Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 14 of 166

  • 9.8 /10 Critical
    CVE-2026-92885 No auth

    Qode Membership - Authentication Bypass

    Qode Membership WordPress plugin <= 2.0.6.2 contains an authentication bypass caused by a typographic error in Facebook OAuth token verification in qode_membership_login_user, letting unauthenticated attackers log in as any user including administrators, exploit requires a valid qode_validate_facebook_login nonce obtainable from public pages.

  • 9.4 /10 Critical
    CVE-2026-90465

    FireCluster - Authentication Bypass

    FireCluster contains a missing authentication vulnerability in Sync processing, letting attackers on the cluster interconnect invoke privileged firewall management actions as root, exploit requires attacker to be positioned on the cluster interconnect.

  • 9.4 /10 Critical
    CVE-2026-86577 No auth

    JP1 Products - Out-of-Bounds Write Vulnerability

    JP1 Products including Integrated Management 3, Automatic Job Management System 3 (Manager and Agent), and JP1/Base contain an out-of-bounds write vulnerability caused by improper memory handling, letting attackers potentially corrupt memory, exploit requires no special privileges.

  • 9.4 /10 Critical
    CVE-2026-86576 No auth

    JP1 Products - Remote Code Execution

    JP1 Products including Integrated Management 3, Automatic Job Management System 3 (Manager and Agent), and JP1/Base contain a heap-based buffer overflow caused by improper memory handling, letting attackers potentially execute arbitrary code remotely, exploit requires network access.

  • 9.4 /10 Critical
    CVE-2026-86575 No auth

    JP1 Products - Buffer Overflow

    JP1 Products including Integrated Management 3 - Manager, Automatic Job Management System 3 - Manager, Agent, Agent Minimal Edition, and JP1/Base contain a stack-based buffer overflow vulnerability, letting attackers cause memory corruption or remote code execution, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-86574 No auth

    JP1/Base - Buffer Overflow

    JP1/Base >= 11-00 < 12-50-54 contains a heap-based buffer overflow caused by improper memory handling, letting attackers potentially execute arbitrary code or cause denial of service, exploit requires crafted input.

  • 9.4 /10 Critical
    CVE-2026-82122 No auth

    HiRDB Server - Buffer Overflow

    HiRDB Server versions 9 and 10 contain a stack-based buffer overflow caused by improper handling of input, letting attackers potentially execute arbitrary code, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-82120 No auth

    HiRDB Server - Buffer Overflow

    HiRDB Server versions 9 and 10 contain a heap-based buffer overflow caused by improper memory handling, letting attackers potentially execute arbitrary code or cause denial of service, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-82119 No auth

    HiRDB Server - OS Command Injection

    HiRDB Server versions 9 and 10 contain an OS command injection vulnerability caused by improper input handling, letting attackers execute arbitrary OS commands remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-82118 No auth

    HiRDB Server - Buffer Overflow

    HiRDB Server versions 9 and 10 contain a stack-based buffer overflow caused by improper handling of input, letting attackers execute arbitrary code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-82117 No auth

    HiRDB Server - Authentication Bypass

    HiRDB Server versions 9 and 10 contain an authentication bypass caused by spoofing vulnerability, letting attackers bypass authentication, exploit requires network access to the server.

  • 9.8 /10 Critical
    CVE-2026-82116 No auth

    HiRDB Server - Authentication Bypass

    HiRDB Server versions 9 and 10 contain a missing authentication for critical function vulnerability, letting attackers access critical functions without authentication, exploit requires no special conditions.

  • 9.8 /10 Critical
    CVE-2026-76939 No auth

    JP1/Automatic Job Management System 3 - Buffer Overflow

    JP1/Automatic Job Management System 3 Manager and Agent from 11-00 before 13-50-31 contain a heap-based buffer overflow caused by improper memory handling, letting attackers potentially execute arbitrary code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-76938 No auth

    JP1/Automatic Job Management System 3 - Authentication Bypass

    JP1/Automatic Job Management System 3 - Manager from 10-00 before 13-50-31 contains an authentication bypass vulnerability caused by improper authentication checks, letting attackers bypass authentication, exploit requires no special conditions.

  • 9.4 /10 Critical
    CVE-2026-76937 No auth

    JP1/Automatic Job Management System 3 - Buffer Overflow

    JP1/Automatic Job Management System 3 - Manager from 10-00 before 13-50-31 contains a heap-based buffer overflow caused by improper memory handling, letting attackers potentially execute arbitrary code remotely, exploit requires crafted input.