Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 145 of 166

  • 9.8 /10 Critical
    CVE-2026-55211 No auth

    Surfio - Buffer Overflow

    Surfio < 0.0.19 contains a buffer overflow caused by improper validation of size fields in IRAP files, letting attackers cause memory corruption when parsing untrusted files, exploit requires untrusted file input.

  • 9.1 /10 Critical
    CVE-2026-55158 No auth

    Conflibot - Command Injection

    Conflibot < 1.2.1 contains a command injection caused by unsafe interpolation of attacker-controlled pull request branch names in exec commands, letting attackers execute arbitrary commands with repository secrets, exploit requires pull_request_target workflow usage.

  • 9.8 /10 Critical
    CVE-2026-54337 PoC publicNo auth

    Fireshare - Command Injection

    Fireshare < 1.6.14 contains a command injection caused by improper sanitization of arguments in the video upload function, letting unauthenticated attackers write or overwrite system files remotely, exploit requires no authentication.

  • 10.0 /10 Critical
    CVE-2026-53710 No auth

    MCP Context Forge - Command Injection

    MCP Context Forge < 1.0.2 contains a command injection caused by unsafe getattr exposure in python_sandbox_server allowing attackers to execute OS commands via execute_code tool, exploit requires network access to HTTP/SSE transport.

  • Critical
    CVE-2026-52824 PoC publicNo auth

    Kimai - Default APP_SECRET Authentication Bypass

    Kimai <= 2.57.0 contains a broken authentication vulnerability caused by a hardcoded default APP_SECRET used to sign login tokens, letting unauthenticated attackers hijack any user account including super-admin.

  • 9.9 /10 Critical
    CVE-2026-45579 Auth required

    DIRAC - Command Injection

    DIRAC < 8.0.79, 9.0.22, 9.1.10 contains a command injection caused by unsafe evaluation of caller-controlled groupingAttribute in ReqManagerHandler.py, letting authenticated attackers execute OS commands, exploit requires authentication.

  • 9.8 /10 Critical
    CVE-2026-39919 No auth

    Ghostscript - Remote Code Execution

    Ghostscript < 10.08.0 contains a heap-based buffer overflow caused by mismatched component subsampling factors in JPEG 2000 output adapter, letting attackers cause memory corruption and execute code via crafted PDF, exploit requires crafted PDF input.

  • 9.8 /10 Critical
    CVE-2026-37152 No auth

    TOTOLINK X5000R - Hardcoded Credentials

    TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a hardcoded password vulnerability caused by embedded root credentials, letting attackers gain unauthorized root access, exploit requires no special conditions.

  • 9.8 /10 Critical
    CVE-2026-19773 No auth

    libwebsockets - Remote Code Execution

    libwebsockets contains a remote code execution caused by improper validation in HTTP/2 HPACK path header parsing, letting remote attackers execute arbitrary code without authentication.

  • 9.8 /10 Critical
    CVE-2026-12351

    IBM MQ - Remote Code Execution

    IBM MQ 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 LTS, and 10.0.0.0 contain a remote code execution caused by unsafe JNDI lookup processing in IVT application deployment, letting remote attackers execute arbitrary code, exploit requires IVT application deployment.

  • 9.8 /10 Critical
    CVE-2026-11928 No auth

    IBM Verify Identity Access - Buffer Overflow

    IBM Verify Identity Access contains a buffer overflow vulnerability that allows attackers to cause memory corruption or remote code execution, exploit requires crafted input.

  • 9.1 /10 Critical
    CVE-2026-11921

    IBM Verify Identity Access - Broken Authentication

    IBM Verify Identity Access containers contain a misconfiguration causing management password change operations to be applied incorrectly, letting attackers potentially bypass password update mechanisms, exploit requires container management access.

  • 9.8 /10 Critical
    CVE-2024-58385 CISA KEVNo auth

    Yonyou U8 CRM - SQL Injection

    Yonyou U8 CRM contains an unauthenticated SQL injection caused by unsanitized 'id' parameter in fillbacksettingedit.php with DontCheckLogin=1 bypassing authentication, letting attackers execute arbitrary SQL and OS commands.

  • 9.8 /10 Critical
    CVE-2023-54398 CISA KEVNo auth

    Yonyou U8 Cloud - Remote Code Execution

    Yonyou U8 Cloud contains an unauthenticated insecure deserialization vulnerability in nc.impl.pub.filesystem.FileManageServlet, letting remote attackers execute arbitrary OS commands via crafted serialized payloads, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-90945 No auth

    Crawlab - Authentication Bypass

    Crawlab <= 0.6.3 contains a broken authentication caused by hard-coded HMAC-SHA256 secret for JWT token signing, letting unauthenticated attackers forge admin tokens to access APIs and execute code on worker nodes, exploit requires no special privileges.