Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 117 of 166

  • 9.1 /10 Critical
    CVE-2026-17645 Auth required

    IBM Financial Transaction Manager - Privilege Escalation

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a privilege escalation caused by improper privilege management, letting remote authenticated attackers gain elevated privileges.

  • 9.1 /10 Critical
    CVE-2026-17635 No auth

    IBM Financial Transaction Manager - Broken Access Control

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a broken access control caused by improper configuration of HTTP method-based security constraints, letting remote attackers perform unauthorized actions, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-17472 Auth required

    IBM Concert - Broken Access Control

    IBM Concert 1.0.0 through 3.0.0 contains a broken access control caused by use of wildcards in RBAC permission definitions, letting remote authenticated attackers access or modify unauthorized resources.

  • 9.9 /10 Critical
    CVE-2026-16346 Auth required

    IBM DataStage - Command Injection

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary commands.

  • 9.8 /10 Critical
    CVE-2026-13355 PoC publicNo auth

    Meta Box AIO - Privilege Escalation

    Meta Box AIO plugin for WordPress <= 3.11.0 contains a privilege escalation caused by lack of authorization checks in populate_via_query_string() and improper role validation in mb-user-profile component, letting unauthenticated attackers escalate to Administrator via crafted shortcode injection.

  • 9.8 /10 Critical
    CVE-2026-12718 No auth

    Karel Electronic Industry and Trade Inc. KarelIPS - SQL Injection

    Karel Electronic Industry and Trade Inc. KarelIPS <= 22092026 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2016-15059 No auth

    Net::IDN::Punycode - Buffer Overflow

    Net::IDN::Punycode < 2.301 for Perl contains a heap buffer overflow caused by unchecked writes past the output buffer in encode_punycode XS backend, letting attackers corrupt heap memory remotely, exploit requires crafted input string.

  • 9.8 /10 Critical
    CVE-2026-94301 No auth

    Apache MINA - Broken Access Control

    Apache MINA 2.0.29, 2.1.13, and later 2.0.x and 2.1.x versions contain an acceptMatchers filter bypass caused by missing resolveProxyClass() override, letting attackers bypass allow-list filters, exploit requires crafted proxy classes.

  • 9.9 /10 Critical
    CVE-2026-94101 Auth required

    Netcore NBR200V2 - Buffer Overflow

    Netcore NBR200V2 1.3.241127.071246 contains a buffer overflow caused by manipulation of the "wan_num" argument in vlan_load_form_uci function of /usr/bin/routerd, letting remote attackers cause memory corruption, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-94100 Auth required

    Netcore NBR200V2 - Buffer Overflow

    Netcore NBR200V2 1.3.241127.071246 contains a buffer overflow caused by manipulation of the argument vlan_wanX.ports in wan_config_set_vlan function of /usr/bin/routerd, letting remote attackers cause memory corruption, exploit requires remote access.

  • 9.9 /10 Critical
    CVE-2026-94099 Auth required

    Netcore NBR200V2 - Command Injection

    Netcore NBR200V2 1.3.241127.071246 contains a command injection caused by manipulation of the QUERY_STRING argument in restore.cgi Backup Restore component, letting remote attackers execute arbitrary commands, exploit requires crafted request.

  • 9.1 /10 Critical
    CVE-2026-94098 Auth required

    Netcore NBR200V2 - Command Injection

    Netcore NBR200V2 1.3.241127.071246 contains a command injection caused by manipulation of the QUERY_STRING argument in /www/cgi-bin/upgrade Firmware Upgrade CGI Endpoint, letting remote attackers execute arbitrary commands, exploit requires no special privileges.

  • 10.0 /10 Critical
    CVE-2026-94097 No auth

    Netcore NBR200V2 - Command Injection

    Netcore NBR200V2 1.3.241127.071246 contains a command injection caused by manipulation of the argument param/key/val in /www/cgi-bin/network_tools CGI Diagnostic Endpoint, letting remote attackers execute arbitrary commands, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-94096 Auth required

    Netcore NBR200V2 - Command Injection

    Netcore NBR200V2 1.3.241127.071246 contains a command injection caused by manipulation of the "ipv4" argument in /usr/bin/network_tools LAN IP Configuration Handler, letting remote attackers execute arbitrary commands, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-94095 PoC publicAuth required

    Netcore NBR200V2 - Command Injection

    Netcore NBR200V2 1.3.241127.071246 contains a command injection caused by manipulation of the "url" argument in /usr/bin/network_tools Traceroute Diagnostic Feature, letting remote attackers execute arbitrary commands, exploit requires no special privileges.