Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 110 of 166
- 9.8 /10 CriticalCVE-2026-13249 PoC publicNo auth
Honeywell PD45 Industrial Printer - Remote Code Execution
Honeywell PD45 Industrial Printer F10.19.010040 contains an unrestricted file upload vulnerability in the web management interface, letting unauthenticated attackers upload and execute malicious files remotely, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-12227 CISA KEVPoC publicNo auth
Visual Composer Website Builder - Local File Inclusion
Visual Composer Website Builder for WordPress <= 45.16.0 contains a local file inclusion vulnerability caused by improper validation of the vcv-template parameter, letting unauthenticated attackers include and execute arbitrary files, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-96759 No auth
Orval - Stored XSS
Orval < 8.29.0 contains a stored XSS caused by failure to escape the operationId parameter in generated TanStack Query mutator options metadata, letting attackers inject and execute arbitrary JavaScript code when hooks are called, exploit requires crafted OpenAPI specification.
- 9.8 /10 CriticalCVE-2026-96758 No auth
orval @orval/core - Code Injection
orval @orval/core < 8.28.0 contains a code injection caused by failure to escape multipart property names in form-data serializer template literals, letting attackers inject expressions that execute during FormData body construction with consumer process privileges.
- 9.8 /10 CriticalCVE-2026-96757
Orval - Stored XSS
Orval < 8.29.0 contains a stored XSS caused by failure to escape OpenAPI media-type keys in single-quoted Content-Type string literals, letting attackers inject JavaScript executed in generated fetch operations or mock resolvers, exploit requires crafted OpenAPI specifications.
- 9.8 /10 CriticalCVE-2026-96755 No auth
Orval - Code Injection
Orval 8.14.0 through 8.28.1 contains a code injection vulnerability caused by improper handling of OpenAPI schema defaults in the @orval/effect generator, letting attackers inject and execute arbitrary JavaScript expressions at module scope, exploit requires crafted schema defaults with ${...} syntax.
- 9.8 /10 CriticalCVE-2026-96754 No auth
Orval - Code Injection
Orval < 8.29.0 contains a code injection caused by failure to escape OpenAPI path values in single-quoted route literals in @orval/hono generator, letting attackers execute arbitrary JavaScript code on module import, exploit requires crafted OpenAPI document.
- 9.8 /10 CriticalCVE-2026-96560 No auth
LightLLM - Remote Code Execution
LightLLM through 1.2.0 contains a remote code execution caused by unauthenticated RPyC control channel deserializing attacker-supplied data in KV-transfer worker with --pd_trans_mode nccl, letting attackers execute arbitrary code remotely, exploit requires starting with --pd_trans_mode nccl.
- 10.0 /10 CriticalCVE-2026-96257 No auth
Fast FAC1203R Gigabit Edition - Buffer Overflow
Fast FAC1203R Gigabit Edition 2.0.4 contains a stack-based buffer overflow caused by improper handling in copy_msg_element function of Device Discovery Service, letting remote attackers execute code, exploit requires network access.
- 9.1 /10 CriticalCVE-2026-95848 PoC publicNo auth
Moquette - Authentication Bypass
Moquette < 0.18.1 contains a broken authentication caused by failure to load configured authenticator or authorizator classes, letting attackers bypass authentication and authorization, exploit requires misconfiguration or class loading failure.
- 9.3 /10 CriticalCVE-2026-95601 No auth
WBW Product Filter - SQL Injection
WBW Product Filter <= 3.1.7 contains an SQL injection caused by unsanitized input, letting unauthenticated attackers execute arbitrary SQL queries, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-93352 No auth
Laravel-Mediable - Remote Code Execution
Laravel-Mediable 7.0.0 before 7.0.2 contains a remote code execution vulnerability caused by incomplete extension blocklist missing .pht in config/mediable.php, letting attackers upload and execute PHP files remotely, exploit requires file upload capability.
- 9.1 /10 CriticalCVE-2026-86934 No auth
FileMaker Server - Authorization Bypass
FileMaker Server before 26.0.3 contains an authorization bypass caused by improper handling of extended privilege headers in the Web Publishing Engine, letting attackers access the XML Web Publishing interface despite disabled settings, exploit requires crafted requests with extended privilege headers.
- 9.1 /10 CriticalCVE-2026-86930 No auth
FileMaker Server - Out of Bounds Read
FileMaker Server for Linux contains an out-of-bounds read vulnerability caused by processing specially crafted image files in container fields during thumbnail generation in FileMaker WebDirect, letting attackers disclose process memory, exploit requires uploading a crafted image file.
- 10.0 /10 CriticalCVE-2026-86708 No auth
ZohoCorp ManageEngine Applications Manager - Authentication Bypass
ZohoCorp ManageEngine Applications Manager <= 182200 contains an exposure of Google Cloud service-account private key in the installer, letting unauthenticated attackers impersonate the service account and access or modify cloud resources, exploit requires no authentication.