Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 122 of 125

  • 9.9 /10 Critical
    CVE-2026-67401 PoC publicAuth required

    cPanel - SQL Injection

    cPanel contains a SQL injection caused by improper input sanitization in the EmailTrack component, letting mail-enabled accounts achieve remote code execution as root, exploit requires mail-enabled account access.

  • 9.8 /10 Critical
    CVE-2026-56207

    Apache Impala - Authentication Bypass

    Apache Impala >=4.0.0 contains a broken authentication caused by lack of signature verification of Bearer token in the last step of SAML2 authentication for hs2-http interface, letting attackers alter user names and impersonate other users, exploit requires crafted Bearer token.

  • 9.6 /10 Critical
    CVE-2026-54694 No auth

    SkillTree - Stored XSS & CSRF Token Theft

    SkillTree < 4.4.2 contains a stored XSS caused by unsanitized user input in account registration fields and unsafe HTML rendering in StringHighlighter.js and HighlightedValue.vue, letting attackers execute arbitrary scripts in admin browsers, exploit requires attacker to self-register with crafted input.

  • 9.1 /10 Critical
    CVE-2026-53939 No auth

    OpenIDC cjose - Cryptographic Key Generation Flaw

    OpenIDC cjose 0.6.1 through 0.6.2.5 contains a cryptographic key generation flaw caused by zeroed content-encryption key in AES-CBC-HMAC JWE encryption, letting attackers decrypt and forge JWE content, exploit requires use of affected algorithms.

  • 9.8 /10 Critical
    CVE-2026-41871

    Apache Nutch - Unsafe Reflection

    Apache Nutch 1.10 through 1.22 contains an unsafe reflection vulnerability caused by use of externally-controlled input to select classes or code in Nutch Server (Nutch REST API), letting attackers bypass authorization, exploit requires access to Nutch Server.

  • 9.1 /10 Critical
    CVE-2026-41869 No auth

    Apache Nutch - Broken Access Control

    Apache Nutch 1.10 through 1.22 contains missing authorization, improper resource shutdown, and job interruption vulnerabilities in the Nutch REST API, letting attackers cause service disruption and unauthorized access, exploit requires network access to the Nutch Service.

  • 9.8 /10 Critical
    CVE-2026-36433

    Actions Semiconductor Co. Ltd Tool- Media Player Utilities - Remote Code Execution

    Actions Semiconductor Co. Ltd Tool- Media Player Utilities v4.46 contains a remote code execution caused by vulnerabilities in Production.dll and RdiskUpgrade.exe components, letting physically proximate attackers execute arbitrary code.

  • 9.1 /10 Critical
    CVE-2026-22590 No auth

    eProsima Fast DDS - Out-of-Bounds Read

    eProsima Fast DDS < 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 contains an out-of-bounds read caused by improper validation of DATA_FRAG submessage payload length in CacheChange_t::add_fragments, letting remote attackers read adjacent heap memory, exploit requires crafted DATA_FRAG packets.

  • 9.8 /10 Critical
    CVE-2026-21096 PoC publicNo auth

    libimagecodec.quram.so - Remote Code Execution

    libimagecodec.quram.so prior to SMR Sep-2026 Release 1 contains a heap-based buffer overflow in JPEG decoder, letting remote attackers execute arbitrary code remotely, exploit requires crafted JPEG input.

  • 9.8 /10 Critical
    CVE-2026-21095 No auth

    libimagecodec.quram.so - Buffer Overflow

    libimagecodec.quram.so < SMR Sep-2026 Release 1 contains a heap-based buffer overflow in DNG decoder, letting remote attackers execute arbitrary code remotely, exploit requires crafted input.

  • 9.1 /10 Critical
    CVE-2026-16272 No auth

    PayTR Virtual Pos iFrame API WHMCS Module - Authentication Bypass

    PayTR Virtual Pos iFrame API (v9x) WHMCS Module >= 9.0.0 < 9.0.3 contains a use of less trusted source vulnerability caused by improper validation of trusted identifiers, letting attackers exploit trusted identifiers, exploit requires crafted requests.

  • 9.0 /10 Critical
    CVE-2026-85982 Auth required

    Auth0 AD/LDAP Connector - Stored XSS

    Auth0 AD/LDAP Connector contains a stored XSS caused by improper HTML encoding in search results and updater log content, letting authenticated users with directory modification privileges or local users execute scripts in admin browsers.

  • 9.9 /10 Critical
    CVE-2026-84869 CISA KEVAuth required

    ScreenConnect - Remote Code Execution

    ScreenConnect client contains an unauthorized file transfer and execution vulnerability during active remote sessions, letting attackers transfer and execute files without host confirmation, exploit requires active remote session.

  • 9.9 /10 Critical
    CVE-2026-83941 Auth required

    Entra ID - Broken Access Control

    Entra ID contains a broken access control vulnerability caused by missing authorization, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.

  • 10.0 /10 Critical
    CVE-2026-82004 No auth

    Adobe Campaign Classic - OS Command Injection

    Adobe Campaign Classic contains an OS Command Injection caused by improper neutralization of special elements, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.