Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 113 of 166
- 9.1 /10 CriticalCVE-2026-88624 No auth
openCode - Path Traversal
openCode v1.18.26 contains a path traversal caused by missing path validation in the Worktree.remove component, letting attackers execute arbitrary recursive directory deletion, exploit requires crafted payload.
- 9.8 /10 CriticalCVE-2026-88416 No auth
MCMS - SQL Injection
MCMS 6.1.1 through 6.2.1 contains a sql injection caused by improper sanitization in the custom model/form import feature, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-88414 No auth
MCMS - SQL Injection
MCMS 6.1.1 through 6.2.1 contains a sql injection caused by unsanitized input in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do), letting attackers execute arbitrary SQL commands remotely, exploit requires crafted request.
- 8.1 /10 CriticalCVE-2026-87902 CISA KEVPoC publicNo auth
Unknown Product - Remote Code Execution
An unauthenticated attacker can exploit a file inclusion vulnerability in get_page_template() causing inclusion of arbitrary readable local .php files outside active theme directories, potentially leading to remote code execution if server and theme conditions are met.
- 9.8 /10 CriticalCVE-2026-87121 No auth
lwIP TCP/IP Stack - Remote Code Execution
lwIP TCP/IP Stack MQTT contains an out-of-bounds write vulnerability in the MQTT component, letting attackers gain full code execution on the device, exploit requires network access.
- 9.1 /10 CriticalCVE-2026-87080 No auth
Net::IDN::Punycode - Logic Error
Net::IDN::Punycode::PP before 2.590 for Perl contains a logic error in decode_punycode caused by improper handling of truncated labels in the pure-Perl decoder, letting attackers cause inconsistent name resolution, exploit requires crafted punycode labels.
- 9.1 /10 CriticalCVE-2026-87078 No auth
Net::IDN::Punycode - Denial of Service
Net::IDN::Punycode versions >= 2.302 and < 2.590 for Perl contain a memory leak caused by improper buffer release in decode_punycode XS backend, letting attackers cause memory exhaustion by sending invalid labels, exploit requires attacker to supply invalid labels.
- 9.6 /10 CriticalCVE-2026-86059 Auth required
Dokploy - Broken Access Control
Dokploy < 0.29.13 contains an information disclosure caused by missing access control checks in provider and application routes, letting organization members without Git provider access retrieve plaintext credentials, exploit requires application read access or provider identifier.
- 9.1 /10 CriticalCVE-2026-85734 No auth
LightRAG - Authentication Bypass
LightRAG < 1.5.5 contains a broken authentication caused by lack of rate limiting and account lockout on POST /login endpoint, letting network attackers perform brute force attacks to gain authenticated access, exploit requires network access.
- 10.0 /10 CriticalCVE-2026-84412 No auth
Adobe Campaign Classic - Code Injection
Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.
- 9.6 /10 CriticalCVE-2026-84388 PoC publicNo auth
Fortinet FortiPAM Chrome Extension - Information Disclosure
Fortinet FortiPAM Chrome Extension 7.4 and 8.0 contain an improper restriction of rendered UI layers vulnerability, letting remote unauthenticated attackers disclose information, exploit requires no special privileges.
- 9.9 /10 CriticalCVE-2026-83660 No auth
Adobe Campaign Classic - Privilege Escalation
Adobe Campaign Classic contains a server-side request forgery caused by improper validation of URLs, letting attackers escalate privileges, exploit requires no user interaction.
- 9.6 /10 CriticalCVE-2026-82443 Auth required
Adobe Campaign Classic - Privilege Escalation
Adobe Campaign Classic contains a server-side request forgery caused by improper validation of URLs, letting low-privileged attackers escalate privileges by accessing internal resources, exploit requires no user interaction.
- 9.9 /10 CriticalCVE-2026-82013 Auth required
Adobe Campaign Classic - Privilege Escalation
Adobe Campaign Classic contains a server-side request forgery caused by improper validation of URLs, letting low-privileged attackers escalate privileges by accessing internal resources, exploit requires no user interaction.
- 9.1 /10 CriticalCVE-2026-82011 Auth required
Adobe Campaign Classic - SQL Injection
Adobe Campaign Classic contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting low-privileged attackers bypass security to gain unauthorized read and limited write access, exploit requires no user interaction.