Top 10 CVEs of 2026
2026
Six data-derived top-10 lists for CVEs published or KEV-added in 2026. No editorial scoring; everything below is computed directly from the ingested corpus.
Top 10 most severe CVEs of 2026
Ranked by CVSS v3 base score, descending. Ties broken by KEV status, then EPSS score, then publish date.
| # | CVE | Severity | CVSS | KEV | Summary |
|---|---|---|---|---|---|
| 1 | CVE-2026-10520 | Critical | 10.0 | KEV | An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution |
| 2 | CVE-2026-48282 | Critical | 10.0 | KEV | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. |
| 3 | CVE-2026-20182 | Critical | 10.0 | KEV | May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. |
| 4 | CVE-2026-20127 | Critical | 10.0 | KEV | A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an u… |
| 5 | CVE-2026-34910 | Critical | 10.0 | KEV | A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. |
| 6 | CVE-2026-15409 | Critical | 10.0 | KEV | A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. |
| 7 | CVE-2026-34908 | Critical | 10.0 | KEV | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system. |
| 8 | CVE-2026-34909 | Critical | 10.0 | KEV | A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account. |
| 9 | CVE-2026-20131 | Critical | 10.0 | KEV | A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vuln… |
| 10 | CVE-2026-22769 | Critical | 10.0 | KEV | Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. |
Top 10 actively exploited CVEs of 2026
CVEs added to the CISA Known Exploited Vulnerabilities catalog during the year, newest first. Empty for pre-2021 years.
| # | CVE | Severity | CVSS | KEV | Added | Summary |
|---|---|---|---|---|---|---|
| 1 | CVE-2026-16812 | Critical | 10.0 | KEV | 2026-07-27 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. |
| 2 | CVE-2025-68686 | Medium | 5.9 | KEV | 2026-07-27 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all v… |
| 3 | CVE-2026-16232 | Critical | 9.8 | KEV | 2026-07-22 | An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. |
| 4 | CVE-2026-50522 | Critical | 9.8 | KEV | 2026-07-22 | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. |
| 5 | CVE-2026-63030 | Critical | 9.8 | KEV | 2026-07-21 | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Inje… |
| 6 | CVE-2026-60137 | Medium | 5.9 | KEV | 2026-07-21 | WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter. |
| 7 | CVE-2021-27137 | High | 8.1 | KEV | 2026-07-21 | An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. |
| 8 | CVE-2026-0770 | Critical | 9.8 | KEV | 2026-07-21 | Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. |
| 9 | CVE-2026-58644 | Critical | 9.8 | KEV | 2026-07-16 | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. |
| 10 | CVE-2026-25089 | Critical | 9.8 | KEV | 2026-07-16 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5… |
Top 10 highest-EPSS CVEs of 2026
FIRST.org Exploit Prediction Scoring System scores, descending. EPSS estimates the probability a CVE will be exploited in the next 30 days.
| # | CVE | Severity | CVSS | KEV | EPSS | Summary |
|---|---|---|---|---|---|---|
| 1 | CVE-2026-10520 | Critical | 10.0 | KEV | 0.999 | An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution |
| 2 | CVE-2026-33017 | Critical | 9.8 | KEV | 0.998 | Langflow is a tool for building and deploying AI-powered agents and workflows. |
| 3 | CVE-2026-48282 | Critical | 10.0 | KEV | 0.992 | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. |
| 4 | CVE-2026-63030 | Critical | 9.8 | KEV | 0.981 | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Inje… |
| 5 | CVE-2026-41940 | Critical | 9.8 | KEV | 0.979 | cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. |
| 6 | CVE-2026-24061 | Critical | 9.8 | KEV | 0.979 | telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable. |
| 7 | CVE-2026-34197 | High | 8.8 | KEV | 0.972 | Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. |
| 8 | CVE-2026-20253 | Critical | 9.8 | KEV | 0.962 | In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. |
| 9 | CVE-2026-23760 | Critical | 9.8 | KEV | 0.957 | SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. |
| 10 | CVE-2026-39987 | Critical | 9.8 | KEV | 0.953 | marimo is a reactive Python notebook. |
Top 10 most PoC-covered CVEs of 2026
Ranked by the count of indexed public proof-of-concept repositories. Higher counts correlate with weaponisation effort.
| # | CVE | Severity | CVSS | KEV | PoCs | Summary |
|---|---|---|---|---|---|---|
| 1 | CVE-2026-31431 | High | 7.8 | KEV | 359 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. |
| 2 | CVE-2026-43499 | High | 7.8 | — | 100 | In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_st… |
| 3 | CVE-2026-41940 | Critical | 9.8 | KEV | 90 | cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. |
| 4 | CVE-2026-63030 | Critical | 9.8 | KEV | 77 | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Inje… |
| 5 | CVE-2026-42945 | High | 8.1 | — | 54 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. |
| 6 | CVE-2026-23744 | Critical | 9.8 | — | 45 | MCPJam inspector is the local-first development platform for MCP servers. |
| 7 | CVE-2026-43284 | High | 8.8 | — | 41 | In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. |
| 8 | CVE-2026-41089 | Critical | 9.8 | — | 29 | Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network. |
| 9 | CVE-2026-24061 | Critical | 9.8 | KEV | 28 | telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable. |
| 10 | CVE-2026-64638 | — | — | — | 25 | WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with con… |
Top 10 most-vulnerable vendors of 2026
Vendors ranked by distinct CVE count for the year. Counts include every CVE attached to any product the vendor ships in our CPE map.
| # | Vendor | CVE count |
|---|---|---|
| 1 | Linux | 5417 |
| 2 | Microsoft | 3392 |
| 3 | 2377 | |
| 4 | Apple | 1822 |
| 5 | Oracle Corporation | 1553 |
| 6 | Oracle | 1501 |
| 7 | Red Hat | 649 |
| 8 | Openclaw | 588 |
Top 10 most-common CWEs of 2026
CWE classification ids ranked by the count of CVEs published in the year that carry them. Each CVE typically lists 1–3 CWE ids; counts reflect the union of those lists across the year's corpus.
| # | CWE | Name | CVE count |
|---|---|---|---|
| 1 | CWE-79 | Cross-site Scripting | 3927 |
| 2 | CWE-862 | Missing Authorization | 2289 |
| 3 | CWE-89 | SQL Injection | 2136 |
| 4 | CWE-284 | Improper Access Control | 1985 |
| 5 | CWE-416 | Use After Free | 1698 |
| 6 | CWE-22 | Path Traversal | 1616 |
| 7 | CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) | 1223 |
| 8 | CWE-78 | OS Command Injection | 1202 |
| 9 | CWE-20 | Improper Input Validation | 1192 |
| 10 | CWE-918 | Server-Side Request Forgery (SSRF) | 1174 |