Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 114 of 166
- 9.9 /10 CriticalCVE-2026-82010 Auth required
Adobe Campaign Classic - SQL Injection
Adobe Campaign Classic contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting low-privileged attackers execute arbitrary code, exploit requires no user interaction.
- 9.1 /10 CriticalCVE-2026-82009 Auth required
Adobe Campaign Classic - SQL Injection
Adobe Campaign Classic contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers with high privileges execute arbitrary SQL commands, exploit requires high privileges.
- 9.9 /10 CriticalCVE-2026-82008 Auth required
Adobe Campaign Classic - Remote Code Execution
Adobe Campaign Classic contains an improper input validation vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.
- 9.6 /10 CriticalCVE-2026-82000 Auth required
Adobe Experience Manager Forms JEE - Privilege Escalation
Adobe Experience Manager Forms JEE contains a server-side request forgery caused by improper validation of URLs, letting low-privileged attackers escalate privileges by accessing internal resources, exploit requires no user interaction.
- 9.1 /10 CriticalCVE-2026-81995 Auth required
Adobe Experience Manager Forms JEE - Remote Code Execution
Adobe Experience Manager Forms JEE contains an improper input validation vulnerability that allows attackers with high privileges to execute arbitrary code in the context of the current user, exploit requires high privileges.
- 9.1 /10 CriticalCVE-2026-80156 Auth required
Lantronix SLC8000 - Path Traversal & Remote Code Execution
Lantronix SLC8000 < 9.7.0.5, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint, letting authenticated attackers write arbitrary data outside intended directories, leading to remote code execution.
- 10.0 /10 CriticalCVE-2026-80155 No auth
Lantronix SLC8000 - Authentication Bypass
Lantronix SLC8000 < 9.7.0.5, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass caused by path traversal in the web management portal upload endpoint, letting unauthenticated attackers read sensitive files and upload arbitrary files leading to remote code execution, exploit requires crafted cookie value.
- 9.6 /10 CriticalCVE-2026-80154 No auth
Lantronix - Authentication Bypass
Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 firmware contain an authentication bypass caused by predictable session token generation and crafted URI exploiting file extension handling in web management portal, letting unauthenticated attackers bypass source IP and User-Agent validation to gain elevated privileges.
- 9.1 /10 CriticalCVE-2026-80152 Auth required
Lantronix SLC8000 & EMG8500/EMG7500 - Command Injection
Lantronix SLC8000 < 9.7.0.3, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain a command injection caused by unsanitized input in the set script schedule command, letting authenticated attackers with services permission execute arbitrary shell commands as root.
- 9.1 /10 CriticalCVE-2026-80151 Auth required
Lantronix SLC8000 - Command Injection
Lantronix SLC8000 < 9.7.0.3, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain a command injection caused by unsanitized input in the set nfs download command, letting authenticated attackers with services permission execute arbitrary shell commands as root.
- 9.9 /10 CriticalCVE-2026-80147 Auth required
Lantronix SLC8000 - Buffer Overflow
Lantronix SLC8000 < 9.7.0.2, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow caused by an undocumented mfc eeprom write command copying unbounded input into a stack buffer, letting authenticated attackers execute arbitrary code via terminal or CLI interface.
- 9.9 /10 CriticalCVE-2026-80146 Auth required
Lantronix SLC8000 - Remote Code Execution
Lantronix SLC8000 < 9.7.0.2, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow caused by an undocumented mfc eeprom read command copying unbounded input to a stack buffer, letting authenticated attackers execute arbitrary code via system() call.
- 9.1 /10 CriticalCVE-2026-80145 Auth required
Lantronix SLC8000 - Command Injection
Lantronix SLC8000 < 9.7.0.2, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain a command injection caused by unsanitized input in the set cifs password command, letting authenticated attackers with services permission execute arbitrary shell commands as root.
- 9.9 /10 CriticalCVE-2026-80144 Auth required
Lantronix SLC8000 - Command Injection
Lantronix SLC8000 < 9.7.0.2, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain a command injection caused by unsanitized input in an undocumented mfc eeprom write command, letting authenticated attackers execute arbitrary shell commands as root, exploit requires authentication.
- 9.9 /10 CriticalCVE-2026-80143 Auth required
Lantronix SLC8000 & EMG8500/EMG7500 - Command Injection
Lantronix SLC8000 < 9.7.0.2, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain a command injection caused by unsanitized input in an undocumented mfc eeprom read command, letting authenticated attackers execute arbitrary shell commands as root, exploit requires authentication.