Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 127 of 166
- 9.1 /10 CriticalCVE-2026-54670 No auth
WeGIA - Broken Access Control & Path Traversal
WeGIA < 3.8.5 contains a broken access control and path traversal caused by lack of controller and method allowlist and improper include path handling in contribution request dispatcher, letting unauthenticated remote attackers disclose sensitive data and invoke financial operations, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-54627 No auth
SAIL - Buffer Overflow
SAIL <= 0.9.10 contains a heap buffer overflow caused by a mode/depth mismatch in PSD Bitmap color mode handling, letting attackers trigger memory corruption or potential code execution by loading crafted PSD files, exploit requires crafted PSD input.
- 9.8 /10 CriticalCVE-2026-54626 No auth
SAIL - Buffer Overflow
SAIL <= 0.9.10 contains a heap buffer overflow caused by inconsistent pixel size calculation in TGA_INDEXED_RLE image loading, letting attackers cause heap corruption or code execution via crafted TGA files, exploit requires crafted file input.
- 9.4 /10 CriticalCVE-2026-54618
Obsidian Web MCP - Authentication Bypass
Obsidian Web MCP < 0.2.0 contains an authentication bypass caused by missing login, consent, and session checks in /oauth/authorize and /oauth/token endpoints, letting unauthenticated remote attackers fully access vault operations, exploit requires network access to the tunnel deployment.
- 9.8 /10 CriticalCVE-2026-54617 No auth
GravitLauncher - Path Traversal
GravitLauncher < 5.7.12 contains a path traversal caused by improper request-target handling in FileServerHandler, letting unauthenticated remote attackers read arbitrary files, exploit requires direct access to LaunchServer on port 9274.
- 9.8 /10 CriticalCVE-2026-54460
OpenReception Appointment Booking Software - Authentication Bypass
OpenReception appointment booking software < 1.1.1 contains an authentication bypass caused by missing WebAuthnService.verifyRegistration and improper passkey binding, letting unauthenticated attackers create staff sessions and access tenant data, exploit requires knowledge of public tenant ID and target staff email.
- 9.6 /10 CriticalCVE-2026-54053 Auth required
Many Notes - Path Traversal & Stored XSS
Many Notes < 0.16.0 contains a path traversal and stored XSS caused by improper validation of ZIP archive filenames in vault import, letting authenticated users write arbitrary files and execute scripts in other users' vaults, exploit requires user authentication.
- 9.0 /10 CriticalCVE-2026-47252 Auth required
Anyquery - Command Injection
Anyquery prior to 0.4.5 contains a command injection caused by improper sanitization of SQL-controlled URLs in macOS virtual tables, letting authenticated users with INSERT or UPDATE access execute arbitrary OS commands, exploit requires authenticated user with specific write permissions.
- 9.0 /10 CriticalCVE-2026-45143 Auth required
Chamilo LMS - Stored XSS
Chamilo LMS 2.0.0 through 2.1.0 contains a stored XSS vulnerability caused by lack of server-side sanitization of private message content, letting authenticated low-privilege users execute scripts in administrator browsers, exploit requires authenticated user sending crafted message.
- 9.8 /10 CriticalCVE-2026-45140 PoC publicNo auth
Chamilo LMS - Remote Code Execution
Chamilo LMS < 2.0.1 contains a remote code execution vulnerability caused by an unspecified issue, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires no special conditions.
- 9.2 /10 CriticalCVE-2026-15688 Auth required
Mitsubishi Electric GX Works3 & Motion Control Setting - Authentication Bypass
Mitsubishi Electric GX Works3 and Motion Control Setting contain an authentication bypass caused by incorrect implementation of the authentication algorithm, letting local attackers authenticate with invalid passwords and manipulate control programs, exploit requires local access and executable modification.
- 9.8 /10 CriticalCVE-2025-55787 No auth
MailData Email Archiving System - SQL Injection
MailData Email Archiving System <= 4.2 contains a sql injection caused by unsanitized input in database queries, letting attackers execute arbitrary SQL commands, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-92805 PoC publicNo auth
UVdesk Community Skeleton - Authentication Bypass
UVdesk Community Skeleton through 1.1.8 contains a broken authentication caused by failure to validate installation state on wizard endpoints in ConfigureHelpdesk controller, letting unauthenticated attackers create super administrator accounts, exploit requires crafted requests to wizard endpoints.
- 9.8 /10 CriticalCVE-2026-92787 No auth
Feast - Authentication Bypass
Feast <= 0.66.0 contains a broken authentication caused by failure to verify JWT token signatures before user identity establishment, letting attackers bypass role-based access control and gain full read/write access, exploit requires presenting an unverified token with a hardcoded claim.
- 9.1 /10 CriticalCVE-2026-92720 No auth
Kubero - Broken Access Control
Kubero <= 3.1.1 contains a broken access control vulnerability caused by missing authentication guards on notifications API endpoints, letting unauthenticated attackers read webhook secrets and modify configurations, exploit requires no authentication.