Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 119 of 166
- 10.0 /10 CriticalCVE-2026-94089 No auth
D-Link DIR-868L - Buffer Overflow
D-Link DIR-868L 2.01b05 contains a stack-based buffer overflow caused by improper handling of the id/password argument in /webfa_authentication.cgi Authentication Handler, letting remote attackers execute code, exploit requires crafted input.
- 9.4 /10 CriticalCVE-2026-94084
Suricata - Use After Free
Suricata < 8.0.7 contains a use-after-free vulnerability caused by improper handling of Http2ThreadMultiBuf during inspection of transactions by rules using http.response_header with and without a transform, letting attackers cause memory corruption or denial of service, exploit requires crafted rules triggering the condition.
- 9.4 /10 CriticalCVE-2026-94083 No auth
Suricata - Denial of Service
Suricata < 8.0.7 contains a type confusion caused by improper cleanup of HTTP2 state during DoH2 requests with HTTP1 to HTTP2 upgrade, letting attackers cause denial of service, exploit requires app-layer.protocols.doh2 enabled.
- 10.0 /10 CriticalCVE-2026-94003 No auth
Comfast CF-N1-S - Buffer Overflow
Comfast CF-N1-S 2.6.0.1 contains a stack-based buffer overflow caused by manipulation of input in get_css_path_from_uri function in /cgi-bin/mbox-config Web Management Interface, letting remote attackers execute arbitrary code, exploit requires crafted request.
- 9.1 /10 CriticalCVE-2026-93958 PoC publicAuth required
D-Link R95 - Command Injection
D-Link R95 BE9500_1.00.16 contains a command injection caused by manipulation of the NTPServer argument in /bin/ssi DHMAPI component, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-90817 CISA KEVPoC publicNo auth
REDCap - Remote Code Execution
REDCap >= 13.3.0 contains a remote code execution caused by manipulation of HTTP requests and crafted file-path/stream parameters in survey passthrough routing and Data Import processing, letting unauthenticated attackers remotely execute code, exploit requires knowledge of a valid public survey hash.
- 9.9 /10 CriticalCVE-2026-93985 Auth required
OpenPanel js-runtime - Remote Code Execution
OpenPanel js-runtime contains a sandbox escape vulnerability caused by failure to block computed member access to constructor chains in the JavaScript webhook template validator, letting attackers with project write access execute arbitrary code in the worker process.
- 9.9 /10 CriticalCVE-2026-93742 Auth required
Totolink A3002MU - Command Injection
Totolink A3002MU Hh-B20211125.1046 contains a command injection caused by manipulation of the "localPin" argument in /boafrm/formWsc, letting remote attackers execute arbitrary commands, exploit requires no special privileges.
- 10.0 /10 CriticalCVE-2026-93741 No auth
Totolink A3002MU - Buffer Overflow
Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "submit-url" argument in /boafrm/formWlWds, letting remote attackers cause memory corruption or execute code, exploit requires crafted request.
- 9.1 /10 CriticalCVE-2026-92229 CISA KEVPoC publicNo auth
Forminator Forms – Contact Form, Payment Form & Custom Form Builder - Stored XSS
Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin <= 1.57.2 contains a stored XSS caused by improper validation before running do_shortcode, letting unauthenticated attackers execute arbitrary shortcodes.
- 9.1 /10 CriticalCVE-2026-89274 PoC publicNo auth
WP Recipe Maker - Server-Side Request Forgery
WP Recipe Maker plugin for WordPress <= 10.8.1 contains an arbitrary shortcode execution caused by unsanitized recursive do_shortcode() calls on recipe metadata, letting unauthenticated attackers execute shortcodes server-side, exploit requires approved comment with shortcode.
- 9.8 /10 CriticalCVE-2026-86591 No auth
Botiga Pro WordPress - Broken Access Control
Botiga Pro WordPress plugin < 1.6.5 contains broken access control caused by lack of authorization checks on a REST route, letting unauthenticated attackers update options, execute scripts, and trash posts, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-84434 CISA KEVPoC publicNo auth
Gravity Forms WordPress Plugin - Unrestricted File Upload
Gravity Forms WordPress plugin <= 3.1.0.4 contains an arbitrary file upload vulnerability caused by bypassing extension validation in hidden file upload fields, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit requires a form with a hidden File Upload field.
- 9.8 /10 CriticalCVE-2026-78030 No auth
Perl DBI - Remote Code Execution
Perl DBI versions before 1.653 with DBD::DBM contain a code injection vulnerability caused by unvalidated dbm_type and dbm_mldbm attributes allowing arbitrary module loading, letting attackers execute arbitrary code remotely, exploit requires attacker-controlled input in connection attributes.
- 9.8 /10 CriticalCVE-2026-93839 No auth
LightLLM - Authentication Bypass
LightLLM through 1.2.0 contains an authentication bypass caused by lack of peer address validation in /pd_register WebSocket endpoint, letting unauthenticated attackers register arbitrary nodes and cause information disclosure and denial of service.