Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 12 of 166
- 9.4 /10 CriticalCVE-2026-63190 No auth
FearlessCMS - Broken Access Control & Stored XSS
FearlessCMS < 0.1.4 contains multiple vulnerabilities including path traversal, stored and reflected XSS, and arbitrary file write/read due to missing authentication and validation in admin debug scripts, letting attackers deface sites, steal sessions, and exhaust disk space, exploit requires bypassing admin login via crafted URI.
- 10.0 /10 CriticalCVE-2026-61567
AVideo - Command Injection
AVideo prior to 8.1.0 contains a command injection caused by unescaped interpolation of attacker-controlled video paths into ffprobe and ffmpeg exec commands in view/videosListToLive.php, letting unauthenticated remote attackers execute arbitrary OS commands as the web-server user, exploit requires hosting an HTTP service reachable by the encoder.
- 10.0 /10 CriticalCVE-2026-61564 No auth
AVideo - Command Injection
AVideo prior to 8.1.0 contains a command injection caused by unescaped interpolation of request parameters into PHP string literals in install/checkConfiguration.php, letting unauthenticated attackers execute arbitrary PHP code as the web-server user, exploit requires absence of videos/configuration.php file.
- 9.9 /10 CriticalCVE-2026-44179 Auth required
XWiki Remote Macros - Remote Code Execution
XWiki Remote Macros 1.13 to <1.14.5 contains a remote code execution caused by improper escaping of included page titles and excerpt content in excerpt-include macro, letting users with edit rights execute arbitrary macros remotely, exploit requires edit permissions.
- 9.1 /10 CriticalCVE-2026-14571 No auth
Futurum Software - SQL Injection
Futurum Software management software contains a blind SQL injection caused by inadequate validation and sanitisation of user inputs in private area database queries, letting unauthenticated attackers execute arbitrary queries and access sensitive data, exploit requires sending manipulated HTTP requests.
- 9.8 /10 CriticalCVE-2026-118690 No auth
Signal K Server - Authentication Bypass
Signal K Server < 2.33.0 contains a missing authentication vulnerability caused by unauthenticated access to /skServer/ziplogs endpoint, letting remote attackers download log archives and forge admin tokens, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-118579 No auth
D-Link DIR-505 - Backdoor
D-Link DIR-505 1.10B02 contains a backdoor caused by manipulation of the argument accu/pass/code/hash/cmds in /secmark1524.cgi Web Management CGI, letting remote attackers execute unauthorized commands, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-118477 No auth
KaliFast - Command Injection
KaliFast contains an OS command injection caused by improper sanitization of the ei_git_repo_url parameter in the Git remote configuration endpoint, letting authenticated attackers execute arbitrary commands with www-data privileges.
- 9.1 /10 CriticalCVE-2026-118264
Echo - Authentication Bypass
Echo 4.0.0 to 4.16.1 and 5.x before 5.4.1 contain an authentication bypass caused by Proxy middleware forwarding requests after upstream rejects WebSocket upgrade, letting attackers bypass Echo route authentication, exploit requires accessible proxy route and cooperating upstream.
- 9.1 /10 CriticalCVE-2026-117574 Auth required
ai-gateway-payload-processing - Authorization Bypass
ai-gateway-payload-processing contains an authorization bypass caused by missing authorization verification when retrieving credentials, letting authenticated remote attackers perform unauthorized requests using another tenant's API keys, exploit requires authentication.
- 9.8 /10 CriticalCVE-2026-115968 No auth
Ultimate Member Ultimate Member - Insecure Deserialization
Ultimate Member Ultimate Member <= 2.13.1 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 9.6 /10 CriticalCVE-2026-115904 No auth
Topluyo Desktop - Command Injection
Topluyo Desktop for Linux < 2026.9.2410 contains a command injection caused by unsafe processing of user-controlled URLs in openExternalLinks() routine in utils.js, letting attackers execute arbitrary OS commands, exploit requires user to open a crafted link.
- 9.3 /10 CriticalCVE-2026-115607 No auth
Crowd Favorite DXP ToolKit - SQL Injection
Crowd Favorite DXP ToolKit <= 2.0.1 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-114278 No auth
che-machine-exec - Command Injection
che-machine-exec contains a command injection caused by unescaped user input concatenated into shell commands, letting unauthenticated remote attackers execute arbitrary code in containers, exploit requires authentication disabled.
- 9.4 /10 CriticalCVE-2026-112197 Auth required
NoviGest Desktop App - Broken Authentication
NoviGest Desktop App contains a broken authentication caused by lack of authentication in Java RMI service, letting attackers with network access execute arbitrary SQL queries and OS commands, exploit requires network access to the service.