Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 116 of 166

  • 9.3 /10 Critical
    CVE-2026-75686 No auth

    Adobe Connect - Remote Code Execution

    Adobe Connect contains an improper input validation vulnerability that allows attackers to execute arbitrary code in the context of the current user, exploit requires victim interaction with a malicious URL or web page.

  • 9.3 /10 Critical
    CVE-2026-75684 No auth

    Adobe Connect - Stored XSS

    Adobe Connect contains a stored XSS vulnerability caused by improper sanitization of form fields, letting attackers inject malicious scripts that execute in victim browsers, potentially gaining elevated access, exploit requires victim to visit the malicious page.

  • 9.9 /10 Critical
    CVE-2026-75682 Auth required

    Adobe Connect - SQL Injection

    Adobe Connect contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting low-privileged attackers execute arbitrary SQL commands and potentially escalate privileges, exploit requires no user interaction.

  • 9.8 /10 Critical
    CVE-2026-74849 No auth

    Zohocorp ManageEngine ADSelfService Plus - Remote Code Execution

    Zohocorp ManageEngine ADSelfService Plus < 7001 contains a remote code execution vulnerability caused by an issue in the GINA client, letting remote attackers execute arbitrary code, exploit requires network access.

  • 10.0 /10 Critical
    CVE-2026-73369 No auth

    Adobe Campaign Classic - Code Injection

    Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.8 /10 Critical
    CVE-2026-65113 No auth

    NVIDIA Infrastructure Controller for Linux - Hardcoded Credentials

    NVIDIA Infrastructure Controller for Linux contains a hardcoded credentials vulnerability caused by use of hard-coded credentials, letting attackers escalate privileges, tamper data, cause denial of service, and disclose information, exploit requires no special conditions.

  • 9.9 /10 Critical
    CVE-2026-57149 Auth required

    Plone plone.app.portlets.portlets - Server-Side Template Injection

    Plone plone.app.portlets.portlets 5.0.0 to <5.0.8, <6.0.4, and <7.0.2 contains a code execution vulnerability caused by unsafe evaluation of user-supplied TALES expressions in the Classic portlet template, letting authenticated users execute arbitrary code, exploit requires ability to add or edit Classic portlets.

  • 9.8 /10 Critical
    CVE-2026-47116

    LTSecurity LTK3500SF - Hardcoded Credentials

    LTSecurity LTK3500SF contains a hardcoded credentials vulnerability caused by reversible hashed root and guest passwords in /etc/shadow, letting attackers authenticate via Telnet or SSH to gain root access, exploit requires access to hashed passwords.

  • 9.8 /10 Critical
    CVE-2026-43641 No auth

    Softaculous Virtualizor - OS Command Injection

    Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection caused by deserialization of crafted billing_data POST field in the billing module handler, letting unauthenticated remote attackers execute arbitrary commands as root, exploit requires specific parameter combinations to bypass authentication.

  • 9.8 /10 Critical
    CVE-2026-28324

    SolarWinds Observability Self-Hosted - Remote Code Execution

    SolarWinds Observability Self-Hosted contains a remote code execution vulnerability caused by insufficient integrity checks in non-default, non-secure configurations, letting unauthenticated attackers execute code remotely, exploit requires non-default insecure configuration.

  • 9.8 /10 Critical
    CVE-2026-25254 No auth

    Unspecified Product - Remote Code Execution

    An unspecified product contains a remote code execution caused by improper authorization in the SocketIO interface, letting attackers execute arbitrary code remotely, exploit requires no special conditions.

  • 9.8 /10 Critical
    CVE-2026-19658 PoC public

    GiveWP Give Tributes - Insecure Deserialization

    GiveWP Give Tributes plugin for WordPress <= 2.3.1 contains a PHP Object Injection caused by deserialization of untrusted input when 'Allow Multiple Recipients' is enabled and 'Custom Message' is disabled, letting unauthenticated attackers inject PHP objects, exploit requires specific plugin settings and presence of a POP chain in other plugins or themes.

  • 9.9 /10 Critical
    CVE-2026-18169 Auth required

    IBM Financial Transaction Manager - Information Disclosure

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains an information disclosure vulnerability caused by improper validation of symbolic links, letting remote authenticated attackers obtain sensitive information.

  • 9.8 /10 Critical
    CVE-2026-18163 No auth

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift - Insecure Deserialization

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains an insecure deserialization vulnerability caused by improper deserialization of untrusted data, letting remote attackers execute arbitrary code, exploit requires crafted malicious input.

  • 9.8 /10 Critical
    CVE-2026-18162 No auth

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift - Remote Code Execution

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a remote code execution vulnerability caused by improper neutralization of user-controlled input within the new Function constructor, letting remote attackers execute arbitrary code, exploit requires no special conditions.