Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 133 of 166

  • 9.1 /10 Critical
    CVE-2026-20306 Auth required

    Cisco ISE - Command Injection & Privilege Escalation

    Cisco ISE and ISE-PIC contain a command injection caused by improper validation of user-supplied input in the REST API, letting authenticated remote attackers execute arbitrary code and escalate privileges to root, exploit requires valid administrative credentials.

  • 9.1 /10 Critical
    CVE-2026-20305 Auth required

    Cisco ISE - Command Injection & Privilege Escalation

    Cisco ISE and ISE-PIC contain a command injection caused by improper validation of user-supplied input in diagnostic tools, letting authenticated remote attackers execute arbitrary code and elevate privileges to root, exploit requires administrative credentials.

  • 9.1 /10 Critical
    CVE-2026-20284 Auth required

    Cisco ISE - SQL Injection

    Cisco ISE contains a SQL injection caused by insufficient validation of user input in the SXP REST API, letting authenticated remote attackers view or modify database data and cause DoS, exploit requires valid admin credentials and SXP service enabled.

  • 9.8 /10 Critical
    CVE-2026-20242 No auth

    Cisco Secure Firewall Management Center - Remote Code Execution & Privilege Escalation

    Cisco Secure Firewall Management Center contains an insecure deserialization vulnerability caused by processing user-supplied Java byte streams from hosts in the external database access list, letting unauthenticated remote attackers execute arbitrary commands as root, exploit requires attacker control of a host in the external database access list.

  • 9.1 /10 Critical
    CVE-2026-20237

    CVE-2026-20237

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20237 are related to improper input validation issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-20.

  • 9.9 /10 Critical
    CVE-2026-20234

    Cisco Identity Services Engine - Hardcoded Credentials

    Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector contain insufficiently protected credentials vulnerabilities caused by weak credential protection, letting attackers potentially access sensitive credentials, exploit requires internal access.

  • 9.1 /10 Critical
    CVE-2026-20211 Auth required

    Cisco ISE - Remote Code Execution & Denial of Service

    Cisco ISE contains an insecure deserialization vulnerability caused by processing crafted serialized Java objects, letting authenticated remote attackers with high-privileged admin credentials execute arbitrary commands and cause DoS.

  • 9.1 /10 Critical
    CVE-2026-20194

    CVE-2026-20194

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20194 are related to incorrect resource transfer between spheres that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-669.

  • 10.0 /10 Critical
    CVE-2026-20192 No auth

    Cisco Identity Services Engine - Broken Access Control

    Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector contain improper access control vulnerabilities caused by insufficient authorization checks, letting attackers gain unauthorized access, exploit requires no special conditions.

  • 9.1 /10 Critical
    CVE-2026-20176 Auth required

    Cisco ISE - Command Injection

    Cisco ISE contains a command injection caused by insufficient validation of user-supplied input in HTTP requests, letting authenticated high-privileged administrators execute arbitrary OS commands and cause DoS, exploit requires high-privileged admin credentials.

  • 10.0 /10 Critical
    CVE-2026-20130

    CVE-2026-20130

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC), engineering teams have conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20130 are related to improper neutralization of special elements issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-74.

  • 9.8 /10 Critical
    CVE-2026-14349 No auth

    TrueBooker – Appointment Booking and Scheduler System - Authorization Bypass

    TrueBooker – Appointment Booking and Scheduler System WordPress plugin <= 1.2.3 contains an authorization bypass caused by improper user authorization verification, letting unauthenticated attackers modify email addresses and reset passwords.

  • 9.8 /10 Critical
    CVE-2026-12793 PoC publicNo auth

    JetFormBuilder WordPress - Privilege Escalation

    JetFormBuilder WordPress plugin <= 3.6.2 contains a privilege escalation caused by lack of validation of form ID ownership before parsing form schema and executing server-side callbacks, letting unauthenticated attackers create admin accounts.

  • 9.8 /10 Critical
    CVE-2025-59953 No auth

    LMDeploy - Remote Code Execution

    LMDeploy 0.9.1 to < 0.10.2 contains a remote code execution caused by unsanitized use of pickle.loads() in AsyncRPCServer's call_and_response(), letting remote attackers execute arbitrary code via crafted RPC messages, exploit requires network access to RPC server.

  • 9.8 /10 Critical
    CVE-2025-56563 No auth

    Zenith Satellite Tracker - Server Side Request Forgery

    Zenith Satellite Tracker 1.0 contains a server side request forgery caused by lack of host or scheme validation in sat_proxy.php's URL parameter, letting unauthenticated remote attackers make arbitrary HTTP/HTTPS requests.