Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 106 of 166

  • 10.0 /10 Critical
    CVE-2026-100886 PoC publicNo auth

    Seetong T8108 - Authentication Bypass

    Seetong T8108, T8108P, T8116, and T8232 4.6.1.4-build202604241011 contain an authentication bypass caused by improper authentication in Debug Service, letting remote attackers bypass authentication, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-100833 PoC publicAuth required

    Contrast - Broken Access Control

    Contrast (edgelesssys/contrast) < 1.23.1 contains a broken access control vulnerability caused by an improper allow_storage rule in runtime policies, letting attackers with Kata agent API access substitute container images, exploit requires attacker access to Kata agent API.

  • 9.8 /10 Critical
    CVE-2026-100741 No auth

    Progressive Robot Ltd hMailServer - Command Injection

    Progressive Robot Ltd hMailServer 6.0.0 through 6.3.3 on Windows contains a command injection caused by improper escaping of backslash in JScript event-script dispatcher, letting remote unauthenticated attackers execute arbitrary JScript with service account privileges, exploit requires event scripting enabled, JScript language, and specific event handlers defined.

  • 9.9 /10 Critical
    CVE-2026-100740 PoC publicAuth required

    D-Link DIR-895L - Buffer Overflow

    D-Link DIR-895L A1_102b07 contains a buffer overflow caused by out-of-bounds write in tunnel_set_params function of L2TP Control Channel Parser, letting remote attackers cause denial of service or code execution, exploit requires crafted network packets.

  • 9.0 /10 Critical
    CVE-2026-100721 PoC publicNo auth

    vm2 - Authorization Bypass

    vm2 before 3.12.2 contains an authorization bypass caused by improper external-module resolution in NodeVM, letting untrusted guest code execute arbitrary code in the host context, exploit requires custom external resolver with context 'host'.

  • 10.0 /10 Critical
    CVE-2026-97163 PoC publicNo auth

    Joomla Extension lomart.fr - Remote Code Execution

    Joomla Extension lomart.fr UP plugin 5.0.0-5.2.0, 6.0.0-6.0.29 contains an unauthenticated remote code installation vulnerability caused by improper validation, letting unauthenticated attackers install remote code.

  • 9.2 /10 Critical
    CVE-2026-97161 PoC publicNo auth

    Joomla Extension lomart.fr - Path Traversal

    Joomla Extension lomart.fr UP plugin 5.0.0-5.2.0, 6.0.0-6.0.29 contains path traversal vulnerabilities caused by improper input validation, letting attackers access arbitrary files remotely, exploit requires crafted requests.

  • 9.4 /10 Critical
    CVE-2026-97160 PoC publicAuth required

    Joomla Extension lomart.fr - Command Injection

    Joomla Extension lomart.fr 5.0.0-5.2.0, 6.0.0-6.0.29 contains a command injection caused by insufficient input sanitization in UP plugin extension, letting authenticated privileged attackers execute arbitrary PHP commands.

  • 9.5 /10 Critical
    CVE-2026-94132 PoC publicNo auth

    Joomla Extension acymailing.com - Remote Code Execution

    Joomla Extension acymailing.com < 11.1.0 contains a remote code execution caused by lack of extension check on MIME parts saved in mailbox action feature, letting attackers upload PHP files remotely via email, exploit requires ability to send email to monitored mailbox.

  • 9.8 /10 Critical
    CVE-2026-94130 PoC publicNo auth

    Joomla Extension joomlaboat.com - SQL Injection

    Joomla Extension joomlaboat.com < 5.7.3 contains an SQL injection caused by improper sanitization in video search and sorting functionality, letting unauthenticated attackers inject SQL commands in read queries.

  • 9.8 /10 Critical
    CVE-2026-85984 PoC publicNo auth

    miniOrange OTP Login, Verification and SMS Notifications - Authentication Bypass

    miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress <= 5.5.5 contains an authentication bypass caused by missing password-intent guard in mo_by_pass_login() function, letting unauthenticated attackers log in as any administrator with only a username and mo_wp_login_intent=otp, exploit requires specific plugin options enabled by site administrator.

  • 9.8 /10 Critical
    CVE-2026-82901 PoC public

    Ultra Addons for Contact Form 7 - Arbitrary File Upload

    Ultra Addons for Contact Form 7 WordPress plugin <= 3.5.50 contains an arbitrary file upload vulnerability caused by insufficient file type validation in 'uacf7_wpcf7_mail_components', letting unauthenticated attackers upload arbitrary files, exploit requires PDF Generator module enabled.

  • 9.8 /10 Critical
    CVE-2026-18143 CISA KEVPoC publicNo auth

    Request a Quote for WooCommerce - Unrestricted File Upload

    Request a Quote for WooCommerce plugin for WordPress <= 2.9.2 contains an unrestricted file upload vulnerability caused by missing file extension and MIME type validation in afrfq_submit_quote_via_popup(), letting unauthenticated attackers upload executable files, exploit requires enabled public quote rule with multi-page popup flow.

  • 9.9 /10 Critical
    CVE-2026-100717 Auth required

    Froxlor - Server-Side Request Forgery

    Froxlor <= 2.3.10 contains a server-side request forgery caused by improper validation of CR/LF characters in userinfo of URLs, letting authenticated low-privilege customers with subdomain-create rights inject arbitrary web-server configuration, exploit requires authenticated low-privilege user.

  • 9.9 /10 Critical
    CVE-2026-100716 Auth required

    Froxlor - Broken Access Control

    Froxlor <= 2.3.10 contains a broken access control vulnerability caused by improper validation of intermediate path components in DataDump export destination, letting authenticated customers with export feature enabled escalate privileges to root via symlink attack, exploit requires authenticated customer with export feature.