Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 108 of 166
- 9.1 /10 CriticalCVE-2026-62262 No auth
Piwigo - SQL Injection
Piwigo <= 17.0.0beta1 contains a SQL injection caused by improper validation and casting of crafted ratings[] values in pwg.images.filteredSearch.create, letting unauthenticated guests extract database information and cause time delays, exploit requires no authentication.
- 9.1 /10 CriticalCVE-2026-42322 PoC publicAuth required
Piwigo - Command Injection
Piwigo < 16.4.0 contains a command injection caused by reuse of attacker-controlled file extension in admin/themes_standard_pages.php, letting authenticated administrators execute arbitrary commands via uploaded logos.
- 9.1 /10 CriticalCVE-2026-39353 Auth required
InvoicePlane - Remote Code Execution
InvoicePlane < 1.7.2-rc-1 contains a remote code execution caused by inclusion of administrator-writable PHP templates, letting attackers execute arbitrary code with web-server privileges, exploit requires administrator file-write capability.
- 9.8 /10 CriticalCVE-2026-14281 PoC publicNo auth
Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code - Privilege Escalation
Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress <= 4.8.6 contains a privilege escalation caused by missing permission enforcement and insecure handling of user meta in REST route and OTP verification, letting unauthenticated attackers gain administrator access, exploit requires unauthenticated access to REST API.
- 9.8 /10 CriticalCVE-2026-100075 No auth
Linux Kernel - Denial of Service
Linux kernel contains a logic error in RDMA srpt_alloc_rw_ctxs() causing stale counters and dangling pointers, letting attackers cause incorrect send queue credit accounting, exploit requires triggering multi-buffer indirect descriptor failure.
- 9.8 /10 CriticalCVE-2026-97413 No auth
Linux Kernel - Integer Overflow
Linux kernel contains an integer underflow vulnerability in RDMA/rtrs-srv caused by improper validation of usr_len in process_read and process_write, letting malicious RDMA clients cause out-of-bounds memory access, exploit requires sending crafted network messages.
- 10.0 /10 CriticalCVE-2026-97360 No auth
HFS2 - Path Traversal
HFS2 <= 2.4.0 contains an unauthenticated arbitrary file access vulnerability caused by lack of authorization in macro dispatcher and path resolver failing to confine absolute paths, letting unauthenticated attackers read, write, append, and delete files outside the shared folder.
- 10.0 /10 CriticalCVE-2026-97359 CISA KEVNo auth
HFS2 - Remote Code Execution
HFS2 <= 2.4.0 contains a template injection caused by malicious template syntax in multipart upload filename, letting unauthenticated attackers execute arbitrary commands remotely, exploit requires crafted filename.
- 9.8 /10 CriticalCVE-2026-97230 No auth
IO::Socket::SSL::SelfCertificate - Command Injection
IO::Socket::SSL::SelfCertificate 1.00 for Perl contains a command injection caused by execution of obfuscated Python code from a hardcoded URL in the generate_certificate component, letting attackers execute arbitrary code as the user without saving a script, exploit requires installation of the malicious package.
- 9.8 /10 CriticalCVE-2026-96891 No auth
D-Link DIR-825 - Out of Bounds Read/Write
D-Link DIR-825 3.00b32 contains an out-of-bounds write caused by manipulation of the "peer_hostname" argument in tunnel_set_params function of rp-l2tp component, letting remote attackers corrupt memory, exploit requires crafted input.
- 9.6 /10 CriticalCVE-2026-95699 Auth required
iSteamX - Broken Access Control
iSteamX mobile application prior to 9/18/2026 contains a broken access control caused by AWS policy granting authenticated users access to wildcard MQTT topics, letting authenticated attackers expose user data and control other users' devices, exploit requires user authentication.
- 9.9 /10 CriticalCVE-2026-93577 Auth required
GitLab CE/EE - Remote Code Execution
GitLab CE/EE >= 19.2 and < 19.2.7, >= 19.3 and < 19.3.3, >= 19.4 and < 19.4.1 contains a remote code execution caused by integer overflow when compiling crafted regular expressions in CI/CD configuration, letting authenticated users execute arbitrary code on the server.
- 9.9 /10 CriticalCVE-2026-93425 Auth required
Dokploy - Command Injection
Dokploy < 0.29.13 contains a command injection caused by unsafe argument quoting of user-controlled repoPath in patch.readRepoDirectories tRPC procedure, letting authenticated organization members with service:read permission execute arbitrary commands as root in the container.
- 9.4 /10 CriticalCVE-2026-93291 No auth
Omni C20 - Man-in-the-Middle
Omni C20 contains a man-in-the-middle vulnerability caused by improper certificate validation, letting attackers execute arbitrary code remotely, exploit requires network access to intercept communications.
- 9.1 /10 CriticalCVE-2026-93228 No auth
Linux Kernel - Denial of Service
Linux kernel contains a vulnerability in svcrdma where Write/Reply chunks with segcount 0 are improperly accepted, caused by insufficient validation in xdr_check_write_chunk, letting remote peers send malformed chunks, exploit requires network access to send crafted RDMA packets.