CVE tracker
Every security flaw published as a CVE this year, with the most serious, the ones attackers are using and the ones most likely to be used next. Period: January to October 2026.
Our advisories are written automatically from the sources in plain English, with what to do. A Securelyn engineer reviews them when they can, and ones not yet reviewed are labelled. The CVE tracker is an automatic list of every CVE published in the National Vulnerability Database this year.
2026 in numbers
82,445
CVEs published in 2026
9,366
Critical (CVSS 9 or more)
34,008
High (CVSS 7 to 8.9)
186
Added to the CISA Known Exploited catalogue in 2026
189
With an EPSS of 10% or more
Published in the last 7 days
| CVE | Published | Severity | Vendor or product | EPSS | What it is |
|---|---|---|---|---|---|
| CVE-2024-4457 | 18 October 2026 | Not scored yet | – | – | The Management Console fails to properly validate input related to the configuration of JDBC user stores. |
| CVE-2026-104627 | 18 October 2026 | Not scored yet | – | – | The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion… |
| CVE-2026-105661 | 18 October 2026 | Not scored yet | – | – | Requesting `/{username}/-/repositories` for an individual user instead of an organization made the… |
| CVE-2026-105964 | 18 October 2026 | Not scored yet | – | – | The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. |
| CVE-2026-107436 | 18 October 2026 | High 8.8 | – | – | Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows… |
| CVE-2026-107618 | 18 October 2026 | Not scored yet | – | – | `POST /{owner}/{repo}/topics` was registered without the sign-in middleware that provides the cross-origin… |
| CVE-2026-107686 | 18 October 2026 | Not scored yet | – | – | The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues… |
| CVE-2026-108485 | 18 October 2026 | High 7.1 | – | – | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in… |
| CVE-2026-109553 | 18 October 2026 | Not scored yet | – | – | Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys… |
| CVE-2026-109844 | 18 October 2026 | Not scored yet | – | – | `GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without… |
| CVE-2026-109894 | 18 October 2026 | Critical 9.3 | – | – | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in… |
| CVE-2026-109895 | 18 October 2026 | High 7.1 | – | – | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in… |
| CVE-2026-109937 | 18 October 2026 | Medium 5.4 | – | 0.1% | The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to… |
| CVE-2026-110024 | 18 October 2026 | Medium 6.8 | – | – | @fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify… |
| CVE-2026-110026 | 18 October 2026 | Medium 4.9 | – | 0.1% | The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when… |
| CVE-2026-110031 | 18 October 2026 | High 7.2 | – | 0.1% | The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon… |
| CVE-2026-110032 | 18 October 2026 | Medium 5.5 | – | 0.1% | The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon… |
| CVE-2026-110033 | 18 October 2026 | Medium 6.8 | – | 0.2% | The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before… |
| CVE-2026-110035 | 18 October 2026 | Medium 4.3 | – | 0.1% | The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to… |
| CVE-2026-110069 | 18 October 2026 | Medium 4.3 | – | 0.1% | The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or… |
| CVE-2026-110070 | 18 October 2026 | Medium 6.5 | – | 0.1% | The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to… |
| CVE-2026-110311 | 18 October 2026 | Not scored yet | – | – | Creating a draft release through the API returned an `assets` list that was built from a release without an… |
| CVE-2026-110324 | 18 October 2026 | Not scored yet | – | – | The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}`… |
| CVE-2026-110365 | 18 October 2026 | Medium 6.5 | – | – | Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows… |
| CVE-2026-110372 | 18 October 2026 | Critical 9.8 | – | – | Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege… |
| CVE-2026-110373 | 18 October 2026 | High 8.1 | – | – | Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number… |
| CVE-2026-110382 | 18 October 2026 | High 7.1 | – | – | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in… |
| CVE-2026-110383 | 18 October 2026 | High 7.5 | – | – | Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on… |
| CVE-2026-110494 | 18 October 2026 | Not scored yet | – | – | Adding attachments to a release checked the repository and release of an attachment but not whether it was… |
| CVE-2026-110880 | 18 October 2026 | Medium 6.5 | – | – | Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting… |
| CVE-2026-110883 | 18 October 2026 | Medium 6.5 | – | – | Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat… |
| CVE-2026-110885 | 18 October 2026 | Medium 6.5 | – | – | Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress… |
| CVE-2026-110886 | 18 October 2026 | Critical 9.8 | – | – | Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot… |
| CVE-2026-110895 | 18 October 2026 | High 8.5 | – | – | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in… |
| CVE-2026-110897 | 18 October 2026 | High 7.1 | – | – | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in… |
| CVE-2026-110976 | 18 October 2026 | Medium 4.9 | – | 0.1% | The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions… |
| CVE-2026-110981 | 18 October 2026 | High 7.1 | – | 0.2% | The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation… |
| CVE-2026-111041 | 18 October 2026 | Medium 4.9 | – | 0.1% | The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media… |
| CVE-2026-111866 | 18 October 2026 | Medium 6.9 | – | 0.4% | A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4. |
| CVE-2026-111868 | 18 October 2026 | Low 2.1 | – | 0.2% | A vulnerability was determined in datastax pulsar-jms up to 9.0.3. |
| CVE-2026-111869 | 18 October 2026 | Medium 5.5 | – | 0.5% | A vulnerability was identified in makeplane plane up to 1.4.2. |
| CVE-2026-111870 | 18 October 2026 | Medium 5.5 | – | 0.4% | A security flaw has been discovered in itsmeravitejak Online-Examination-System up to… |
| CVE-2026-111871 | 18 October 2026 | Medium 5.5 | – | 0.3% | A weakness has been identified in itsmeravitejak Online-Examination-System up to… |
| CVE-2026-111872 | 18 October 2026 | Medium 5.5 | – | 0.3% | A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to… |
| CVE-2026-111873 | 18 October 2026 | Medium 5.5 | – | 0.3% | A vulnerability was detected in itsmeravitejak Online-Examination-System up to… |
| CVE-2026-111874 | 18 October 2026 | Low 2.9 | – | 0.5% | A flaw has been found in OpenCATS 0.10.0. Affected is the function processLogin of the file… |
| CVE-2026-111875 | 18 October 2026 | Low 2.0 | – | 0.2% | A vulnerability has been found in David-Crty Databasement up to 1.8.1. |
| CVE-2026-111876 | 18 October 2026 | Low 1.9 | – | 0.6% | A vulnerability was found in alexpasmantier television up to 0.15.9. |
| CVE-2026-111877 | 18 October 2026 | Low 2.1 | – | 0.3% | A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. |
| CVE-2026-111942 | 18 October 2026 | Low 2.1 | – | 0.3% | A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0. |
Critical this month
| CVE | Published | Severity | Vendor or product | EPSS | What it is |
|---|---|---|---|---|---|
| CVE-2026-109894 | 18 October 2026 | Critical 9.3 | – | – | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in… |
| CVE-2026-110372 | 18 October 2026 | Critical 9.8 | – | – | Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege… |
| CVE-2026-110886 | 18 October 2026 | Critical 9.8 | – | – | Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot… |
| CVE-2026-111998 | 18 October 2026 | Critical 9.3 | – | – | Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote… |
| CVE-2026-112005 | 18 October 2026 | Critical 9.2 | – | – | WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read… |
| CVE-2026-104736 | 17 October 2026 | Critical 9.8 | – | 0.4% | The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including… |
| CVE-2026-110653 | 17 October 2026 | Critical 9.1 | – | 0.4% | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is… |
| CVE-2026-111823 | 17 October 2026 | Critical 9.8 | – | 0.4% | Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth… |
| CVE-2026-111911 | 17 October 2026 | Critical 9.3 | – | 0.4% | phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration… |
| CVE-2026-102551 | 16 October 2026 | Critical 9.2 | – | 0.3% | Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in… |
| CVE-2026-102608 | 16 October 2026 | Critical 9.0 | – | 0.3% | ZoneMinder is a free, open source closed-circuit television software application. |
| CVE-2026-102692 | 16 October 2026 | Critical 9.1 | – | 0.4% | RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other… |
| CVE-2026-102693 | 16 October 2026 | Critical 9.6 | – | 0.2% | RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other… |
| CVE-2026-103768 | 16 October 2026 | Critical 9.8 | – | 0.6% | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File… |
| CVE-2026-104730 | 16 October 2026 | Critical 9.8 | – | 0.5% | The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is… |
| CVE-2026-104798 | 16 October 2026 | Critical 9.8 | – | 0.9% | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all… |
| CVE-2026-105279 | 16 October 2026 | Critical 9.3 | – | 0.2% | In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. |
| CVE-2026-107617 | 16 October 2026 | Critical 9.3 | – | 0.3% | An attacker can use a hard-coded credential to log in to EseeCloud devices. |
| CVE-2026-109219 | 16 October 2026 | Critical 9.8 | – | 0.7% | The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and… |
| CVE-2026-109515 | 16 October 2026 | Critical 9.8 | – | 0.4% | The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. |
| CVE-2026-109587 | 16 October 2026 | Critical 9.3 | – | 0.1% | Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and… |
| CVE-2026-109588 | 16 October 2026 | Critical 9.3 | – | 0.1% | Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and… |
| CVE-2026-111391 | 16 October 2026 | Critical 9.2 | – | 0.5% | SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows… |
| CVE-2026-111444 | 16 October 2026 | Critical 9.8 | – | 0.3% | Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled… |
| CVE-2026-111472 | 16 October 2026 | Critical 9.3 | – | 0.2% | An SQL injection vulnerability has been discovered in TSG Profleet. |
Added to the Known Exploited catalogue in 2026
| CVE | Added to KEV | Severity | Vendor or product | EPSS | What it is |
|---|---|---|---|---|---|
| CVE-2026-102764 KEV | 16 October 2026 | Critical 9.3 | beyondtrust remote support | 1.2% | The vulnerability exists within internal components of BeyondTrust’s Remote Support product. |
| CVE-2025-61624 KEV | 16 October 2026 | Medium 6.5 | fortinet fortios | 1.1% | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in… |
| CVE-2026-0322 KEV | 14 October 2026 | High 8.6 | paloaltonetworks pan-os | 1.2% | A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS®… |
| CVE-2026-76519 KEV | 14 October 2026 | Critical 9.8 | cisco asyncos | 1.6% | A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow… |
| CVE-2026-105133 KEV | 14 October 2026 | Medium 5.5 | ahsay cloud backup suite | 0.9% | A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2. |
| CVE-2026-105134 KEV | 14 October 2026 | Critical 9.3 | ahsay cloud backup suite | 4.8% | A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file… |
| CVE-2026-104935 KEV | 13 October 2026 | High 8.6 | ivanti connect secure | 26% | Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to… |
| CVE-2026-96951 KEV | 13 October 2026 | High 8.8 | microsoft outlook web | 1.5% | Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows… |
| CVE-2026-88779 KEV | 4 October 2026 | High 8.7 | citrix netscaler application delivery controller | 0.6% | Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before… |
| CVE-2026-102489 KEV | 2 October 2026 | Critical 9.4 | zammad | 1.3% | Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code… |
| CVE-2026-102490 KEV | 2 October 2026 | Critical 9.4 | zammad | 0.5% | Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had… |
| CVE-2026-104286 KEV | 1 October 2026 | Critical 9.8 | fortinet fortimail | 2.2% | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet… |
| CVE-2026-76504 KEV | 30 September 2026 | Critical 9.8 | cisco catalyst sd-wan manager | 1.8% | A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could… |
| CVE-2026-86950 KEV | 29 September 2026 | High 8.8 | apple ipados | 1.2% | An out-of-bounds write issue was addressed with improved bounds checking. |
| CVE-2026-88771 KEV | 27 September 2026 | Critical 9.5 | citrix netscaler application delivery controller | 1.1% | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. |
| CVE-2026-88772 KEV | 27 September 2026 | Critical 9.5 | citrix netscaler application delivery controller | 1.3% | Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. |
| CVE-2026-87902 KEV | 25 September 2026 | High 8.1 | wordpress | 40% | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen… |
| CVE-2026-67279 KEV | 25 September 2026 | Medium 6.9 | mikrotik routeros | 1.0% | RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication… |
| CVE-2026-65660 KEV | 25 September 2026 | High 8.8 | microsoft sharepoint server | 2.1% | Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an… |
| CVE-2026-71362 KEV | 24 September 2026 | Critical 9.1 | adobe commerce | 88% | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege… |
| CVE-2026-5430 KEV | 24 September 2026 | Critical 10.0 | wso2 api control plane | 0.6% | The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly… |
| CVE-2026-93616 KEV | 22 September 2026 | Critical 9.8 | checkpoint multi-domain security management | 76% | A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute… |
| CVE-2026-93952 KEV | 22 September 2026 | Critical 9.5 | arista velocloud orchestrator | 1.1% | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to… |
| CVE-2026-94127 KEV | 22 September 2026 | Critical 9.3 | f5 big-ip access policy manager | 2.2% | When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious… |
| CVE-2026-85102 KEV | 22 September 2026 | Critical 9.8 | checkpoint gaia embedded | 50% | Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may… |
Most exploitable by EPSS
| CVE | Published | Severity | Vendor or product | EPSS | What it is |
|---|---|---|---|---|---|
| CVE-2026-10520 KEV | 9 June 2026 | Critical 10.0 | ivanti standalone sentry | 100% | An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions… |
| CVE-2026-24061 KEV | 21 January 2026 | Critical 9.8 | gnu inetutils | 99% | telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER… |
| CVE-2026-1281 KEV | 29 January 2026 | Critical 9.8 | ivanti endpoint manager mobile | 99% | A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code… |
| CVE-2026-1340 KEV | 29 January 2026 | Critical 9.8 | ivanti endpoint manager mobile | 99% | A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code… |
| CVE-2026-41940 KEV | 29 April 2026 | Critical 9.3 | cpanel | 99% | cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that… |
| CVE-2026-72898 KEV | 10 August 2026 | Critical 10.0 | metabase | 97% | Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password'… |
| CVE-2026-20253 KEV | 10 June 2026 | Critical 9.8 | splunk | 97% | In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could… |
| CVE-2026-0257 KEV | 13 May 2026 | High 7.8 | paloaltonetworks pan-os | 97% | Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS®… |
| CVE-2026-35273 KEV | 11 June 2026 | Critical 9.8 | oracle peoplesoft enterprise peopletools | 97% | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates… |
| CVE-2026-23760 KEV | 22 January 2026 | Critical 9.3 | smartertools smartermail | 96% | SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the… |
| CVE-2026-43284 | 8 May 2026 | High 8.8 | linux kernel | 94% | In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on… |
| CVE-2026-21643 KEV | 6 February 2026 | Critical 9.8 | fortinet forticlientems | 94% | An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in… |
| CVE-2026-85706 KEV | 12 September 2026 | Critical 10.0 | gitlab | 93% | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before… |
| CVE-2026-42271 KEV | 8 May 2026 | High 8.7 | litellm | 93% | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. |
| CVE-2026-1731 KEV | 6 February 2026 | Critical 9.9 | beyondtrust privileged remote access | 92% | BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a… |
The trend
| Month | CVEs |
|---|---|
| January 2026 | 4302 |
| February 2026 | 4616 |
| March 2026 | 6234 |
| April 2026 | 5810 |
| May 2026 | 6936 |
| June 2026 | 7942 |
| July 2026 | 9770 |
| August 2026 | 12258 |
| September 2026 | 14936 |
| October 2026 | 9641 |
| Severity | CVEs |
|---|---|
| Critical | 9366 |
| High | 34008 |
| Medium | 30477 |
| Low | 5593 |
| Not scored yet | 3001 |
Vendors with the most CVEs in 2026
| Vendor | CVEs | Bar |
|---|---|---|
| 3,732 | ||
| microsoft | 3,461 | |
| linux | 3,024 | |
| oracle | 2,728 | |
| ibm | 1,066 | |
| adobe | 889 | |
| apache | 809 | |
| apple | 801 | |
| openclaw | 575 | |
| mozilla | 572 |
Most common weaknesses (CWE)
| Weakness | CVEs | Bar |
|---|---|---|
| Cross-site scripting (CWE-79) | 7,325 | |
| Missing authorisation (CWE-862) | 4,433 | |
| CWE-284 | 3,890 | |
| SQL injection (CWE-89) | 3,850 | |
| Use after free (CWE-416) | 2,862 | |
| Path traversal (CWE-22) | 2,759 | |
| Out-of-bounds read (CWE-125) | 2,223 | |
| Incorrect authorisation (CWE-863) | 2,033 | |
| OS command injection (CWE-78) | 2,008 | |
| Server-side request forgery (CWE-918) | 1,989 |
Where this comes from
- CVE records, scores and weaknesses: the NIST National Vulnerability Database (NVD). As at 18 October 2026.
- Known exploited flaws: the CISA Known Exploited Vulnerabilities catalogue. As at 18 October 2026.
- Exploitation probability: FIRST EPSS. As at 18 October 2026.