Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 111 of 166
- 9.1 /10 CriticalCVE-2026-86350 PoC publicNo auth
Apache Tomcat - HTTP Request Smuggling
Apache Tomcat 11.0.22 through 11.0.25, 10.1.55 through 10.1.59, and 9.0.118 through 9.0.121 contain an HTTP request smuggling caused by regression in fix for CVE-2026-41293, letting attackers trigger request header mix-up, exploit requires crafted HTTP/2 requests.
- 9.8 /10 CriticalCVE-2026-86248
Apache Tomcat - Authentication Bypass
Apache Tomcat 11.0.0-M14 through 11.0.25, 10.1.22 through 10.1.59, and 9.0.92 through 9.0.121 contain an authentication bypass caused by CLIENT_CERT authentication not failing as expected when soft fail is disabled, letting attackers bypass authentication, exploit requires specific CLIENT_CERT soft fail configuration.
- 9.1 /10 CriticalCVE-2026-86246 No auth
Apache Tomcat Native - Insecure Default Configuration
Apache Tomcat Native 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8 contain an insecure default configuration caused by enabled insecure options including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF, and ALLOW_NO_DHE_KEX, letting attackers exploit weakened security, exploit requires no special conditions.
- 9.6 /10 CriticalCVE-2026-85724 PoC publicAuth required
Moquette - Broken Access Control
Moquette < 0.18.1 contains an authorization bypass caused by improper substitution of client ID and username in pattern-based ACL rules, letting attackers with crafted identities gain cross-tenant read/write access or cause DoS, exploit requires crafted client ID or username.
- 9.9 /10 CriticalCVE-2026-84719 Auth required
Ansible Automation Platform automation-controller - Broken Access Control
Ansible Automation Platform automation-controller contains a broken access control caused by incomplete permission checks when copying WorkflowJobTemplate, letting users with organization workflow-admin permission bypass instance group restrictions and run jobs in unauthorized control-plane context, exploit requires organization workflow-admin permission.
- 9.9 /10 CriticalCVE-2026-84502 Auth required
Red Hat Ansible Automation Platform - Command Injection
Red Hat Ansible Automation Platform automation-controller contains a command injection caused by improper validation of the Project scm_url field, letting users with project modification permissions execute arbitrary commands on the control-plane task pod, exploit requires user with project create or modify permissions.
- 9.9 /10 CriticalCVE-2026-84474 Auth required
Red Hat Ansible Automation Platform - Privilege Escalation & Remote Code Execution
Red Hat Ansible Automation Platform automation-controller contains a privilege escalation and remote code execution vulnerability caused by exposure of provisioning-callback secret and trusting client-supplied X-Forwarded-For header, letting minimally privileged or unauthenticated attackers execute jobs on arbitrary managed hosts, exploit requires empty proxy allow-list and read-level view_jobtemplate permission.
- 9.0 /10 CriticalCVE-2026-82843 Auth required
WP OAuth Server (Login with WordPress) - Authentication Bypass
WP OAuth Server (Login with WordPress) < 6.4.0 contains an authentication bypass caused by improper binding of OpenID Connect identity assertions to authorization grants, letting users with Subscriber role or higher authenticate as other users including administrators, exploit requires user to have Subscriber role or above.
- 9.8 /10 CriticalCVE-2026-82331 No auth
Apache BuildStream - Path Traversal
Apache BuildStream < 2.8.1 on Python < 3.12 contains a file write vulnerability caused by improper link resolution in the tar source plugin, letting attackers write files via symlinks during source fetching, exploit requires malicious source tarballs.
- 9.9 /10 CriticalCVE-2026-77602 Auth required
OpenC3 COSMOS - Remote Code Execution
OpenC3 COSMOS 5.1.0 to 7.3.0 contains a remote code execution caused by authenticated non-administrator users writing executable content under targets_modified/, letting attackers execute arbitrary code with elevated privileges, exploit requires authenticated non-admin user access.
- 9.8 /10 CriticalCVE-2026-76183 No auth
Apache Tomcat - Authentication Bypass
Apache Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121 contain an authentication bypass caused by alternate name handling in WebSocket endpoints, letting attackers bypass security constraints, exploit requires no special conditions.
- 9.1 /10 CriticalCVE-2026-75884 Auth required
AWX - Broken Access Control
AWX contains a broken access control caused by incomplete blocklist in container group pod_spec_override field, letting AAP platform administrators escalate privileges to OpenShift namespace-level access and exfiltrate secrets, exploit requires AAP platform administrator privileges.
- 9.0 /10 CriticalCVE-2026-75799 No auth
YAHMAN Add-ons WordPress plugin - Unrestricted File Upload
YAHMAN Add-ons WordPress plugin < 0.9.31 contains an unrestricted file upload vulnerability caused by lack of validation on remote files cached in a public directory, letting unauthenticated attackers upload arbitrary PHP files and achieve remote code execution when the feature is enabled.
- 9.8 /10 CriticalCVE-2026-6928
IBM Concert - Use After Free
IBM Concert 1.0.0 through 3.0.0 contains a use after free vulnerability caused by accessing memory after it has been freed, letting attackers corrupt memory, cause crashes, or execute arbitrary code, exploit requires attacker to influence program execution or input.
- 9.8 /10 CriticalCVE-2026-6730 No auth
IBM Concert - Buffer Overflow
IBM Concert 1.0.0 through 3.0.0 contains a buffer overflow caused by improper bounds checking, letting local users execute arbitrary code on the system, exploit requires local access.