Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 13 of 166
- 9.3 /10 CriticalCVE-2026-111411 No auth
Aman FunnelKit Automations - SQL Injection
Aman FunnelKit Automations wp-marketing-automations <= 3.8.5.2 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.
- 9.8 /10 CriticalCVE-2026-110879 No auth
Jackson-databind - Remote Code Execution
Jackson-databind 2.10.0 and 3.0.0 contain a remote code execution vulnerability caused by improper validation of generic type arguments in class-name polymorphism, letting attackers execute arbitrary commands via crafted input, exploit requires attacker-controlled input with default typing enabled.
- 9.8 /10 CriticalCVE-2026-109218
WordPress Contact Manager - Unrestricted File Upload
WordPress Contact Manager plugin <= 9.1.2 contains an arbitrary file upload vulnerability caused by an incomplete extension blacklist in add_message function, letting unauthenticated attackers upload executable files, exploit requires Apache with libapache2-mod-php and timely file retrieval.
- 9.8 /10 CriticalCVE-2026-106013 No auth
Jupiter X Core - Authentication Bypass
Jupiter X Core WordPress plugin <= 4.61.0 contains an authentication bypass caused by improper OAuth token handling in the Twitter/X Social Login handler, letting unauthenticated attackers gain admin access by exploiting token misassignment.
- 9.4 /10 CriticalCVE-2026-105420 Auth required
Wing FTP Server - Broken Access Control
Wing FTP Server before 8.2.6 contains a broken access control caused by improper verification of user's base folder, letting attackers with admin privileges add directories escaping the base folder, enabling file write and remote code execution as process owner.
- 9.4 /10 CriticalCVE-2026-104383 Auth required
EagleCloud Aquila - Command Injection
EagleCloud Aquila <= 2.6.7.2 contains a command injection caused by improper control of code generation in Pigeon MFA service, letting authenticated remote attackers execute arbitrary code.
- 9.6 /10 CriticalCVE-2026-103799 Auth required
Dell PowerProtect Data Domain Management Center - Broken Access Control
Dell PowerProtect Data Domain Management Center 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20 contain a missing authorization vulnerability, letting low privileged remote attackers perform unauthorized system operations on managed systems, exploit requires remote access with low privileges.
- 9.6 /10 CriticalCVE-2026-103792 Auth required
Dell PowerProtect Data Domain Management Center - SQL Injection
Dell PowerProtect Data Domain Management Center 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20 contain an SQL injection caused by improper neutralization of special elements in SQL commands, letting low privileged remote attackers gain unauthorized access to managed systems, exploit requires remote access with low privileges.
- 9.8 /10 CriticalCVE-2026-103780 No auth
Dell PowerProtect Data Domain - Remote Code Execution
Dell PowerProtect Data Domain 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20 contain a stack-based buffer overflow in an unspecified component, letting unauthenticated remote attackers execute arbitrary commands.
- 9.8 /10 CriticalCVE-2026-103688 CISA KEVNo auth
WooCommerce Checkout Files Upload - Unrestricted File Upload
WooCommerce Checkout Files Upload WordPress plugin < 2.4.0 contains an unrestricted file upload vulnerability caused by lack of file type validation when accepted file types setting is empty, letting unauthenticated attackers upload arbitrary files including PHP, leading to remote code execution on servers executing PHP from uploads directory.
- 9.8 /10 CriticalCVE-2026-103409
Juniper Networks Session Smart Router - Authentication Bypass
Juniper Networks Session Smart Router contains a missing authentication for critical function caused by insecure endpoint accessible via crafted URL parameters, letting unauthenticated network attackers obtain administrative privileges, exploit requires device not onboarded to Mist/Conductor.
- 9.8 /10 CriticalCVE-2026-103406 No auth
Juniper Networks Session Smart Conductor - Command Injection
Juniper Networks Session Smart Conductor contains a command injection caused by improper neutralization of special elements in AutomatedProvisioner, letting remote attackers execute arbitrary commands as root via crafted salt minion ID.
- 9.2 /10 CriticalCVE-2026-93866 No auth
WatchGuard Fireware OS - Integer Overflow
WatchGuard Fireware OS Access Portal contains an integer overflow caused by improper WebSocket connection handling, letting remote unauthenticated attackers write beyond heap buffer bounds, exploit requires Access Portal enabled.
- 9.2 /10 CriticalCVE-2026-93865 No auth
Fireware OS - Authentication Bypass
Fireware OS contains a missing authentication vulnerability in the FireCluster synchronization daemon, letting remote unauthenticated attackers invoke privileged system-level administrative actions when clustering is enabled.
- 9.2 /10 CriticalCVE-2026-93857 No auth
Fireware OS - Remote Code Execution
Fireware OS contains a stack-based buffer overflow caused by improper handling in the SIP proxy, letting remote unauthenticated attackers execute arbitrary code by sending crafted requests through policies using the SIP proxy.