Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 100 of 166

  • 9.6 /10 Critical
    CVE-2026-49243 No auth

    Webmin - Stored XSS

    Webmin < 2.650 contains a stored XSS vulnerability caused by improper input sanitization, letting remote attackers execute attacker-controlled commands via malicious links, exploit requires user interaction.

  • 9.8 /10 Critical
    CVE-2026-39117 No auth

    AltumCode 66Uptime - Remote Code Execution

    AltumCode 66Uptime < 54.0.0 and 66Uptime ping-servers plugin < 2.0.0 contain a remote code execution caused by improper input handling in index.php, letting remote attackers execute arbitrary code, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-103044 No auth

    The Wikimedia Foundation Mediawiki - XPath Injection

    The Wikimedia Foundation Mediawiki - EasyTimeline extension < 1.46.1, 1.45.5, 1.43.10 contains an xpath injection caused by improper input sanitization, letting attackers perform blind XPath injection, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-103041

    LightLLM - Insecure Deserialization

    LightLLM through 1.2.0 multimodal deployments contain an insecure deserialization caused by unauthenticated RPyC cache service with pickle deserialization enabled, letting attackers execute arbitrary code with service privileges, exploit requires exposed cache service.

  • 9.8 /10 Critical
    CVE-2026-103040 No auth

    LightLLM - Remote Code Execution

    LightLLM through 1.2.0 contains a remote code execution caused by unauthenticated RPyC server with pickle deserialization in the router profiler service, letting attackers execute arbitrary code remotely, exploit requires --enable_profiling flag enabled.

  • 9.2 /10 Critical
    CVE-2026-102829 No auth

    argv-parser - Command Injection

    argv-parser < 2.0.1 contains an unsafe editor invocation vulnerability caused by omission of VISUAL from GitEnvKeys in parseEnv, letting attackers influence Git editor execution during operations, exploit requires attacker-controlled environment variables.

  • 9.8 /10 Critical
    CVE-2026-102828 No auth

    simple-git - Command Injection

    simple-git 3.15.0 to 4.0.1 contains a command injection caused by unsafe classification of trailer.<token>.cmd in configuration, letting attackers execute arbitrary shell commands with Node.js process permissions, exploit requires attacker-controlled config values.

  • 9.1 /10 Critical
    CVE-2026-102792 Auth required

    Ziroom ZHOME A0101 - Command Injection

    Ziroom ZHOME A0101 1.0.1.0 contains a command injection caused by manipulation of the conloglevel/log_size arguments in /api/ZRnetwork/set_syslog, letting remote attackers execute arbitrary commands, exploit requires crafted request.

  • 10.0 /10 Critical
    CVE-2026-102425 PoC publicNo auth

    Balbooa Forms - Remote Code Execution

    Balbooa Forms < 2.4.3.4 contains an unauthenticated remote code execution caused by improper sanitization of field shortcodes in administrator-defined PHP code after public form submission, letting remote attackers execute arbitrary code, exploit requires a public form with PHP-after-submission action using attacker-controlled shortcodes.

  • 9.1 /10 Critical
    CVE-2026-102361 No auth

    mall4j - Authentication Bypass

    mall4j through 4.0 contains a broken authentication vulnerability caused by missing authentication in the PUT /user/updatePwd endpoint, letting unauthenticated attackers reset any storefront account password, exploit requires no authentication.

  • 9.6 /10 Critical
    CVE-2026-102331 No auth

    Google Chrome - Buffer Overflow

    Google Chrome on Android < 154.0.8037.92 contains a buffer overflow in ANGLE, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-102316 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.92 contains a use after free vulnerability in Views, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires user interaction.

  • 9.6 /10 Critical
    CVE-2026-102309 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.92 contains a use after free vulnerability in FullScreen, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-102308 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.92 contains a use after free vulnerability in Views, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires user interaction.

  • 9.6 /10 Critical
    CVE-2026-102306 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.92 contains a use after free vulnerability in Bluetooth, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.