Top 10 CVEs of 2026
2026
Six data-derived top-10 lists for CVEs published or KEV-added in 2026. No editorial scoring; everything below is computed directly from the ingested corpus.
Top 10 most severe CVEs of 2026
Ranked by CVSS v3 base score, descending. Ties broken by KEV status, then EPSS score, then publish date.
| # | CVE | Severity | CVSS | KEV | Summary |
|---|---|---|---|---|---|
| 1 | CVE-2026-10520 | Critical | 10.0 | KEV | An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution |
| 2 | CVE-2026-20182 | Critical | 10.0 | KEV | May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed in February 2026. |
| 3 | CVE-2026-85706 | Critical | 10.0 | KEV | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user cou… |
| 4 | CVE-2026-20127 | Critical | 10.0 | KEV | A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBond, could allow an u… |
| 5 | CVE-2026-20079 | Critical | 10.0 | KEV | A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to… |
| 6 | CVE-2026-21962 | Critical | 10.0 | KEV | Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for Apache HTTP Server, Weblogic Server Proxy Plug-in for IIS). |
| 7 | CVE-2026-34910 | Critical | 10.0 | KEV | A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. |
| 8 | CVE-2026-20131 | Critical | 10.0 | KEV | A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vuln… |
| 9 | CVE-2026-48282 | Critical | 10.0 | KEV | ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution in the context of the current user. |
| 10 | CVE-2026-72898 | Critical | 10.0 | KEV | Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance. |
Top 10 actively exploited CVEs of 2026
CVEs added to the CISA Known Exploited Vulnerabilities catalog during the year, newest first. Empty for pre-2021 years.
| # | CVE | Severity | CVSS | KEV | Added | Summary |
|---|---|---|---|---|---|---|
| 1 | CVE-2026-86950 | High | 8.8 | KEV | 2026-09-29 | An out-of-bounds write issue was addressed with improved bounds checking. |
| 2 | CVE-2026-88772 | High | 8.1 | KEV | 2026-09-27 | Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. |
| 3 | CVE-2026-88771 | Critical | 9.8 | KEV | 2026-09-27 | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. |
| 4 | CVE-2026-87902 | High | 8.1 | KEV | 2026-09-25 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. |
| 5 | CVE-2026-67279 | Medium | 6.5 | KEV | 2026-09-25 | RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. |
| 6 | CVE-2026-65660 | High | 8.8 | KEV | 2026-09-25 | Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
| 7 | CVE-2026-71362 | Critical | 9.1 | KEV | 2026-09-24 | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. |
| 8 | CVE-2026-5430 | Critical | 10.0 | KEV | 2026-09-24 | The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. |
| 9 | CVE-2026-94127 | Critical | 9.8 | KEV | 2026-09-22 | When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). |
| 10 | CVE-2026-93616 | Critical | 9.8 | KEV | 2026-09-22 | A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server. |
Top 10 highest-EPSS CVEs of 2026
FIRST.org Exploit Prediction Scoring System scores, descending. EPSS estimates the probability a CVE will be exploited in the next 30 days.
| # | CVE | Severity | CVSS | KEV | EPSS | Summary |
|---|---|---|---|---|---|---|
| 1 | CVE-2026-10520 | Critical | 10.0 | KEV | 0.999 | An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution |
| 2 | CVE-2026-24061 | Critical | 9.8 | KEV | 0.990 | telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable. |
| 3 | CVE-2026-1281 | Critical | 9.8 | KEV | 0.987 | A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. |
| 4 | CVE-2026-1340 | Critical | 9.8 | KEV | 0.986 | A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution. |
| 5 | CVE-2026-41940 | Critical | 9.8 | KEV | 0.985 | cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. |
| 6 | CVE-2026-20253 | Critical | 9.8 | KEV | 0.969 | In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. |
| 7 | CVE-2026-23760 | Critical | 9.8 | KEV | 0.965 | SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. |
| 8 | CVE-2026-0257 | Critical | 9.1 | KEV | 0.964 | Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection. |
| 9 | CVE-2026-21643 | Critical | 9.8 | KEV | 0.937 | An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted… |
| 10 | CVE-2026-42271 | High | 8.8 | KEV | 0.926 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. |
Top 10 most PoC-covered CVEs of 2026
Ranked by the count of indexed public proof-of-concept repositories. Higher counts correlate with weaponisation effort.
| # | CVE | Severity | CVSS | KEV | PoCs | Summary |
|---|---|---|---|---|---|---|
| 1 | CVE-2026-31431 | High | 7.8 | KEV | 368 | In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. |
| 2 | CVE-2026-43499 | High | 7.8 | — | 182 | In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_st… |
| 3 | CVE-2026-41940 | Critical | 9.8 | KEV | 99 | cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. |
| 4 | CVE-2026-63030 | Critical | 9.8 | KEV | 88 | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Inje… |
| 5 | CVE-2026-24061 | Critical | 9.8 | KEV | 80 | telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable. |
| 6 | CVE-2026-42945 | High | 8.1 | — | 55 | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. |
| 7 | CVE-2026-23744 | Critical | 9.8 | — | 49 | MCPJam inspector is the local-first development platform for MCP servers. |
| 8 | CVE-2026-43284 | High | 8.8 | — | 47 | In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. |
| 9 | CVE-2026-41089 | Critical | 9.8 | — | 35 | Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network. |
| 10 | CVE-2026-33017 | Critical | 9.8 | KEV | 30 | Langflow is a tool for building and deploying AI-powered agents and workflows. |
Top 10 most-vulnerable vendors of 2026
Vendors ranked by distinct CVE count for the year. Counts include every CVE attached to any product the vendor ships in our CPE map.
| # | Vendor | CVE count |
|---|---|---|
| 1 | Linux | 8053 |
| 2 | Microsoft | 4432 |
| 3 | 3390 | |
| 4 | Oracle Corporation | 3049 |
| 5 | Oracle | 2705 |
| 6 | Apple | 2114 |
| 7 | IBM | 1019 |
| 8 | Red Hat | 989 |
Top 10 most-common CWEs of 2026
CWE classification ids ranked by the count of CVEs published in the year that carry them. Each CVE typically lists 1–3 CWE ids; counts reflect the union of those lists across the year's corpus.
| # | CWE | Name | CVE count |
|---|---|---|---|
| 1 | CWE-79 | Cross-site Scripting | 5356 |
| 2 | CWE-284 | Improper Access Control | 3653 |
| 3 | CWE-862 | Missing Authorization | 3345 |
| 4 | CWE-89 | SQL Injection | 2828 |
| 5 | CWE-416 | Use After Free | 2288 |
| 6 | CWE-22 | Path Traversal | 2234 |
| 7 | CWE-918 | Server-Side Request Forgery (SSRF) | 1701 |
| 8 | CWE-125 | Out-of-bounds Read | 1687 |
| 9 | CWE-78 | OS Command Injection | 1687 |
| 10 | CWE-200 | Information Disclosure | 1633 |