Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 138 of 166

  • 9.9 /10 Critical
    CVE-2026-83282 Auth required

    Oracle Business Intelligence Enterprise Edition - Remote Code Execution

    Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 contains a remote code execution caused by platform security flaws, letting low privileged attackers with network access via HTTP take over the system, exploit requires low privileges.

  • 9.8 /10 Critical
    CVE-2026-83269 No auth

    Oracle BI Publisher - Remote Code Execution

    Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 contains a remote code execution caused by unauthenticated network access via HTTP, letting attackers fully compromise the system, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-83268 Auth required

    Oracle BI Publisher - Authentication Bypass

    Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 contain a critical vulnerability in BI Platform Security, letting high privileged attackers with network access via HTTP take over the system, exploit requires high privileges.

  • 9.8 /10 Critical
    CVE-2026-83261 No auth

    Oracle Product Lifecycle Analytics - Remote Code Execution

    Oracle Product Lifecycle Analytics 3.6.1 contains a remote unauthenticated takeover vulnerability caused by an easily exploitable issue in the core component, letting attackers fully compromise the system, exploit requires network access via HTTP.

  • 9.1 /10 Critical
    CVE-2026-83260 Auth required

    Oracle Agile PLM - Remote Code Execution

    Oracle Agile PLM 9.3.6 contains a remote code execution caused by vulnerability in Event Java PX component, letting high privileged attackers with network access via T3, IIOP fully compromise the system, exploit requires high privileges.

  • 9.8 /10 Critical
    CVE-2026-83232 No auth

    Oracle Data Integrator - Remote Code Execution

    Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 contain a remote code execution vulnerability in Console / Repository Explorer, letting unauthenticated attackers with network access via HTTP fully compromise the system, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-83229 Auth required

    Oracle Siebel CRM - Remote Code Execution

    Oracle Siebel CRM 17.0-26.7 contains a remote code execution caused by a vulnerability in Siebel Management Console, letting high privileged attackers with network access via HTTP take over Siebel CRM Deployment, exploit requires high privileges.

  • 9.1 /10 Critical
    CVE-2026-83202 No auth

    Oracle Siebel CRM Deployment - Broken Access Control

    Oracle Siebel CRM Deployment 17.0-26.7 contains an unauthorized access vulnerability in Server Infrastructure, letting unauthenticated network attackers via HTTP create, delete, or modify critical data, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-83201 No auth

    Oracle Siebel CRM Deployment - Broken Access Control

    Oracle Siebel CRM Deployment 17.0-26.7 contains an unauthenticated access control vulnerability in Server Infrastructure, letting remote attackers create, delete, or modify critical data, exploit requires network access via HTTP.

  • 9.1 /10 Critical
    CVE-2026-83197 No auth

    Oracle Siebel CRM Siebel Apps - Financial Services - Authentication Bypass

    Oracle Siebel CRM Siebel Apps - Financial Services 17.0-26.7 contains an unauthenticated network accessible vulnerability in Financial Accounts, letting attackers gain unauthorized data access or cause denial of service, exploit requires network access via HTTP.

  • 9.1 /10 Critical
    CVE-2026-83196 Auth required

    Oracle Siebel CRM - Remote Code Execution

    Oracle Siebel CRM 17.0-26.7 contains a remote code execution caused by a vulnerability in Server Infrastructure, letting high privileged attackers with network access via HTTP take over Siebel CRM Deployment, exploit requires high privileges.

  • 9.1 /10 Critical
    CVE-2026-83154 No auth

    Oracle Siebel CRM End User - Broken Access Control

    Oracle Siebel CRM End User 17.0-26.7 contains a broken access control vulnerability caused by unauthenticated network access via SOAP, letting attackers create, delete, or modify critical data, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-83151 No auth

    Oracle Fusion Middleware Service Delivery Platform - Remote Code Execution

    Oracle Fusion Middleware Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 contains a remote code execution caused by unauthenticated network access via SOAP, letting attackers fully compromise the platform, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-83149 Auth required

    Oracle Application Testing Suite - Authentication Bypass

    Oracle Application Testing Suite 13.3.0.1 contains an authentication bypass caused by insufficient privilege checks, letting low privileged attackers with Test Manager for Web Apps privilege access and modify critical data and cause partial denial of service, exploit requires network access via HTTP.

  • 9.8 /10 Critical
    CVE-2026-83108 No auth

    Oracle Oracle Forms - Remote Code Execution

    Oracle Fusion Middleware Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a remote code execution caused by unauthenticated network access via HTTP, letting attackers fully compromise Oracle Forms, exploit requires network access via HTTP.