Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 137 of 166

  • 9.6 /10 Critical
    CVE-2026-87186

    Oracle Hyperion Financial Management - Remote Code Execution

    Oracle Hyperion Financial Management 11.2.26.0.000 contains a remote takeover vulnerability caused by an easily exploitable flaw in the security component, letting unauthenticated attackers with physical network access fully compromise the system, exploit requires physical access to the communication segment.

  • 9.8 /10 Critical
    CVE-2026-87184 No auth

    Oracle Hyperion Financial Management - SQL Injection

    Oracle Hyperion Financial Management 11.2.26.0.000 contains a sql injection caused by unauthenticated network access via SQL, letting attackers fully compromise the system, exploit requires network access without authentication.

  • 9.1 /10 Critical
    CVE-2026-87176 No auth

    Oracle Hyperion Financial Management - Broken Access Control

    Oracle Hyperion Financial Management 11.2.26.0.000 contains an unauthorized data access vulnerability in Security component, letting unauthenticated network attackers create, delete, or modify critical data, exploit requires network access via TCP.

  • 9.1 /10 Critical
    CVE-2026-87175 No auth

    Oracle Hyperion Financial Management - Broken Access Control

    Oracle Hyperion Financial Management 11.2.26.0.000 contains an unauthorized data access vulnerability caused by insufficient access controls in the Security component, letting unauthenticated network attackers create, delete, or modify critical data.

  • 9.1 /10 Critical
    CVE-2026-87173 No auth

    Oracle Hyperion Financial Management - Broken Access Control

    Oracle Hyperion Financial Management 11.2.26.0.000 contains an unauthorized data access vulnerability caused by insufficient access controls in the Security component, letting unauthenticated network attackers create, delete, or modify critical data.

  • 9.9 /10 Critical
    CVE-2026-87172 Auth required

    Oracle Hyperion Financial Management - Authentication Bypass

    Oracle Hyperion Financial Management 11.2.26.0.000 contains a security vulnerability caused by an unspecified flaw in the Security component, letting low privileged attackers with network access via HTTP take over the system, exploit requires network access with low privileges.

  • 9.1 /10 Critical
    CVE-2026-87170 No auth

    Oracle Hyperion Financial Management - Broken Access Control

    Oracle Hyperion Financial Management 11.2.26.0.000 contains an unauthorized access vulnerability in Security component, letting unauthenticated network attackers via HTTP create, delete, or modify critical data, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-87129 No auth

    Oracle Hyperion Data Relationship Management - Broken Access Control

    Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an access control vulnerability in Access and security, letting unauthenticated network attackers via HTTP create, delete, or modify critical data, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-87128 No auth

    Oracle Hyperion Data Relationship Management - Broken Access Control

    Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an access control vulnerability in Access and security, letting unauthenticated network attackers via HTTP create, delete, or modify critical data, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-83462 No auth

    Oracle Mobile Application Server - Remote Code Execution

    Oracle Mobile Application Server 12.2.3-12.2.15 contains a remote code execution vulnerability caused by unauthenticated network access via TCP, letting unauthenticated attackers fully compromise the server, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-83452 No auth

    Oracle Document Management and Collaboration - Authentication Bypass

    Oracle Document Management and Collaboration 12.2.3-12.2.15 contains a remote unauthenticated takeover vulnerability caused by internal operations flaw, letting attackers with network HTTP access fully compromise the system, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-83355 No auth

    Oracle Enterprise Manager - Remote Code Execution

    Oracle Enterprise Manager for Fusion Middleware 13.5 and 24.1 contains a remote code execution vulnerability caused by an easily exploitable flaw in Metrics component, letting unauthenticated attackers with network access via HTTP take over the system, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-83339 No auth

    Oracle WebCenter Enterprise Capture - Remote Code Execution

    Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 contains a remote code execution caused by unauthenticated network access via HTTP, letting unauthenticated attackers fully compromise the system, exploit requires network access via HTTP.

  • 9.8 /10 Critical
    CVE-2026-83327 No auth

    Oracle Oracle Applications Framework - Authentication Bypass

    Oracle E-Business Suite Oracle Applications Framework 12.2.3-12.2.15 contains a remote unauthenticated takeover vulnerability caused by insecure SOAP access in Personalization component, letting attackers fully compromise the framework, exploit requires network access via SOAP.

  • 9.8 /10 Critical
    CVE-2026-83283 No auth

    Oracle Business Intelligence Enterprise Edition - Authentication Bypass

    Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 contains a remote unauthenticated takeover vulnerability in Platform Security, letting attackers with network HTTP access fully compromise the system, exploit requires network access via HTTP.