Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 117 of 125

  • 9.3 /10 Critical
    CVE-2026-8323 No auth

    Armiya Information Technologies Ltd. Co. Access Control System - Open Redirect

    Armiya Information Technologies Ltd. Co. Access Control System < 2 contains an open redirect vulnerability caused by improper validation of redirect URLs, letting attackers redirect users to untrusted sites, exploit requires user interaction.

  • 9.6 /10 Critical
    CVE-2026-82107 Auth required

    IBM DataStage - Authentication Bypass

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a broken authentication caused by improper authentication, letting remote authenticated attackers obtain sensitive information and bypass security restrictions.

  • 9.6 /10 Critical
    CVE-2026-82100 Auth required

    IBM DataStage on Cloud Pak for Data - Denial of Service

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability caused by improper input validation, letting remote authenticated attackers cause denial of service, exploit requires authentication.

  • 9.3 /10 Critical
    CVE-2026-81800 No auth

    Verified Reviews (Avis Vérifiés) - SQL Injection

    Verified Reviews (Avis Vérifiés) <= 2.4.6 contains an unauthenticated SQL injection caused by improper input sanitization, letting remote attackers execute arbitrary SQL queries, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-81468 Auth required

    Dell ThinOS - OS Command Injection

    Dell ThinOS < 2605_10.2616 contains an OS command injection caused by improper neutralization of special elements, letting high privileged remote attackers execute arbitrary commands.

  • 9.8 /10 Critical
    CVE-2026-81467 No auth

    Dell ThinOS - OS Command Injection

    Dell ThinOS < 2605_10.2616 contains an OS command injection caused by improper neutralization of special elements, letting unauthenticated remote attackers execute arbitrary commands, exploit requires remote access.

  • 9.8 /10 Critical
    CVE-2026-81204 No auth

    IBM Langflow OSS - Command Injection

    IBM Langflow OSS 1.0.0 through 1.11.5 contains a command injection caused by code injection during graph construction, letting remote attackers execute arbitrary code remotely, exploit requires crafted input.

  • 9.6 /10 Critical
    CVE-2026-81048 No auth

    Dell ThinOS - Command Injection

    Dell ThinOS < 2605_10.2616 contains a command injection caused by improper neutralization of special elements in command processing, letting unauthenticated adjacent network attackers execute remote code.

  • 9.4 /10 Critical
    CVE-2026-81046 No auth

    Dell ThinOS - Remote Code Execution

    Dell ThinOS < 2605_10.2616 contains a protection mechanism failure vulnerability allowing unauthenticated remote attackers to execute arbitrary code within the application context.

  • 9.1 /10 Critical
    CVE-2026-80424 Auth required

    IBM DataStage on Cloud Pak for Data - Path Traversal

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal caused by improper archive extraction, letting remote authenticated attackers create arbitrary files.

  • 9.8 /10 Critical
    CVE-2026-80352 No auth

    Apache Camel K - Code Injection

    Apache Camel K 2.0.0 < 2.9.3, 2.10.1 < 2.10.2 contains a code injection caused by improper control in custom resource YAML configuration, letting authorized CR authors create arbitrary Kubernetes objects, exploit requires authorized CR author privileges.

  • 9.8 /10 Critical
    CVE-2026-80351 No auth

    Apache Camel K - Expression Language Injection

    Apache Camel K 2.0.0 < 2.9.3, 2.10.1 < 2.10.2 contains an expression language injection caused by improper neutralization of directives in dynamically evaluated Maven configuration, letting tenant attackers execute arbitrary code with operator privileges, exploit requires tenant-controlled repository content.

  • 9.8 /10 Critical
    CVE-2026-79724 No auth

    IBM Langflow OSS - Command Injection

    IBM Langflow OSS 1.0.0 through 1.11.5 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote attackers execute arbitrary OS commands, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-78573 No auth

    IBM ContextForge MCP Gateway - Authentication Bypass

    IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 contains a broken authentication caused by use of default credentials, letting remote attackers gain administrative access, exploit requires default credentials to be unchanged.

  • 9.1 /10 Critical
    CVE-2026-78361 No auth

    zipMoney(Zip Co) Payments Plugin for WooCommerce - Broken Access Control

    zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin < 2.4.0 contains a broken access control vulnerability caused by lack of authorization checks on a front-end request handler, letting unauthenticated attackers delete arbitrary WordPress options, exploit requires no authentication.