Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 11 of 166
- 9.8 /10 CriticalCVE-2026-107058
Shelter - Broken Access Control
Shelter versionCode 445 contains a broken access control vulnerability caused by improper auth_key registration, letting attackers take over another user's binder service API and preference state, exploit requires attacker to register their own auth_key.
- 9.1 /10 CriticalCVE-2026-107034 No auth
LeafPad / Leaf Note - Broken Access Control
LeafPad / Leaf Note v1.21 contains insecure permissions caused by improper access control, letting unauthorized attackers read other users' note data, exploit requires no special privileges.
- 9.1 /10 CriticalCVE-2026-107032 No auth
Bulk Share : Location Sender - Broken Access Control
Bulk Share : Location Sender v2.1.0 (versionCode 5) contains insecure permissions caused by an exported component, letting unauthorized attackers access and control arbitrary data flow, exploit requires component invocation.
- 9.1 /10 CriticalCVE-2026-107028
wbpxre150 Shopping List - Broken Access Control
wbpxre150 Shopping List v11.0 contains a broken access control caused by insecure permissions on an exported component, letting unauthorized attackers manipulate shopping-list data, exploit requires access to the exported component.
- 9.1 /10 CriticalCVE-2026-107017 No auth
Canvoki - Broken Access Control
Canvoki versionCode 14 contains insecure permissions in ShortcutDispatchActivity component, letting unauthorized attackers trigger another user's automated actions, exploit requires no special privileges.
- 9.1 /10 CriticalCVE-2026-107015 No auth
Simple Contacts Pro - Broken Access Control
Simple Contacts Pro versionCode 107 contains insecure permissions caused by improper access control on note database, letting unauthorized attackers read and write notes of other users, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-104339 No auth
IBM Langflow OSS - Command Injection
IBM Langflow OSS 1.0.0 through 1.12.3 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote attackers execute arbitrary code, exploit requires network access.
- 9.4 /10 CriticalCVE-2026-103093 Auth required
ServiceNow AI Platform - Remote Code Execution
ServiceNow AI Platform contains a sandbox escape vulnerability caused by bypassing Rhino sandbox restrictions, letting authenticated admin users execute arbitrary code on the host OS, exploit requires admin privileges.
- 9.3 /10 CriticalCVE-2023-22793 No auth
Veeam Management Pack for Microsoft System Center - Remote Code Execution
Veeam Management Pack for Microsoft System Center contains a remote code execution caused by unauthenticated access to Veeam Virtualization Extensions service, letting unauthenticated attackers execute arbitrary code remotely.
- 9.1 /10 CriticalCVE-2026-90717 Auth required
Dell PowerProtect Data Domain Management Center - Authentication Bypass
Dell PowerProtect Data Domain Management Center 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20 contain an authentication bypass by spoofing, letting low privileged remote attackers elevate privileges, exploit requires remote access.
- 9.8 /10 CriticalCVE-2026-86400 No auth
Dell PowerProtect Data Domain - Authentication Bypass
Dell PowerProtect Data Domain 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20 contain an improper authentication vulnerability allowing unauthenticated remote attackers to execute arbitrary commands with root privileges.
- 9.8 /10 CriticalCVE-2026-86397 No auth
Dell PowerProtect Data Domain - Authentication Bypass
Dell PowerProtect Data Domain 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20 contain an improper authentication vulnerability allowing unauthenticated remote attackers to create privileged accounts, leading to full system control.
- 9.8 /10 CriticalCVE-2026-86384 No auth
Dell PowerProtect Data Domain - Hardcoded Credentials
Dell PowerProtect Data Domain 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20 contain a hardcoded cryptographic key vulnerability, letting unauthenticated remote attackers expose credentials, exploit requires remote access.
- 9.8 /10 CriticalCVE-2026-84999 CISA KEVNo auth
Pie Register Premium - Unrestricted File Upload
Pie Register Premium WordPress plugin <= 3.8.4.0 contains an unrestricted file upload vulnerability caused by improper validation and lack of nonce or capability checks in piereg_file_upload, letting unauthenticated attackers upload executable files and achieve remote code execution.
- 9.1 /10 CriticalCVE-2026-67074
HCL BigFix AEX - Remote Code Execution
HCL BigFix AEX contains a remote code execution vulnerability caused by unspecified conditions, letting attackers execute code with application privileges, exploit requires unspecified conditions.