Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 104 of 125

  • 9.8 /10 Critical
    CVE-2026-37152 No auth

    TOTOLINK X5000R - Hardcoded Credentials

    TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a hardcoded password vulnerability caused by embedded root credentials, letting attackers gain unauthorized root access, exploit requires no special conditions.

  • 9.8 /10 Critical
    CVE-2026-19773 No auth

    libwebsockets - Remote Code Execution

    libwebsockets contains a remote code execution caused by improper validation in HTTP/2 HPACK path header parsing, letting remote attackers execute arbitrary code without authentication.

  • 9.8 /10 Critical
    CVE-2026-12351

    IBM MQ - Remote Code Execution

    IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 contain a remote code execution caused by unsafe JNDI lookup processing in IVT application deployment, letting remote attackers execute arbitrary code, exploit requires IVT application deployment.

  • 9.8 /10 Critical
    CVE-2026-11928 No auth

    IBM Verify Identity Access - Buffer Overflow

    IBM Verify Identity Access contains a buffer overflow vulnerability that allows attackers to cause memory corruption or remote code execution, exploit requires crafted input.

  • 9.1 /10 Critical
    CVE-2026-11921

    IBM Verify Identity Access - Broken Authentication

    IBM Verify Identity Access containers contain a misconfiguration causing management password change operations to be applied incorrectly, letting attackers potentially bypass password update mechanisms, exploit requires container management access.

  • 9.8 /10 Critical
    CVE-2024-58385 CISA KEVNo auth

    Yonyou U8 CRM - SQL Injection

    Yonyou U8 CRM contains an unauthenticated SQL injection caused by unsanitized 'id' parameter in fillbacksettingedit.php with DontCheckLogin=1 bypassing authentication, letting attackers execute arbitrary SQL and OS commands.

  • 9.8 /10 Critical
    CVE-2023-54398 CISA KEVNo auth

    Yonyou U8 Cloud - Remote Code Execution

    Yonyou U8 Cloud contains an unauthenticated insecure deserialization vulnerability in nc.impl.pub.filesystem.FileManageServlet, letting remote attackers execute arbitrary OS commands via crafted serialized payloads, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-90945 No auth

    Crawlab - Authentication Bypass

    Crawlab <= 0.6.3 contains a broken authentication caused by hard-coded HMAC-SHA256 secret for JWT token signing, letting unauthenticated attackers forge admin tokens to access APIs and execute code on worker nodes, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-90942 Auth required

    Casdoor - Authentication Bypass

    Casdoor through 4.4.0 contains an information disclosure caused by improper masking of the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, letting organization administrators retrieve the private key, exploit requires organization administrator privileges.

  • 9.9 /10 Critical
    CVE-2026-90937 Auth required

    Froxlor - Broken Access Control

    Froxlor < 2.2.5 contains a configuration injection vulnerability caused by failure to validate newline characters in subdomain redirect URLs, letting authenticated customers inject arbitrary web server directives, exploit requires authentication.

  • 9.8 /10 Critical
    CVE-2026-90919

    LightLLM - Remote Code Execution

    LightLLM through 1.2.0 contains a remote code execution caused by unauthenticated /visual_register WebSocket endpoint passing client frames directly to pickle.loads(), letting attackers execute arbitrary code with Config Server privileges, exploit requires access to Config Server port.

  • 9.8 /10 Critical
    CVE-2026-90898 PoC publicNo auth

    Bifrost transports - Command Injection

    Bifrost transports v2.0.0 contains a command injection caused by unauthenticated stdio client registration via POST /api/mcp/client, letting unauthenticated attackers execute arbitrary programs as the Bifrost process user, exploit requires authentication disabled.

  • 9.1 /10 Critical
    CVE-2026-90703 Auth required

    D-Link DWR-M921 - Command Injection

    D-Link DWR-M921 1.1.52 contains a command injection caused by manipulation of the "folderpath" argument in /boafrm/formDiskCreateShare system function, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-90702 Auth required

    D-Link DWR-M921 - Command Injection

    D-Link DWR-M921 1.1.52 contains a command injection caused by manipulation of the "partition" argument in /boafrm/formDiskFormat, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-90699 Auth required

    D-Link DWR-M920 - Command Injection

    D-Link DWR-M920 1.1.7 contains a command injection caused by manipulation of the "newPin" argument in /boafrm/formPinManageSetup, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.