Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 118 of 166

  • 9.8 /10 Critical
    CVE-2026-93012 No auth

    Email::Sender::Transport::Sendmail - Command Injection

    Email::Sender::Transport::Sendmail < 2.602 for Perl contains a command injection caused by unsafe shell command construction on Windows in _sendmail_pipe, letting attackers execute arbitrary commands via crafted email headers, exploit requires attacker control of email headers.

  • 9.8 /10 Critical
    CVE-2026-88405 No auth

    Univer - Remote Code Execution

    Univer v1.0.0-alpha.2 contains a remote code execution caused by crafted payload in RemoteRegisterFunctionService function, letting remote attackers execute arbitrary code, exploit requires crafted payload.

  • 9.8 /10 Critical
    CVE-2026-88404 No auth

    Univer - Remote Code Execution

    Univer v1.0.0-alpha.2 contains a remote code execution caused by crafted payload in UniscriptExecutionService.execute() function, letting remote attackers execute arbitrary code, exploit requires crafted payload.

  • 9.8 /10 Critical
    CVE-2026-88402 No auth

    nocobase - SQL Injection

    nocobase v2.1.21 contains a sql injection caused by improper sanitization in the checkSQL function, letting attackers access sensitive database information via crafted SQL statements, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-86473 No auth

    Apache Airflow - Authentication Bypass

    Apache Airflow Core API contains a broken authentication caused by logout endpoint revoking only session tokens from cookies but not bearer tokens, letting attackers with stolen bearer tokens maintain access after victim logout, exploit requires attacker to already possess a valid token.

  • 9.8 /10 Critical
    CVE-2026-85751 No auth

    Mailu - Authentication Bypass

    Mailu 2.0 to 2024.06.55 and helm-charts prior to 2.7.3 contain an authentication bypass caused by trusting client-controlled X-Forwarded-By header when REAL_IP_HEADER is unset, letting unauthenticated remote attackers bypass proxy authentication, exploit requires PROXY_AUTH_WHITELIST configured and REAL_IP_HEADER unset.

  • 9.8 /10 Critical
    CVE-2026-82187 No auth

    Web to Print Online Designer WordPress - Unrestricted File Upload

    Web to Print Online Designer WordPress plugin < 2.15.0 contains an unrestricted file upload vulnerability caused by lack of validation on file type and extension, letting unauthenticated attackers upload and execute arbitrary code remotely, exploit requires no authentication.

  • 9.9 /10 Critical
    CVE-2026-79920 Auth required

    Ajenti - Command Injection

    Ajenti < 2.2.16 contains a command injection caused by unvalidated plugin package name and version in /api/core/tasks/start, letting authenticated users execute code as root, exploit requires user authentication.

  • 9.1 /10 Critical
    CVE-2026-79916 Auth required

    MaxKB - Command Injection

    MaxKB < 2.10.5-lts contains a command injection caused by unsafe parsing of control characters in AWS credentials fields, letting authenticated workspace members execute commands as root, exploit requires authentication.

  • 9.8 /10 Critical
    CVE-2026-78847 No auth

    gray-matter - Remote Code Execution

    gray-matter All versions contains a remote code execution caused by use of eval() in lib/engines.js to parse front matter with language set to js/javascript, letting attackers execute arbitrary code remotely, exploit requires crafted front matter input.

  • 10.0 /10 Critical
    CVE-2026-77521 PoC publicNo auth

    MaxKB - Command Injection

    MaxKB prior to 2.10.5-lts contains a command injection caused by exposed execute shell tool in SandboxShellBackend without proper restrictions, letting untrusted content cause command execution without human approval, exploit requires untrusted input.

  • 9.8 /10 Critical
    CVE-2026-67827 No auth

    ZLMediaKit - Broken Access Control

    ZLMediaKit contains an incorrect access control vulnerability caused by unauthenticated access to the setServerConfig API endpoint, letting remote attackers achieve remote code execution by overwriting ffmpeg.snap with shell commands, exploit requires no authentication.

  • 9.3 /10 Critical
    CVE-2026-58491 No auth

    Warpgate - Stored XSS & Open Redirect

    Warpgate < 0.25.5 contains a stored XSS and open redirect caused by unescaped attacker-controlled 'next' parameter in SSO endpoints, letting attackers execute scripts in authenticated sessions and redirect users, exploit requires victim interaction.

  • 9.1 /10 Critical
    CVE-2026-36469 No auth

    CuteNews - Server-Side Request Forgery

    CuteNews 2.1.2 contains a server-side request forgery caused by improper validation in core/modules/media.php upload_from_inet, letting attackers make arbitrary requests from the server, exploit requires access to the Upload by URL feature.

  • 9.1 /10 Critical
    CVE-2025-12999

    Open VSX - Open Redirect & Cache Poisoning

    Open VSX contains a cache poisoning vulnerability caused by unvalidated use of X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Prefix headers in URL construction, letting unauthenticated remote attackers inject malicious URLs into cached metadata, exploit requires a proxy that relays client headers without overwriting.