Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 112 of 166
- 9.8 /10 CriticalCVE-2026-6721 No auth
IBM Concert - Command Injection
IBM Concert 1.0.0 through 3.0.0 contains a command injection caused by incorporation of specially crafted input into OS commands, letting unauthenticated remote attackers execute arbitrary commands, exploit requires no authentication.
- 10.0 /10 CriticalCVE-2026-59167 No auth
SunEditor - Stored XSS
SunEditor < 2.47.11 contains a stored XSS caused by inconsistent sanitization of namespaced or custom HTML elements in src/lib/core.js, letting attackers execute scripts in the browser via crafted content, exploit requires user interaction.
- 9.9 /10 CriticalCVE-2026-19599 Auth required
ZohoCorp ManageEngine OpManager MSP - Remote Code Execution
ZohoCorp ManageEngine OpManager MSP <= 12.8.709 contains a remote code execution caused by a flaw in the Notification Profile module, letting remote attackers execute arbitrary code, exploit requires no special privileges.
- 9.3 /10 CriticalCVE-2026-18872 No auth
IBM Financial Transaction Manager (FTM) - Stored XSS
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a stored cross-site scripting caused by script injection in the NetworkAcknowledgement React component, letting authenticated operators have their sessions hijacked and perform unauthorized payment actions, exploit requires operator authentication.
- 9.8 /10 CriticalCVE-2025-63564 No auth
Moodle Socialwall - SQL Injection
Moodle Socialwall plugin v3.0 through v3.3 contains a sql injection caused by improper sanitization of input in HTTP requests, letting attackers execute arbitrary code remotely, exploit requires crafted HTTP requests.
- 9.8 /10 CriticalCVE-2026-95675 CISA KEVPoC publicNo auth
D-Link DAP-1360 - Remote Code Execution
D-Link DAP-1360 <= 6.14 contains an unauthenticated remote code execution caused by crafted requests to the web management interface, letting remote attackers execute arbitrary commands as root, exploit requires no authentication.
- 10.0 /10 CriticalCVE-2026-94493 No auth
Gigatech PDV5701 - Authentication Bypass
Gigatech PDV5701 1.0.31_240305_112640 contains an authentication bypass caused by manipulation in WebSocket Service component /index.html, letting remote attackers bypass authentication, exploit requires no special conditions.
- 9.1 /10 CriticalCVE-2026-94456 No auth
Postiz - Authentication Bypass
Postiz contains a broken authentication caused by use of non-cryptographically secure Math.random() for generating security-sensitive credentials, letting unauthenticated attackers reconstruct PRNG state and compromise OAuth credentials, exploit requires access to OAuth dynamic client registration endpoint.
- 9.8 /10 CriticalCVE-2026-94127 CISA KEVPoC publicNo auth
F5 BIG-IP - Remote Code Execution
F5 BIG-IP APM with OAuth profile configured on a virtual server contains a remote code execution vulnerability caused by specific malicious traffic, letting unauthenticated attackers execute code remotely, exploit requires crafted malicious traffic.
- 10.0 /10 CriticalCVE-2026-93952 CISA KEVNo auth
VeloCloud Orchestrator - Broken Access Control
VeloCloud Orchestrator (VCO) contains a broken access control vulnerability allowing remote attackers to access privileged internal functionality, potentially compromising confidentiality, integrity, and availability, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-93616 CISA KEVPoC publicNo auth
Check Point Management Server - Unrestricted File Upload
Check Point Management Server contains a directory traversal and unrestricted file upload vulnerability allowing unauthenticated attackers to upload and execute arbitrary scripts remotely, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-93088
SGLang multimodal generation runtime - Remote Code Execution
SGLang multimodal generation runtime contains an unauthenticated arbitrary code execution caused by ZeroMQ ROUTER socket in DiffusionServer passing unvalidated data to pickle.loads(), letting unauthenticated attackers execute arbitrary code remotely, exploit requires network access to the socket.
- 9.1 /10 CriticalCVE-2026-89282 No auth
Apache HTTP Server - Broken Access Control
Apache HTTP Server Windows distribution by Apache Lounge contains an insecure installation directory permissions vulnerability caused by default directory permissions on C:\, letting authenticated users write to the directory, exploit requires authenticated user access.
- 9.9 /10 CriticalCVE-2026-89276 Auth required
Adobe Campaign Classic - Code Injection
Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting low-privileged attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.
- 10.0 /10 CriticalCVE-2026-89275 No auth
Adobe Campaign Classic - Code Injection
Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.