Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 140 of 166
- 9.9 /10 CriticalCVE-2026-83058 Auth required
Oracle Internet Directory - Privilege Escalation
Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 contain a privilege escalation caused by a vulnerability in the OID LDAP Server, letting low privileged attackers with network LDAP access take over the directory, exploit requires low privileges.
- 9.9 /10 CriticalCVE-2026-83057 Auth required
Oracle Internet Directory - Privilege Escalation
Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 contain a privilege escalation caused by a vulnerability in the OID LDAP Server, letting low privileged attackers with network LDAP access take over the directory, exploit requires low privileges.
- 9.9 /10 CriticalCVE-2026-83056 Auth required
Oracle Internet Directory - Privilege Escalation
Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 contain a privilege escalation vulnerability in OID LDAP Server, letting low privileged attackers with network LDAP access takeover Oracle Internet Directory, exploit requires low privilege network access.
- 9.9 /10 CriticalCVE-2026-83055 Auth required
Oracle Internet Directory - Privilege Escalation
Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 contain a privilege escalation caused by a vulnerability in the OID LDAP Server, letting low privileged attackers with network LDAP access takeover Oracle Internet Directory, exploit requires low privileged network access.
- 9.8 /10 CriticalCVE-2026-83054 No auth
Oracle Internet Directory - Authentication Bypass
Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 contains a remote unauthenticated takeover vulnerability in OID LDAP Server, letting attackers with network access fully compromise the system, exploit requires network access via LDAP.
- 9.6 /10 CriticalCVE-2026-83043 No auth
Oracle WebCenter Portal - Authentication Bypass
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contains an authentication bypass caused by unauthenticated network access via HTTP, letting attackers take over the portal, exploit requires user interaction from a third party.
- 9.8 /10 CriticalCVE-2026-83042 No auth
Oracle Identity Manager - Authentication Bypass
Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 contain a remote takeover vulnerability caused by an easily exploitable flaw in OIM Legacy UI, letting unauthenticated attackers with network HTTP access fully compromise the system.
- 9.6 /10 CriticalCVE-2026-83040 No auth
Oracle WebCenter Portal - Remote Code Execution
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contain a remote code execution caused by unauthenticated network access via SOAP, letting unauthenticated attackers with user interaction take over the portal, exploit requires human interaction from a third party.
- 9.9 /10 CriticalCVE-2026-83039 Auth required
Oracle WebCenter Portal - Authentication Bypass
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contains a critical vulnerability in Composer, letting low privileged attackers with network access via HTTP fully compromise the portal and impact additional products, exploit requires network access.
- 9.9 /10 CriticalCVE-2026-83038 Auth required
Oracle WebLogic Server - Remote Code Execution
Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contain a remote code execution caused by a vulnerability in TopLink Integration, letting low privileged attackers with network access via HTTP take over the server, exploit requires network access with low privileges.
- 9.8 /10 CriticalCVE-2026-83037 No auth
Oracle WebCenter Sites - Remote Code Execution
Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 contain a remote code execution vulnerability caused by unauthenticated network access via HTTP, letting unauthenticated attackers fully compromise the system, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-83036 No auth
Oracle WebCenter Sites - Remote Code Execution
Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 contain a remote code execution caused by an easily exploitable vulnerability accessible via HTTP, letting unauthenticated attackers fully compromise the system, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-83035 No auth
Oracle WebCenter Sites - Remote Code Execution
Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 contain a remote code execution vulnerability caused by unauthenticated network access via HTTP, letting attackers fully compromise the system, exploit requires network access.
- 9.9 /10 CriticalCVE-2026-83031 Auth required
Oracle WebCenter Sites - Remote Code Execution
Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 contain a remote code execution caused by an easily exploitable vulnerability accessible via HTTP, letting low privileged attackers with network access take over the system, exploit requires low privileges and network access.
- 9.6 /10 CriticalCVE-2026-83029 Auth required
Oracle Managed File Transfer - Broken Access Control
Oracle Managed File Transfer 12.2.1.4.0 and 14.1.2.0.0 contain a broken access control vulnerability caused by improper authorization in MFT Runtime Server, letting low privileged attackers with network access via HTTP modify or access critical data, exploit requires low privileged network access.