Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

This feed covers the vulnerability. Panop covers your exposure to it.

How Panop validates exposure

CVE monitoring

  • The CVE, its CVSS score and the vendor's fix
  • Whether CISA has seen it exploited in the wild
  • Whether exploit code is public

Panop, in your environment

  • Whether you run the affected software, and where
  • Whether an attacker can actually reach and exploit it
  • The misconfigurations that never get a CVE number
  • What it would cost the business, ranked into what to fix first

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 1 of 125

  • 9.8 /10 Critical
    CVE-2026-111444 PoC publicNo auth

    Wheels - SQL Injection

    Wheels 4.1.2 contains a SQL injection caused by improper handling of backslash escaping in inline-literal paths, letting attackers alter queries via crafted input, exploit requires parameterize=false or unbound query parts.

  • 9.3 /10 Critical
    CVE-2026-111472 No auth

    TSG Profleet - SQL Injection

    TSG Profleet contains an SQL injection caused by unsanitized 'Identificación' parameter in /cgi-bin/index.php, letting attackers retrieve, create, update, and delete database data remotely, exploit requires crafted GET request.

  • 10.0 /10 Critical
    CVE-2026-94169 No auth

    Theme-one The Grid - Command Injection

    Theme-one The Grid <= 2.8.1 contains a command injection caused by improper control of code generation, letting attackers execute arbitrary commands remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-89079 No auth

    Theme My Login WordPress Plugin - Privilege Escalation

    Theme My Login WordPress plugin <= 7.2.1 contains a privilege escalation caused by improper user identity validation before password update, letting unauthenticated attackers change arbitrary user passwords on multi-site setups, exploit requires specific multi-site configuration.

  • 9.8 /10 Critical
    CVE-2026-104730 No auth

    Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers - Insecure Deserialization

    Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers WordPress plugin <= 3.7.4 contains a PHP Object Injection caused by deserialization of untrusted input, letting unauthenticated attackers inject PHP objects if a POP chain is present in other plugins/themes, exploit requires presence of a POP chain in other installed plugins or themes.

  • 9.8 /10 Critical
    CVE-2026-104798 No auth

    My Calendar – Accessible Event Manager - Privilege Escalation

    My Calendar – Accessible Event Manager WordPress plugin <= 3.8.7 contains a privilege escalation caused by unsanitized 'mcs' GET parameter allowing unauthenticated attackers to invoke arbitrary PHP functions, letting attackers gain full admin access, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-109219 No auth

    Mang Board WordPress Plugin - Unrestricted File Upload

    Mang Board WordPress plugin <= 2.4.4 contains an arbitrary file upload vulnerability caused by missing file extension validation in mbw_file_upload function, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit requires guest posts enabled.

  • 9.8 /10 Critical
    CVE-2026-109515 No auth

    MailOptin WordPress Plugin - Privilege Escalation

    MailOptin WordPress plugin <= 1.2.78.6 contains a privilege escalation caused by lack of allow-list validation on optin_data[form_custom_field_mappings] in subscribe_to_email_list endpoint, letting unauthenticated attackers overwrite any user password and take over accounts, exploit requires a published WordPress User Registration opt-in form.

  • 9.3 /10 Critical
    CVE-2026-94388 No auth

    halfdata Green Popups - SQL Injection

    halfdata Green Popups < 7.6.3 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted SQL payload.

  • 9.8 /10 Critical
    CVE-2026-103768 No auth

    ELEX WordPress HelpDesk & Customer Ticketing System - Unrestricted File Upload

    ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress <= 3.3.7 contains an unrestricted file upload vulnerability caused by insufficient file type validation in the initMailPart function, letting unauthenticated attackers upload executable files and achieve remote code execution.

  • 10.0 /10 Critical
    CVE-2026-110958 PoC publicNo auth

    Wavlink WN530HG4B - Buffer Overflow

    Wavlink WN530HG4B M30HG4B_V260724 contains a heap-based buffer overflow caused by improper handling in api.cgi, letting remote attackers execute arbitrary code, exploit requires no special conditions.

  • 9.1 /10 Critical
    CVE-2026-55240 Auth required

    Tianji - Server-Side Template Injection

    Tianji < 1.31.29 contains a server-side template injection caused by unsafe use of lodash template() with default evaluate pattern in survey and monitor templates, letting workspace administrators execute arbitrary server-side JavaScript via public survey.submit endpoint, exploit requires workspace administrator to store malicious template.

  • 9.4 /10 Critical
    CVE-2026-105474 Auth required

    SolusVM - Server-Side Template Injection

    SolusVM <= 2.0.0-44576 contains a server-side template injection caused by improper input handling, letting remote authenticated users execute arbitrary code as root, exploit requires user authentication.

  • 9.3 /10 Critical
    CVE-2026-47218 No auth

    runwasi containerd-shim-wasmtime-v1 - Remote Code Execution

    runwasi containerd-shim-wasmtime-v1 < 0.6.1 contains a remote code execution caused by trusting and deserializing precompiled Wasmtime bytes from OCI image layers, letting attackers execute native code in the shim process, exploit requires victim to run crafted image.

  • 9.9 /10 Critical
    CVE-2026-57155 PoC publicAuth required

    OPNsense - Path Traversal & Remote Code Execution

    OPNsense < 26.1.11 contains a path traversal in Firewall Alias GeoIP importer's process_zip() and process_gzip() caused by unvalidated CSV country_code, letting attackers with Firewall Alias Edit privilege write files as root and execute commands, exploit requires Firewall Alias Edit privilege.