Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

This feed covers the vulnerability. Panop covers your exposure to it.

How Panop validates exposure

CVE monitoring

  • The CVE, its CVSS score and the vendor's fix
  • Whether CISA has seen it exploited in the wild
  • Whether exploit code is public

Panop, in your environment

  • Whether you run the affected software, and where
  • Whether an attacker can actually reach and exploit it
  • The misconfigurations that never get a CVE number
  • What it would cost the business, ranked into what to fix first

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 1 of 166

  • Critical

    Linux Kernel TCP/IP RCE: Internet-Wide Scanning for CVE-2026-98432

    CVE-2026-98432 is a critical use-after-free in the Linux kernel's IPv4 TCP path. Threat actors are already scanning for exposed MPTCP listeners.

  • 9.8 /10 Critical
    CVE-2026-120534

    Advanced Custom Fields Extended PRO - Code Injection

    Advanced Custom Fields: Extended PRO for WordPress <= 0.9.2.6 contains a limited code injection caused by insufficient validation of form configuration parameters in render_field, letting unauthenticated attackers call arbitrary WordPress functions, exploit requires shortcode_preview enabled or lack of OpenSSL.

  • 9.1 /10 Critical
    CVE-2026-120518

    BuddyPress XProfile Image Field - Arbitrary File Deletion

    BuddyPress XProfile Image Field plugin for WordPress <= 3.1.0 contains an arbitrary file deletion vulnerability caused by unsafe unlink() calls on visitor-supplied signup metadata, letting unauthenticated attackers delete arbitrary files, exploit requires open registration and image-type profile field on signup form.

  • 9.4 /10 Critical
    CVE-2026-97718 No auth

    Secure Access server - Cross-Site Request Forgery

    Secure Access server 14.60 contains a cross-site request forgery caused by bypassed security control, letting attackers cause an admin to create an account under attacker control, exploit requires admin interaction.

  • 9.1 /10 Critical
    CVE-2026-94290 Auth required

    SUSE Rancher Fleet - Broken Access Control

    SUSE Rancher Fleet 0.13.0 to 0.16.3 contains a broken access control vulnerability caused by insufficient restriction on kubeconfig secret references, letting ordinary users escalate privileges to manage the cluster with administrative credentials.

  • 9.1 /10 Critical
    CVE-2026-88811 No auth

    SUSE Rancher Manager - Information Disclosure

    SUSE Rancher Manager 2.13.0 to 2.13.11, 2.14.0 to 2.14.7, and 2.15.0 to 2.15.3 contains an information disclosure vulnerability caused by missing filtering in the meta proxy, letting attackers leak rancher credentials to cloud providers, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-86596 CISA KEVPoC publicNo auth

    s2Member WordPress plugin - Remote Code Execution

    s2Member WordPress plugin <= 260927 contains a remote code execution caused by insufficient sanitization in strip_php_tags_deep() and post-interpolation placeholder cleanup in 'item_name' parameter, letting authenticated attackers with custom-level access execute code on the server.

  • 9.8 /10 Critical
    CVE-2026-77876 No auth

    Control Web Panel - Command Injection

    Control Web Panel (CWP) < 1.16 contains a command injection caused by unescaped input in the protected_directory user panel module's file POST parameter in acc=deletedp action, letting attackers execute arbitrary commands in user panel context, exploit requires crafted POST request.

  • 9.1 /10 Critical
    CVE-2026-73696 No auth

    Control Web Panel - Authentication Bypass

    Control Web Panel (CWP) < 1.12 contains an execution after redirect vulnerability caused by missing exit() after redirect in user panel authentication flow, letting attackers with valid hosting usernames bypass authentication and execute code, exploit requires valid hosting username.

  • 9.4 /10 Critical
    CVE-2026-120446 No auth

    madong-admin-saas - Authentication Bypass

    madong-admin-saas <= 5.1.4 contains a broken authentication caused by 'platformapi' middleware key mismatch in platform tenant management API, letting unauthenticated remote attackers manage tenants and subscription plans.

  • 9.8 /10 Critical
    CVE-2026-120442

    ape-volo-admin - Authentication Bypass

    ape-volo-admin < 3.6.1 contains an authentication bypass caused by a hardcoded JWT signing key in appsettings.json, letting unauthenticated attackers forge administrator tokens and gain full API control, exploit requires knowledge of the hardcoded key.

  • 10.0 /10 Critical
    CVE-2026-120345 No auth

    WAVLINK WN551X3-A - Command Injection

    WAVLINK WN551X3-A M51X3_V251020-WO-182e965 contains a command injection caused by manipulation of the "data" argument in /bin/ioos DNS Resolution Handler, letting remote attackers execute arbitrary OS commands, exploit requires crafted input.

  • 10.0 /10 Critical
    CVE-2026-120344 No auth

    WAVLINK WN551X3-A - Command Injection

    WAVLINK WN551X3-A M51X3_V251020-WO-182e965 contains a command injection caused by manipulation of the "group_name" argument in /bin/ioos WireGuard CLI Group Handler, letting remote attackers execute arbitrary OS commands, exploit requires network access.

  • 9.9 /10 Critical
    CVE-2026-120322 Auth required

    Termix-SSH Termix - Path Traversal

    Termix-SSH Termix <= 2.9.2 contains a path traversal caused by manipulation of the "destPath" argument in /plugin-api/file-manager/transferToHost, letting remote attackers access arbitrary file paths, exploit requires no special privileges.

  • 10.0 /10 Critical
    CVE-2026-120283 No auth

    Linksys E8450 - Buffer Overflow

    Linksys E8450 1.2.00.360516 contains a stack-based buffer overflow caused by improper handling of the "hidden_timezone" argument in /www/cgi-bin/portal.cgi, letting remote attackers execute code remotely, exploit requires crafted request.