Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 109 of 125
- 9.9 /10 CriticalCVE-2026-82845 Auth required
Masteriyo LMS WordPress plugin - Insecure Deserialization
Masteriyo LMS WordPress plugin < 3.4.1 contains an insecure deserialization vulnerability caused by user-supplied metadata being deserialized, letting attackers with minimal accounts execute arbitrary code or write files, exploit requires user account.
- 9.8 /10 CriticalCVE-2026-81402 No auth
DS Ad Rotator WordPress - Unrestricted File Upload
DS Ad Rotator WordPress plugin through 0.8 contains an unrestricted file upload vulnerability caused by lack of capability check, nonce verification, and file-type validation in the image upload handler, letting unauthenticated attackers upload arbitrary files including PHP, leading to remote code execution.
- 9.8 /10 CriticalCVE-2026-78159 CISA KEVPoC publicNo auth
The Events Calendar WordPress plugin - Remote Code Execution
The Events Calendar WordPress plugin <= 6.17.3 contains a remote code execution caused by insufficient validation of the widget 'classes' map in parse_array, letting unauthenticated attackers execute code remotely, exploit requires comments enabled on tribe_events posts with crafted wp:legacy-widget block comment.
- 9.8 /10 CriticalCVE-2026-78006 CISA KEVPoC publicNo auth
The Events Calendar WordPress Plugin - Remote Code Execution
The Events Calendar WordPress plugin <= 6.17.4 contains a remote code execution vulnerability caused by insufficient protection in is_safe_widget_instance and forged wp_hash integrity attribute, letting unauthenticated attackers execute code remotely, exploit requires comments enabled and visible on events.
- 9.6 /10 CriticalCVE-2026-77006 Auth required
WebTotem Backups WordPress Plugin - Unrestricted File Deletion
WebTotem Backups WordPress plugin through 1.0.1 contains an unrestricted file deletion vulnerability caused by lack of file path validation, capability checks, and CSRF enforcement, letting authenticated users delete arbitrary files, exploit requires user authentication.
- 9.6 /10 CriticalCVE-2026-77005 Auth required
CODE MONKEYS PROPOSALS WordPress - Broken Access Control
CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 contains a broken access control caused by lack of user capability checks and file path validation before file deletion, letting authenticated users delete arbitrary files, exploit requires user authentication.
- 9.8 /10 CriticalCVE-2026-75800 No auth
Frontegg SAML SSO WordPress plugin - Authentication Bypass
Frontegg SAML SSO WordPress plugin <= 1.0.1 contains a broken authentication caused by lack of signature and issuer verification in SAML responses, letting unauthenticated attackers log in as any user or create accounts, exploit requires no authentication.
- 9.1 /10 CriticalCVE-2026-89713
Linux Kernel NFSD - Race Condition
Linux kernel NFSD contains a time-of-check to time-of-use (TOCTOU) vulnerability caused by checking truncate permission without inode lock, letting attackers bypass append-only file restrictions during concurrent file size changes, exploit requires concurrent file append operations.
- 9.8 /10 CriticalCVE-2026-89712
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in NFSD nfsd4_ssc_expire_umount caused by improper handling of list iteration after dropping nfsd_ssc_lock, letting attackers cause denial of service by crashing the kernel, exploit requires concurrent NFS RPC threads.
- 9.8 /10 CriticalCVE-2026-89708 No auth
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in nfsd caused by improper handling of cl_cb_session during session teardown, letting attackers cause memory corruption or denial of service, exploit requires triggering session destruction with inflight callbacks.
- 9.8 /10 CriticalCVE-2026-89703
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in nfsd4_drop_revoked_stid due to missing SC_STATUS_FREED flag setting for admin-revoked delegations, letting attackers cause memory corruption, exploit requires local access.
- 9.8 /10 CriticalCVE-2026-89702 No auth
Linux Kernel - Out of Bounds Read/Write
Linux kernel contains a buffer overflow caused by mismatched sizing of server sockaddr slot in nfsd_fh_verify tracepoints, letting attackers cause out-of-bounds memory writes, exploit requires NFS/UDP usage.
- 9.1 /10 CriticalCVE-2026-89697 No auth
Linux Kernel - Broken Access Control
Linux kernel contains a broken access control vulnerability caused by missing fh_want_write() call in nfsd_proc_setattr() during early-verified SETATTR, letting attackers cause improper mount write reference handling, exploit requires network access to NFS service.
- 9.8 /10 CriticalCVE-2026-89689 No auth
Linux Kernel nfsd - Use After Free
Linux kernel nfsd contains a use-after-free vulnerability caused by improper freeing of session slots in nfsd4_sequence(), letting attackers cause memory corruption and potential denial of service, exploit requires crafted NFSv4 client requests.
- 9.8 /10 CriticalCVE-2026-89688 No auth
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability caused by incorrect reference counting in nfsd4_cstate_assign_replay() during seqid_op replay retry, letting attackers cause memory corruption or denial of service, exploit requires attacker to trigger specific NFSv4 operations.