Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 102 of 125

  • 10.0 /10 Critical
    CVE-2026-71133 No auth

    Oracle Access Manager - Authentication Bypass

    Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 contain an authentication bypass caused by a vulnerability in the Authentication Engine, letting unauthenticated network attackers fully compromise the system, exploit requires network access via HTTP.

  • 9.8 /10 Critical
    CVE-2026-70913 No auth

    Oracle Identity Manager - Remote Code Execution

    Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 contain a remote code execution caused by an easily exploitable vulnerability in the core component, letting unauthenticated attackers with network access via HTTP fully compromise the system, exploit requires network access via HTTP.

  • 9.8 /10 Critical
    CVE-2026-70757

    Oracle WebLogic Server - Remote Code Execution

    Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contain a remote code execution caused by unauthenticated network access via T3 and IIOP protocols, letting attackers fully compromise the server, exploit requires network access to T3 or IIOP.

  • 9.8 /10 Critical
    CVE-2026-70756 No auth

    Oracle WebLogic Server - Remote Code Execution

    Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contain a remote code execution caused by unauthenticated network access via T3 and IIOP protocols, letting attackers fully compromise the server, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-70748 No auth

    Oracle WebLogic Server - Remote Code Execution

    Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contains a remote code execution caused by unauthenticated network access via T3 and IIOP protocols, letting attackers fully compromise the server, exploit requires network access.

  • 9.6 /10 Critical
    CVE-2026-66890 No auth

    Affected Products - Hardcoded Credentials

    Affected products contain hardcoded credentials allowing remote attackers to access files with root privileges via FTP, exploit requires FTP service to be reachable.

  • 9.6 /10 Critical
    CVE-2026-66887

    CVE-2026-66887

    The affected products are missing authorization on state-changing CGIs and session checks are not performed.

  • 9.1 /10 Critical
    CVE-2026-63696 Auth required

    Dell SmartFabric OS10 Software - Remote Code Execution

    Dell SmartFabric OS10 Software < 10.6.1.3 contains a download of code without integrity check vulnerability, letting high privileged remote attackers execute arbitrary code, exploit requires high privileges.

  • 9.8 /10 Critical
    CVE-2026-63695

    Dell SmartFabric OS10 Software - Authentication Bypass

    Dell SmartFabric OS10 Software < 10.6.1.3 contains a session fixation vulnerability caused by improper session management, letting unauthenticated remote attackers steal sessions, exploit requires remote access.

  • 9.8 /10 Critical
    CVE-2026-62379 No auth

    Open Access Management (OpenAM) - Remote Code Execution

    Open Access Management (OpenAM) < 16.1.2 contains a remote code execution caused by unsafe deserialization and arbitrary class instantiation in the pre-authentication /authservice PLL endpoint, letting unauthenticated attackers execute code remotely.

  • 9.9 /10 Critical
    CVE-2026-61667 Auth required

    DIRAC - Command Injection

    DIRAC < 8.0.79, 9.0.22, 9.1.10 contains a command injection caused by unparameterized SQL query in DatasetManager.py __checkDataset, letting authenticated attackers execute arbitrary commands, exploit requires authentication.

  • 9.6 /10 Critical
    CVE-2026-61568 No auth

    @zereight/mcp-gitlab - DNS Rebinding

    @zereight/mcp-gitlab < 2.1.30 contains a dns rebinding vulnerability caused by lack of effective Host or Origin allowlist in the Streamable HTTP MCP endpoint, letting attackers route browser requests to local MCP listener with attacker-controlled headers, exploit requires victim to visit malicious web page.

  • 9.8 /10 Critical
    CVE-2026-61560 No auth

    @zereight/mcp-gitlab - Information Disclosure

    @zereight/mcp-gitlab < 2.1.27 contains an information disclosure caused by unsanitized file_path parameter in upload_markdown tool with SSE=true, letting unauthenticated network attackers read arbitrary files and steal GitLab tokens, exploit requires default SSE transport mode enabled.

  • 9.6 /10 Critical
    CVE-2026-61559 Auth required

    @zereight/mcp-gitlab - Information Disclosure

    @zereight/mcp-gitlab < 2.1.27 contains an information disclosure caused by lack of hostname restriction on X-GitLab-API-URL header, letting attackers receiving victim's Private-Token via attacker-controlled API URL, exploit requires network access to send crafted requests.

  • 10.0 /10 Critical
    CVE-2026-59971 No auth

    MySQL MCP Server - DNS Rebinding

    MySQL MCP Server < 0.4.2 contains a DNS rebinding and unauthenticated access vulnerability caused by insecure SseServerTransport configuration and lack of authentication on key routes, letting network attackers disclose and modify database contents and potentially execute code if FILE privileges exist, exploit requires network access and victim browser interaction.