Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 105 of 166
- 9.1 /10 CriticalCVE-2026-101008 Auth required
aaPanel BaoTa - Command Injection
aaPanel BaoTa <= 11.8.0 contains a command injection caused by manipulation of the "split_file_path" argument in merge_split_file function of /www/server/panel/class/files.py, letting remote attackers execute arbitrary commands, exploit requires no special privileges.
- 9.9 /10 CriticalCVE-2026-101002 Auth required
Netcore NBR200V2 - Command Injection
Netcore NBR200V2 1.3.241127.071246 contains a command injection caused by manipulation of the "url" argument in /usr/bin/network_tools component Tools Ping Handler, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.
- 10.0 /10 CriticalCVE-2026-101001 No auth
Netcore NBR200V2 - OS Command Injection
Netcore NBR200V2 1.3.241127.071246 contains an OS command injection caused by manipulation of the QUERY_STRING argument in /www/cgi-bin/network_tools Web Management Interface, letting remote attackers execute arbitrary OS commands.
- 10.0 /10 CriticalCVE-2026-101000 No auth
Netcore NBR100V2 - Broken Access Control
Netcore NBR100V2 1.3.240614.030928 contains a broken access control caused by missing authorization in uci.apply function of ACL Handler, letting remote attackers bypass authorization, exploit requires no special privileges.
- 9.9 /10 CriticalCVE-2026-100896 Auth required
TOTOLINK N150RT - Command Injection
TOTOLINK N150RT 3.4.0-B20201030 contains a command injection caused by manipulation of the "wlanif" argument in /boafrm/formWlSiteSurvey of the Web Management Interface, letting remote attackers execute OS commands, exploit requires no special privileges.
- 9.3 /10 CriticalCVE-2026-100752 PoC publicNo auth
Joomla Extension ordasoft.com Real Estate Manager - SQL Injection
Joomla Extension ordasoft.com Real Estate Manager (Free) < 6.7.9 contains an unauthenticated SQL injection caused by direct concatenation of the order_field parameter into the ORDER BY clause in site/realestatemanager.php, letting attackers execute arbitrary SQL queries remotely, exploit requires no authentication.
- 9.1 /10 CriticalCVE-2026-89134
wolfSSL - Authentication Bypass
wolfSSL 5.9.2 contains a broken authentication caused by improper name-constraint checks allowing certificates with no dNSName SAN but other SAN types to bypass Subject CN dNSName validation, letting attackers bypass name constraints, exploit requires crafted certificate.
- 9.8 /10 CriticalCVE-2026-88777 No auth
Citrix NetScaler ADC & Gateway - Buffer Overflow
Citrix NetScaler ADC and Gateway before 14.1-73.37 and 13.1-64.23 contain a buffer overflow caused by improper memory handling, letting attackers cause denial of service or unpredictable behavior, exploit requires no special conditions.
- 9.8 /10 CriticalCVE-2026-88776 PoC publicNo auth
Citrix NetScaler ADC & Gateway - Buffer Overflow
Citrix NetScaler ADC and Gateway before 14.1-73.37 and 13.1-64.23 contain a buffer overflow caused by improper memory handling, letting attackers cause denial of service or unpredictable behavior, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-88775 No auth
Citrix NetScaler ADC & Gateway - Buffer Overflow
Citrix NetScaler ADC and Gateway before 14.1-73.37 and 13.1-64.23 contain a buffer overflow caused by improper memory handling, letting attackers cause denial of service or unpredictable behavior, exploit requires no special privileges.
- 10.0 /10 CriticalCVE-2026-88773 PoC publicNo auth
Citrix NetScaler ADC & Gateway - HTTP Request Smuggling
Citrix NetScaler ADC and Gateway before 14.1-73.37 and 13.1-64.23 contain an HTTP request smuggling vulnerability caused by inconsistent interpretation of HTTP requests, letting attackers perform request smuggling attacks, exploit requires crafted HTTP requests.
- 9.8 /10 CriticalCVE-2026-88771 CISA KEVPoC publicNo auth
Citrix NetScaler ADC & Gateway - Command Injection
Citrix NetScaler ADC and Gateway < 14.1-73.37, < 13.1-64.23 contain a command injection caused by improper input validation, letting unauthenticated attackers execute arbitrary commands remotely, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-101090
Nezha - Host Header Injection
Nezha 2.2.3 contains a host header injection caused by reflecting attacker-supplied HTTP Host header in OAuth2 redirect_uri when dashboard_host is empty, letting attackers hijack OAuth2 login flow, exploit requires empty dashboard_host configuration.
- 9.6 /10 CriticalCVE-2026-101084 Auth required
Obot - Broken Access Control
Obot < v0.21.1 contains a broken access control vulnerability caused by failure to enforce access control rules on /mcp-connect endpoint, letting authenticated users bypass authorization to access restricted MCP servers using server ID.
- 9.8 /10 CriticalCVE-2026-101065 No auth
Obot - Authentication Bypass
Obot up to commit d7e6970 contains an authentication bypass caused by disabled authentication in the Docker quickstart, letting unauthenticated attackers gain full admin access and control over the host Docker, exploit requires exposed port with disabled authentication.