Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 107 of 166
- 9.6 /10 CriticalCVE-2026-100715 Auth required
Froxlor - Unrestricted File Upload
Froxlor <= 2.3.10 contains an arbitrary file deletion vulnerability caused by symlink following in the FTP data deletion cron task, letting authenticated customers delete arbitrary directories as root, exploit requires FTP home directory write access.
- 9.1 /10 CriticalCVE-2026-100714 Auth required
Froxlor - Command Injection
Froxlor < 2.3.12 contains a command injection vulnerability caused by unescaped system.letsencryptchallengepath setting concatenated into acme.sh command line, letting administrators or actors with settings write access execute arbitrary commands as root, exploit requires write access to settings.
- 9.9 /10 CriticalCVE-2026-100706 Auth required
Kyverno - Broken Access Control
Kyverno < 1.19.1 contains a broken access control caused by improper validation of URL-encoded path segments in Policy apiCall urlPath, letting namespace tenants bypass namespace restrictions and escalate privileges to cluster admin, exploit requires namespace tenant privileges.
- 9.1 /10 CriticalCVE-2026-97064 No auth
X-SpringBoot - Authentication Bypass
X-SpringBoot through 6.0 contains a broken authentication caused by a hardcoded static master login verification code in the database seed, letting unauthenticated attackers authenticate as any user via the emailOrMobileLogin endpoint.
- 9.1 /10 CriticalCVE-2026-97063 No auth
X-SpringBoot - Authentication Bypass
X-SpringBoot <= 6.0 contains an authentication bypass caused by login verification codes returned in HTTP responses from unauthenticated endpoints, letting attackers hijack accounts by requesting and reading codes, exploit requires no authentication.
- 9.3 /10 CriticalCVE-2026-93647 No auth
Zimbra Classic - Stored XSS
Zimbra Classic contains a stored XSS caused by active markup in a COUNTER message's RFC From address, letting unauthenticated calendar senders access mailbox data and act as victims, exploit requires message selection.
- 9.8 /10 CriticalCVE-2026-93643 No auth
OnlyOffice Document Editing - Path Traversal & Command Injection
OnlyOffice Document Editing contains a path traversal and command injection caused by unsigned save fields in public Briefcase documents, letting unauthenticated remote attackers write files and execute commands as zimbra, exploit requires access to a supported public Briefcase document.
- 9.3 /10 CriticalCVE-2026-93642 No auth
Zimbra Modern - Stored XSS
Zimbra Modern contains a stored XSS caused by forged share notifications, letting unauthenticated attackers execute scripts when signed-in users click Accept Share, exploit requires victim interaction.
- 9.3 /10 CriticalCVE-2026-93641 No auth
Zimbra Classic - Stored XSS
Zimbra Classic contains a stored XSS caused by unauthenticated sender forging share notification, letting attackers access mailbox data and act as victim when signed-in user clicks Accept Share.
- 9.1 /10 CriticalCVE-2026-93399 CISA KEVPoC publicNo auth
Bookly WordPress Plugin - Broken Access Control
Bookly WordPress plugin <= 28.2 contains an insecure direct object reference caused by improper session validation in AJAX handlers, letting unauthenticated attackers disclose order tokens, retrieve calendar data, and delete bookings.
- 9.8 /10 CriticalCVE-2026-92609 No auth
Apache Qpid Broker-J - Authentication Bypass
Apache Qpid Broker-J <= 10.1.0 contains a session fixation vulnerability in HTTP management authentication, letting remote attackers gain unauthorized access to authenticated sessions via reuse of session identifiers, exploit requires no special conditions.
- 9.1 /10 CriticalCVE-2026-92289
Lemonldap::NG::Portal - Authentication Bypass
Lemonldap::NG::Portal 2.23.0 to before 2.23.4 for Perl contains a PKCE bypass caused by checkEndPointAuthenticationCredentials not verifying client secret for public Relying Parties, letting attackers exchange intercepted authorization codes for tokens, exploit requires intercepted authorization code.
- 9.1 /10 CriticalCVE-2026-92288 No auth
Lemonldap::NG::Portal - Authentication Bypass
Lemonldap::NG::Portal 2.20.0 < 2.21.6 and 2.22.0 < 2.23.4 contains an information disclosure caused by missing client secret verification for public Relying Parties in OAuth2 token introspection, letting unauthenticated attackers confirm token activity and read metadata, exploit requires attacker to know a public client_id and hold an access token.
- 9.8 /10 CriticalCVE-2026-92161 No auth
FriendsOfFlarum OAuth - Authentication Bypass
FriendsOfFlarum OAuth < 1.7.4 and < 2.0.0-beta.4 contains an authentication bypass caused by improper verification of Discord OAuth email addresses, letting unauthenticated attackers link attacker-controlled Discord accounts to existing users and authenticate as them without passwords, exploit requires victim's email not linked to Discord.
- 9.1 /10 CriticalCVE-2026-89055 PoC publicNo auth
WooCommerce Customer Reviews - Authorization Bypass
WooCommerce Customer Reviews plugin for WordPress <= 5.120.0 contains an authorization bypass caused by improper user authorization verification, letting unauthenticated attackers delete arbitrary media attachments, exploit requires public review-form link with nonce.