Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 116 of 125

  • 9.8 /10 Critical
    CVE-2026-88877 PoC publicNo auth

    Traefik - Authentication Bypass & Broken Access Control

    Traefik v3.7.0 to v3.7.11 contains a broken access control vulnerability caused by mishandling of Kubernetes ingress-nginx annotations, letting attackers bypass authentication and other middlewares, exploit requires crafted Host header with non-numeric or empty port.

  • 9.3 /10 Critical
    CVE-2026-88869 No auth

    AVideo - Stored XSS

    AVideo contains a stored XSS caused by improper escaping of the "label" parameter in AD_Server plugin's log.php endpoint, letting unauthenticated attackers execute arbitrary JavaScript in admin browser sessions.

  • 9.1 /10 Critical
    CVE-2026-88864 Auth required

    Capgo - Broken Access Control

    Capgo contains a broken access control vulnerability caused by unrestricted write access to the public.sso_providers table via Supabase PostgREST, letting attackers with a full API key bypass SSO provisioning controls and enforce arbitrary SSO, exploit requires possession of a full API key.

  • 9.4 /10 Critical
    CVE-2026-88285 No auth

    GeoVision GV-LPC2211 - Broken Access Control

    GeoVision GV-LPC2211 V1.13 contains a broken access control vulnerability caused by an unauthenticated network-accessible PTZ control service, letting remote attackers retrieve PTZ information and issue PTZ or raw serial commands, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-88278

    GeoVision GV-LPC2211 - Authentication Bypass

    GeoVision GV-LPC2211 V1.13 contains a replay attack vulnerability caused by failure to enforce WS-Security UsernameToken freshness or nonce reuse protection, letting attackers replay captured PasswordDigest tokens for ONVIF operations, exploit requires captured token.

  • Critical
    CVE-2026-88062 CISA KEV

    OmniRoute - Remote Code Execution

    OmniRoute <= 3.8.49 contains a remote code execution caused by insufficient validation of interpreter arguments in the POST /api/acp/agents endpoint, letting remote attackers execute arbitrary code, exploit requires anonymous access when requireLogin is false or management session/API key when true.

  • 9.1 /10 Critical
    CVE-2026-88056 PoC public

    Angular - Server-Side Request Forgery

    Angular < 20.3.30, 21.2.22, 22.1.4 contains a server-side request forgery caused by improper URL trimming in resolveUrl and parseUrl utilities, letting attackers cause SSRF and credential disclosure, exploit requires sensitive server-side credentials attached to requests.

  • 9.1 /10 Critical
    CVE-2026-88044 No auth

    rclone - Authentication Bypass

    rclone 1.70.0 to 1.75.1 contains an authentication proxy bypass caused by incorrect checking of process-global proxy.Opt.AuthProxy instead of per-server proxyOpt.AuthProxy in FTP and S3 constructors, letting attackers bypass intended proxy authentication, exploit requires crafted requests to affected RC interface.

  • 9.8 /10 Critical
    CVE-2026-88018 No auth

    rclone - Authentication Bypass

    rclone < 1.75.1 contains an authentication bypass caused by authPairMiddleware registering any client-chosen accessKeyID with an empty secret in s3 serve mode with --auth-proxy but without --auth-key, letting unauthenticated network attackers access backend services, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-88008 PoC public

    Traefik - Authentication Bypass

    Traefik 2.11.26 to 2.11.57 and 3.7.13 contain an authentication bypass caused by forwarding client-supplied Upgrade headers to backends supporting h2c, letting unauthenticated attackers access protected routes, exploit requires backend accepting h2c and returning 101 Switching Protocols.

  • 9.1 /10 Critical
    CVE-2026-88007

    Traefik - Authentication Bypass

    Traefik 2.11.0 to 2.11.57 and 3.7.13 contain an authentication bypass caused by shared backend transport usage in HTTP/3 ConnContext, letting attackers reuse authenticated backend connections to impersonate victims, exploit requires HTTP/3 and connection-bound NTLM or Negotiate authentication enabled.

  • 9.6 /10 Critical
    CVE-2026-87931 No auth

    Behavioral Technology Group Pavlok Behavioral Conditioning Wearable - Buffer Overflow

    Behavioral Technology Group Pavlok Behavioral Conditioning Wearable <= 20260707 contains a buffer overflow caused by manipulation in Apple Notification Center Service Event Handler, letting local network attackers cause memory corruption, exploit requires local network access.

  • 9.1 /10 Critical
    CVE-2026-85228 No auth

    Amazon Deep Java Library - Integer Overflow

    Amazon Deep Java Library (DJL) 0.13.0 through 0.36.0 contains an integer overflow caused by improper tensor buffer validation, letting remote unauthenticated actors cause denial of service or information disclosure via crafted tensor payloads.

  • 9.8 /10 Critical
    CVE-2026-85025 No auth

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.11.5 contains a remote code execution caused by improper enforcement of public-flow security restrictions and session isolation controls in MCP project endpoints, letting unauthenticated attackers execute arbitrary code and access or modify chat sessions, exploit requires publicly shared MCP project endpoints.

  • 9.1 /10 Critical
    CVE-2026-84939 No auth

    Apache FreeMarker - Path Traversal

    Apache FreeMarker 2.2.0 through 2.3.34 contains a path traversal caused by specifying a malformed locale identifier with localized lookup enabled, letting attackers access unintended template files, exploit requires localized lookup enabled.