Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 103 of 166
- 9.8 /10 CriticalCVE-2026-96760 PoC publicNo auth
Authlib - Authentication Bypass
Authlib <= 1.7.2 contains a signature verification bypass caused by JsonWebSignature.deserialize_json() method accepting JSON Serialization JWS objects without signature or key verification, letting attackers bypass signature verification, exploit requires crafted JSON Serialization JWS object.
- 9.8 /10 CriticalCVE-2026-90924 No auth
Innotim Software Logsign SIEM - Authentication Bypass
Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM 6.4.101 to before 6.4.117 contains a broken authentication caused by use of default credentials, letting attackers gain unauthorized access by trying common or default usernames and passwords, exploit requires no special privileges.
- 9.6 /10 CriticalCVE-2026-88804 No auth
SUSE Rancher - Stored XSS
SUSE Rancher < 2.15.2, 2.14 < 2.14.6, 2.13 < 2.13.10, 2.12 < 2.12.14, and 2.11 < 2.11.18 contain a stored cross-site scripting caused by unauthenticated update of public UI settings, letting remote attackers execute scripts in Rancher UI, exploit requires no authentication.
- 9.9 /10 CriticalCVE-2026-87799 Auth required
Canonical LXD - Path Traversal
Canonical LXD >= 4.0 contains a path traversal caused by improper link resolution in migration receive path, letting authenticated clients or malicious migration sources write files as root, exploit requires instance or volume creation privileges.
- 9.9 /10 CriticalCVE-2026-85526 Auth required
Canonical LXD - Path Traversal
Canonical LXD on Linux contains a path traversal caused by crafted subvolumes[].path entry in backup/optimized_header.yaml during btrfs optimized backup import, letting authenticated users with instance creation privileges delete or replace arbitrary files as root.
- 9.6 /10 CriticalCVE-2026-85185 Auth required
Canonical LXD - Path Traversal
Canonical LXD 4.0.2 and later contain a path traversal in the btrfs storage driver caused by crafted subvolume paths with ../ sequences, letting authenticated clients with instance creation permission delete or write arbitrary files as root, exploit requires authenticated client with instance creation permission.
- 9.8 /10 CriticalCVE-2026-82384 PoC publicNo auth
Apache Roller - Remote Code Execution
Apache Roller 6.1.5 contains an insecure deserialization vulnerability caused by accepting vendor extension types in the XML-RPC endpoint before authentication, letting unauthenticated remote attackers achieve remote code execution, exploit requires no special configuration.
- 9.0 /10 CriticalCVE-2026-82378
Apache Roller - Broken Access Control
Apache Roller 6.1.5 contains a broken access control caused by improper authorization in the OAuth 1.0a authorization endpoint, letting unauthenticated remote attackers bind request tokens to arbitrary user accounts, exploit requires knowledge of an outstanding request token.
- 9.9 /10 CriticalCVE-2026-82377 Auth required
Apache Roller - Broken Access Control
Apache Roller 6.1.5 contains a broken access control vulnerability caused by missing authorization checks in legacy XML-RPC Blogger and MetaWeblog API handlers, letting authenticated users read, modify, or delete other weblogs' content, exploit requires enabled global XML-RPC setting.
- 9.2 /10 CriticalCVE-2026-73642 No auth
Dayforce Payroll - Path Traversal
Dayforce Payroll R2026.2.0 contains a path traversal caused by improper validation of file path parameter in file download functionality, letting unauthenticated attackers read arbitrary local files, exploit requires crafted GET request.
- 9.3 /10 CriticalCVE-2026-73640 No auth
Dayforce Payroll - SQL Injection
Dayforce Payroll R2026.2.0 contains a time-based blind SQL injection caused by unsanitized input in password recovery parameters, letting unauthenticated attackers perform delayed SQL queries, exploit requires crafted GET request.
- 9.1 /10 CriticalCVE-2026-49994 No auth
Bluehood - Broken Access Control
Bluehood < 0.7.1 contains broken access control caused by missing authentication checks on /api/* handlers, letting network attackers read Bluetooth tracking data and modify application state without session cookies.
- 9.6 /10 CriticalCVE-2026-12342 No auth
IdentityIQ - Remote Code Execution
IdentityIQ contains a remote code execution caused by improper input validation of submitted web service API content, letting unauthenticated attackers execute code remotely, exploit requires no special privileges.
- 9.1 /10 CriticalCVE-2026-102268 PoC publicNo auth
PyJWT - Authentication Bypass
PyJWT < 2.14.0 contains an authentication bypass caused by is_pem_format not recognizing all PEM representations, letting attackers forge authenticated HMAC tokens when mixing HMAC and asymmetric algorithms, exploit requires supplying mutated public-key PEM as raw key bytes.
- 9.1 /10 CriticalCVE-2026-101894 PoC publicNo auth
Node.js decompress - Path Traversal & Remote Code Execution
Node.js decompress package < 10.2.2 and < 11.1.4 contains a path traversal caused by chained symlink entries in archives, letting attackers read/write files outside output directory and potentially execute remote code, exploit requires crafted archive.