Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 10 of 166

  • 9.8 /10 Critical
    CVE-2026-54856 No auth

    RexCoin - PHP Object Injection

    RexCoin <= 1.2.6 contains an unauthenticated PHP Object Injection caused by improper handling of serialized objects, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-42922 No auth

    FUXA - Authorization Bypass

    FUXA 1.3.2-2809 contains an authorization bypass caused by improper access control in /nodered functionality, letting unauthenticated attackers execute arbitrary code remotely, exploit requires crafted HTTP request.

  • 9.9 /10 Critical
    CVE-2026-119145 Auth required

    Frappe - Path Traversal

    Frappe < 15.121.0 and 16.x < 16.34.0 contain a path traversal caused by improper validation of destination path in file-upload handling, letting authenticated attackers achieve remote code execution by uploading crafted files outside intended directories.

  • 9.2 /10 Critical
    CVE-2026-118769 No auth

    Botan - Buffer Overflow

    Botan 2.1.0 to 3.13.0 contains a buffer overflow caused by unchecked conversion of block size from size_t to int in botan_block_cipher_block_size function, letting attackers cause memory corruption via crafted algorithm parameters in raw ECB mode, exploit requires use of FFI raw ECB mode with external algorithm parameters.

  • 9.3 /10 Critical
    CVE-2026-118762 No auth

    Monkeytype - Remote Code Execution

    Monkeytype < 26.43.0 contains a remote code execution caused by elevated GITHUB_TOKEN persistence in CI workflow on pull_request_target, letting external contributors execute arbitrary code and modify repository content, exploit requires pull request with format label.

  • 9.3 /10 Critical
    CVE-2026-115964 No auth

    StylemixThemes Motors - SQL Injection

    StylemixThemes Motors motors-car-dealership-classified-listings <= 1.4.126 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.

  • 9.3 /10 Critical
    CVE-2026-114358 No auth

    Radius Xenia M2M Platform - SQL Injection

    Radius Xenia M2M Platform contains a SQL injection caused by insufficient validation of user input in the password recovery functionality, letting unauthenticated remote attackers access or modify database records.

  • 9.2 /10 Critical
    CVE-2026-112256 No auth

    OpenText Advanced Authentication Server - Broken Access Control

    OpenText Advanced Authentication Server 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, and 6.6.0.0 through 6.6.1.0 contains an access control vulnerability caused by acceptance of extraneous untrusted data with trusted data, letting attackers access functionality not properly constrained by ACLs, exploit requires no special conditions.

  • 9.3 /10 Critical
    CVE-2026-111732

    P-Net - Buffer Overflow

    P-Net before 1.0.3 contains a buffer overflow caused by improper length parsing in ARVendorBlock request when PNET_OPTION_AR_VENDOR_BLOCKS is enabled, letting attackers cause denial of service or remote code execution, exploit requires this option enabled.

  • 9.8 /10 Critical
    CVE-2026-110186 No auth

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.12.8 contains a remote code execution caused by improper control of code generation, letting remote attackers execute arbitrary code, exploit requires no special conditions.

  • 9.8 /10 Critical
    CVE-2026-109516 No auth

    WooCommerce Bot for Telegram - Authentication Bypass

    WooCommerce Bot for Telegram WordPress plugin <= 1.3.0 contains an authentication bypass caused by missing permission checks and webhook signature verification in REST endpoints, letting unauthenticated attackers take over accounts by forging bot updates with arbitrary usernames.

  • 9.9 /10 Critical
    CVE-2026-107329 PoC publicAuth required

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.12.4 contains a remote code execution caused by improper control of code generation, letting remote authenticated attackers execute arbitrary code.

  • 9.9 /10 Critical
    CVE-2026-107328 PoC publicAuth required

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.12.4 contains a remote code execution caused by improper neutralization of code in eval/exec, letting remote authenticated attackers execute arbitrary code.

  • 9.9 /10 Critical
    CVE-2026-107327 PoC publicAuth required

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.12.4 contains a remote code execution caused by missing authorization, letting remote authenticated attackers execute arbitrary code.

  • 9.1 /10 Critical
    CVE-2026-107060 No auth

    Tailscale - Broken Access Control

    Tailscale versionCode 297862600 contains a broken access control caused by insecure permissions, letting unauthorized attackers make arbitrary changes to other users' VPN configurations and preferences, exploit requires no special privileges.