished
        9. 994Remote root takeover in web UICisco IOS XE Software · CVE-2023-20198KEVNo patch listed yetPublished
        10. 1093Source disclosure and code execution in mod_rewriteApache Software Foundation Apache HTTP Server · CVE-2024-38475KEVNo patch listed yetProvisionalAdded to KEV
        11. 1193Memory exhaustion in DVMRP via IGMP trafficCisco IOS XR Software · CVE-2020-3566KEVNo patch listed yetAdded to KEV
        12. 1293Remote memory exhaustion in DVMRPCisco IOS XR Software · CVE-2020-3569KEVNo patch listed yetAdded to KEV
        13. 1392Code execution via SQL injection in REST API batch endpointWordPress · CVE-2026-63030KEVExploit publicNucleiFix availableExploit published
        14. 1492Out-of-bounds write in decompression decoderGoogle Brotli · node +7 · CVE-2026-111497KEVExploit publicFix availableExploit published
        15. 1592Security check bypass via unvalidated Host headerKludex starlette · starlette · CVE-2026-48710KEVFix availableAdded to KEV
        16. 1692Malware in @tanstack/* npm packages steals credentials@tanstack arktype-adapter · @tanstack eslint-plugin-rou… +82 · CVE-2026-45321KEVFix availableAdded to KEV
        17. 1792Pre-auth remote code execution in server function endpointsMeta react-server-dom-webpack · Meta react-server-dom-tu… +4 · CVE-2025-55182KEVExploit publicNucleiFix availableExploit published
        18. 1892Sandbox escape in ANGLE and GPU componentsGoogle Chrome · CVE-2025-6558KEVFix availableAdded to KEV
        19. 1992Remote code execution in V8 JavaScript engineGoogle Chrome · CVE-2024-4947KEVFix availableAdded to KEV
        20. 2092Sandbox escape via use-after-free in VisualsGoogle Chrome · CVE-2024-4671KEVFix availableProvisionalAdded to KEV
        21. 2192Authentication bypass in web componentIvanti ICS · Ivanti IPS · CVE-2023-46805KEVNo patch listed yetPublished
        22. 2292Sandbox escape via integer overflow in SkiaGoogle Chrome · CVE-2023-6345KEVFix availableAdded to KEV
        23. 2392Sandbox escape from integer overflow in SkiaGoogle Chrome · CVE-2023-2136KEVFix availableAdded to KEV
        24. 2492Sandbox escape via heap overflow in GPU componentGoogle Chrome · electron · CVE-2022-4135KEVFix availableAdded to KEV
        25. 2592Sandbox escape in Mojo from insufficient data validationGoogle Chrome · CVE-2022-3075KEVFix availableProvisionalPublished
        26. 2692Remote code execution in JNDI lookupsApache Software Foundation Apache Log4j2 · org.apache.lo… +4 · CVE-2021-44228KEVExploit publicNucleiFix availableExploit published
        27. 2792Heap buffer overflow in FreeType font renderingGoogle Chrome · CefSharp.Common +3 · CVE-2020-15999KEVFix availableAdded to KEV
        28. 2892Sandbox escape via heap buffer overflow in UIGoogle Chrome · CVE-2020-16010KEVFix availableProvisionalAdded to KEV
        29. 2992Sandbox escape in site isolationGoogle Chrome · CefSharp.Common +3 · CVE-2020-16017KEVFix availableProvisionalAdded to KEV
        30. 3092Sandbox escape in Indexed DB APIGoogle Chrome · CVE-2021-30633KEVFix availableAdded to KEV
        31. 3192Sandbox escape via use-after-free in PortalsGoogle Chrome · CVE-2021-37973KEVFix availableAdded to KEV
        32. 3292Path traversal and file disclosure in URL alias handlingApache Software Foundation Apache HTTP Server · CVE-2021-41773KEVNo patch listed yetAdded to KEV
        33. 3391Remote code execution in V8 via out-of-bounds writeGoogle Chrome · CVE-2026-87491KEVFix availableProvisionalPublished
        34. 3491Remote code execution in V8 sandboxGoogle Chrome · CVE-2026-85046KEVFix availableProvisionalAdded to KEV
        35. 3591Auth bypass in MCP Streamable HTTP endpointBerriAI litellm · litellm · CVE-2026-59822KEVFix availableAdded to KEV
        36. 3691Remote code execution via DNS rebinding in browser checksray-project ray · ray · CVE-2025-62593KEVFix availableAdded to KEV
        37. 3791Out-of-bounds read in V8 enables sandboxed code executionGoogle Chrome · CVE-2026-11645KEVFix availableProvisionalAdded to KEV
        38. 3891SQL injection in Proxy API key verificationBerriAI litellm · litellm · CVE-2026-42208KEVFix availablePublished
        39. 3991Unauthenticated remote code execution via code injectionIvanti Endpoint Manager Mobile · CVE-2026-1340KEVNo patch listed yetProvisionalAdded to KEV
        40. 4091Code execution via use-after-free in DawnGoogle Chrome · CVE-2026-5281KEVFix availableProvisionalPublished
        41. 4191Memory corruption in Skia graphics libraryGoogle Chrome · CVE-2026-3909KEVFix availableProvisionalAdded to KEV
        42. 4291Remote code execution in V8 JavaScript engineGoogle Chrome · CVE-2026-3910KEVFix availableProvisionalAdded to KEV
        43. 4391Sandboxed code execution via CSS use-after-freeGoogle Chrome · CVE-2026-2441KEVFix availableProvisionalAdded to KEV
        44. 4491Out-of-bounds memory access in ANGLEGoogle Chrome · CVE-2025-14174KEVFix availableProvisionalPublished
        45. 4591Remote memory corruption in V8 via type confusionGoogle Chrome · CVE-2025-13223KEVFix availableProvisionalAdded to KEV
        46. 4691Memory corruption in V8 via type confusionGoogle Chrome · CVE-2025-10585KEVFix availableProvisionalPublished
        47. 4791Memory corruption in V8 from out-of-bounds readGoogle Chrome · CVE-2025-5419KEVFix availableProvisionalAdded to KEV
        48. 4891Unauthenticated remote code execution in gatewayIvanti Connect Secure · Ivanti Policy Secure +1 · CVE-2025-0282KEVExploit publicNo patch listed yetExploit published
        49. 4991Unauthenticated path traversal leaks data in file handlingIvanti Endpoint Manager · CVE-2024-13159KEVNo patch listed yetProvisionalAdded to KEV
        50. 5091Remote file disclosure via path traversalIvanti Endpoint Manager · CVE-2024-13160KEVNo patch listed yetProvisionalAdded to KEV