Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 139 of 166

  • 9.1 /10 Critical
    CVE-2026-83107 Auth required

    Oracle Oracle Forms - Remote Code Execution

    Oracle Fusion Middleware Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a remote code execution caused by an easily exploitable vulnerability in Forms Services, letting high privileged attackers with network access via HTTP take over Oracle Forms, exploit requires high privileges.

  • 9.0 /10 Critical
    CVE-2026-83105 No auth

    Oracle Oracle Forms - Remote Code Execution

    Oracle Fusion Middleware Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a remote code execution caused by a vulnerability in Forms Services, letting unauthenticated attackers with network HTTP access take over Oracle Forms, exploit requires high attack complexity.

  • 9.1 /10 Critical
    CVE-2026-83104 No auth

    Oracle Fusion Middleware Oracle Forms - Broken Access Control

    Oracle Fusion Middleware Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a broken access control vulnerability in Forms Services, allowing unauthenticated network attackers to create, delete, or modify critical data, or access all Oracle Forms data.

  • 9.1 /10 Critical
    CVE-2026-83103 Auth required

    Oracle Oracle Forms - Remote Code Execution

    Oracle Fusion Middleware Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a remote code execution caused by a vulnerability in Forms Services, letting high privileged attackers with network access via HTTP take over Oracle Forms, exploit requires high privileges.

  • 9.8 /10 Critical
    CVE-2026-83100 No auth

    Oracle Oracle Forms - Remote Code Execution

    Oracle Fusion Middleware Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a remote code execution caused by unauthenticated network access via HTTP, letting attackers fully compromise Oracle Forms, exploit requires network access via HTTP.

  • 10.0 /10 Critical
    CVE-2026-83099 No auth

    Oracle Oracle Forms - Remote Code Execution

    Oracle Fusion Middleware Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a remote code execution caused by an easily exploitable vulnerability in Forms Services, letting unauthenticated attackers with network access via HTTP take over Oracle Forms, exploit requires network access via HTTP.

  • 9.8 /10 Critical
    CVE-2026-83098 No auth

    Oracle Fusion Middleware Oracle Forms - Remote Code Execution

    Oracle Fusion Middleware Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a remote code execution caused by unauthenticated network access via HTTP, letting attackers fully compromise Oracle Forms, exploit requires network access via HTTP.

  • 9.8 /10 Critical
    CVE-2026-83095 No auth

    Oracle Fusion Middleware Oracle Forms - Remote Code Execution

    Oracle Fusion Middleware Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a remote code execution caused by unauthenticated network access via HTTP, letting attackers fully compromise Oracle Forms, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-83094 No auth

    Oracle Oracle Forms - Remote Code Execution

    Oracle Fusion Middleware Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a remote code execution caused by unauthenticated network access via HTTP, letting attackers fully compromise Oracle Forms, exploit requires network access via HTTP.

  • 9.8 /10 Critical
    CVE-2026-83066 No auth

    Oracle Internet Directory - Remote Code Execution

    Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 contains a remote code execution caused by unauthenticated network access via T3 and IIOP protocols, letting unauthenticated attackers fully compromise the system, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-83064 Auth required

    Oracle WebCenter Portal - Authentication Bypass

    Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contain a takeover vulnerability caused by an easily exploitable flaw in Runtime Tools, letting high privileged attackers with network access via HTTP fully compromise the portal, exploit requires high privileges.

  • 9.8 /10 Critical
    CVE-2026-83062 No auth

    Oracle Internet Directory - Remote Code Execution

    Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 contains a remote code execution caused by unauthenticated network access via LDAP, letting attackers fully compromise Oracle Internet Directory, exploit requires network access via LDAP.

  • 9.8 /10 Critical
    CVE-2026-83061 No auth

    Oracle Internet Directory - Remote Code Execution

    Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 contains a remote takeover vulnerability caused by unauthenticated network access via LDAP, letting attackers fully compromise the system without authentication.

  • 9.8 /10 Critical
    CVE-2026-83060 No auth

    Oracle Internet Directory - Remote Code Execution

    Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 contains a remote code execution caused by unauthenticated network access via LDAP, letting attackers fully compromise Oracle Internet Directory, exploit requires network access via LDAP.

  • 10.0 /10 Critical
    CVE-2026-83059 No auth

    Oracle Internet Directory - Remote Code Execution

    Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 contain an unauthenticated remote code execution vulnerability in OID LDAP Server, letting unauthenticated attackers with network access fully compromise the system, exploit requires network LDAP access.