Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 115 of 125
- 9.8 /10 CriticalCVE-2026-71644
Robotics-STAR-Lab RACER Tested - Unsafe Trajectory Planning
Robotics-STAR-Lab RACER Tested commit abcdef1234567890 contains an unsafe trajectory planning vulnerability caused by a missing default case in the FSM stopping swarm trajectory publishing when drone enters IDLE, letting attackers cause UAV collisions, exploit requires control over drone state.
- 9.8 /10 CriticalCVE-2026-62105 No auth
ThemeREX Addons - Remote Code Execution
ThemeREX Addons < 2.45.0 contains an unauthenticated PHP Object Injection caused by improper handling of serialized data, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-62103 No auth
Everest Forms - Insecure Deserialization
Everest Forms <= 3.6.0 contains an insecure deserialization vulnerability caused by unauthenticated PHP object injection, letting remote attackers execute arbitrary code, exploit requires no authentication.
- 9.3 /10 CriticalCVE-2026-54072 No auth
Authorizer - Open Redirect
Authorizer prior to 2.2.1 contains an open redirect vulnerability caused by lack of validation of redirect_uri in /authorize endpoint, letting unauthenticated attackers steal tokens via attacker-supplied URLs, exploit requires attacker to obtain client_id from public endpoint.
- 9.8 /10 CriticalCVE-2026-53952 No auth
GetSimple CMS - Authentication Bypass
GetSimple CMS <= 3.4.0a and GetSimpleCMS-CE <= 3.3.22 contain an authentication bypass caused by a logic flaw in the automated deletion of admin/setup.php, letting unauthenticated attackers create new admin accounts, exploit requires access to setup script post-installation.
- 9.8 /10 CriticalCVE-2026-52630 No auth
Woltlab WCF - SQL Injection
Woltlab WCF <= 6.2.4 contains a SQL injection caused by improper sanitization in UserEditor.class.php and UserAction.class.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted requests.
- 9.8 /10 CriticalCVE-2026-14563 No auth
advanced-customized-prompts WordPress - Authentication Bypass
advanced-customized-prompts WordPress plugin through 1.0.1 contains an authentication bypass caused by lack of password verification before issuing authenticated sessions, letting unauthenticated attackers log in as any user or create accounts, exploit requires no authentication.
- 10.0 /10 CriticalCVE-2026-14560 No auth
teddy-bear-customize-addon WordPress - Unrestricted File Upload
teddy-bear-customize-addon WordPress plugin through 1.0.5 contains an unrestricted file upload vulnerability caused by improper validation of uploaded files relying on client-supplied content type and original filename, letting unauthenticated attackers upload and execute arbitrary PHP code on the server, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-14559 No auth
teddy-bear-customize-addon WordPress - Authentication Bypass
teddy-bear-customize-addon WordPress plugin through 1.0.5 contains a broken authentication caused by lack of password verification before user authentication, letting unauthenticated attackers log in as any registered user by supplying only the user's email address.
- 9.8 /10 CriticalCVE-2026-9163 No auth
GIS Informatics GisLab Laboratory Management System - SQL Injection
GIS Informatics GisLab Laboratory Management System >= 1.4.03 and < 1.5 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.
- 9.9 /10 CriticalCVE-2026-89094 Auth required
Forgejo - Remote Code Execution
Forgejo < 16.0.4 contains a remote code execution caused by mishandled template expansion in .forgejo/template files, letting remote attackers execute arbitrary code, exploit requires crafted template repository.
- 9.1 /10 CriticalCVE-2026-89086 No auth
jose OCaml - Authentication Bypass
jose package for OCaml < 0.11.0 contains a broken authentication caused by incomplete RSA signature validation that only checks PKCS #1 decoding without verifying the public key, letting attackers bypass signature verification, exploit requires crafted signature input.
- 9.9 /10 CriticalCVE-2026-89049 Auth required
Amazon AWS Systems Manager Agent - Server-Side Request Forgery
Amazon AWS Systems Manager Agent (SSM Agent) < 3.3.4851.0 contains a server-side request forgery caused by improper validation of equivalent address representations in port forwarding, letting authenticated remote users bypass denylist and access link-local endpoints, exploit requires authentication.
- 9.1 /10 CriticalCVE-2026-89042 No auth
passport-saml-encrypted - Authentication Bypass
passport-saml-encrypted <= 0.1.13 contains an authentication bypass caused by conditional SAML signature verification based on an optional cert option, letting attackers submit unsigned SAML responses to bypass authentication, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-88899 PoC publicNo auth
OpenCode - Path Traversal
OpenCode < 0.31.0 contains a path traversal caused by improper validation of the x-opencode-directory header in /api/opencode proxy endpoint, letting remote attackers perform file operations outside the project root, exploit requires crafted request.