Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 115 of 166

  • 9.8 /10 Critical
    CVE-2026-79313 No auth

    webpy web.py - Authentication Bypass

    webpy web.py 0.76 contains an insufficient session expiration vulnerability caused by reliance on periodic cleanup instead of last-access time checks, letting attackers replay expired sessions to access protected resources.

  • 9.8 /10 Critical
    CVE-2026-77987

    GitHub Enterprise Server - Server-Side Request Forgery

    GitHub Enterprise Server 3.17 through 3.22 contains a server-side request forgery caused by improper port validation in the notebook viewer, letting attackers extract instance secrets and achieve remote code execution, exploit requires network access and authentication depending on private mode.

  • 9.1 /10 Critical
    CVE-2026-77254 PoC public

    MCP Atlassian - Broken Access Control

    MCP Atlassian < 0.22.0 contains a broken access control vulnerability caused by allowing requests without per-user identity to use global Jira or Confluence credentials, letting network attackers perform operations with operator permissions, exploit requires lack of independent authentication boundary.

  • 10.0 /10 Critical
    CVE-2026-77244 PoC public

    MCP Atlassian - Broken Access Control

    MCP Atlassian < 0.22.0 contains a broken access control vulnerability caused by accepting requests without verified user identity in HTTP transport, letting network clients invoke Atlassian tools as the operator, exploit requires network access to MCP endpoint.

  • 9.8 /10 Critical
    CVE-2026-76709 No auth

    Analytics and Location Engine - Broken Access Control

    Analytics and Location Engine contains a broken access control vulnerability in the internal administrative component, letting unauthenticated remote attackers gain unauthorized write access to the file system with elevated privileges, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-76708 No auth

    Analytics and Location Engine - Authentication Bypass

    Analytics and Location Engine contains a hardcoded credentials vulnerability caused by use of default credentials for administrative and system accounts, letting unauthenticated remote attackers gain unauthorized access, exploit requires no special privileges.

  • 10.0 /10 Critical
    CVE-2026-75745 No auth

    Adobe Experience Manager Forms JEE - Authentication Bypass

    Adobe Experience Manager Forms JEE contains an incorrect authorization vulnerability that allows attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.1 /10 Critical
    CVE-2026-75728 No auth

    Adobe Campaign Classic - Authentication Bypass

    Adobe Campaign Classic contains an incorrect authorization vulnerability that allows attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 10.0 /10 Critical
    CVE-2026-75723 No auth

    Adobe Campaign Classic - Authentication Bypass

    Adobe Campaign Classic contains an incorrect authorization vulnerability that allows attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 10.0 /10 Critical
    CVE-2026-75721 No auth

    Adobe Campaign Classic - Command Injection

    Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 10.0 /10 Critical
    CVE-2026-75703 No auth

    Adobe Campaign Classic - Code Injection

    Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 10.0 /10 Critical
    CVE-2026-75699 No auth

    Adobe Campaign Classic - Code Injection

    Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.3 /10 Critical
    CVE-2026-75698 No auth

    Adobe Connect - Reflected XSS

    Adobe Connect contains a reflected XSS caused by improper input sanitization, letting attackers inject malicious scripts to gain elevated access or control, exploit requires victim interaction with crafted URL or page.

  • 9.3 /10 Critical
    CVE-2026-75697 No auth

    Adobe Connect - Stored XSS

    Adobe Connect contains a stored XSS vulnerability caused by improper sanitization of form fields, letting attackers inject malicious scripts that execute in victim browsers, potentially gaining elevated access, exploit requires victim to visit the malicious page.

  • 9.3 /10 Critical
    CVE-2026-75689 No auth

    Adobe Connect - Stored XSS

    Adobe Connect contains a stored XSS vulnerability caused by improper sanitization of form fields, letting attackers inject malicious scripts that execute in victim browsers, potentially gaining elevated access, exploit requires victim to visit the malicious page.