Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 146 of 166
- 9.6 /10 CriticalCVE-2026-90942 Auth required
Casdoor - Authentication Bypass
Casdoor through 4.4.0 contains an information disclosure caused by improper masking of the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, letting organization administrators retrieve the private key, exploit requires organization administrator privileges.
- 9.9 /10 CriticalCVE-2026-90937 Auth required
Froxlor - Broken Access Control
Froxlor < 2.2.5 contains a configuration injection vulnerability caused by failure to validate newline characters in subdomain redirect URLs, letting authenticated customers inject arbitrary web server directives, exploit requires authentication.
- 9.8 /10 CriticalCVE-2026-90919
LightLLM - Remote Code Execution
LightLLM through 1.2.0 contains a remote code execution caused by unauthenticated /visual_register WebSocket endpoint passing client frames directly to pickle.loads(), letting attackers execute arbitrary code with Config Server privileges, exploit requires access to Config Server port.
- 9.8 /10 CriticalCVE-2026-90898 PoC publicNo auth
Bifrost transports - Command Injection
Bifrost transports v2.0.0 contains a command injection caused by unauthenticated stdio client registration via POST /api/mcp/client, letting unauthenticated attackers execute arbitrary programs as the Bifrost process user, exploit requires authentication disabled.
- 9.1 /10 CriticalCVE-2026-90703 Auth required
D-Link DWR-M921 - Command Injection
D-Link DWR-M921 1.1.52 contains a command injection caused by manipulation of the "folderpath" argument in /boafrm/formDiskCreateShare system function, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.
- 9.1 /10 CriticalCVE-2026-90702 Auth required
D-Link DWR-M921 - Command Injection
D-Link DWR-M921 1.1.52 contains a command injection caused by manipulation of the "partition" argument in /boafrm/formDiskFormat, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.
- 9.9 /10 CriticalCVE-2026-90699 Auth required
D-Link DWR-M920 - Command Injection
D-Link DWR-M920 1.1.7 contains a command injection caused by manipulation of the "newPin" argument in /boafrm/formPinManageSetup, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.
- 9.9 /10 CriticalCVE-2026-90693 Auth required
D-Link DIR-878 - Buffer Overflow
D-Link DIR-878 120B05 contains a stack-based buffer overflow caused by manipulation of the Primary/Secondary argument in SetWan3Settings of WAN Settings, letting remote attackers execute arbitrary code, exploit requires network access.
- 9.9 /10 CriticalCVE-2026-90692 Auth required
D-Link DIR-878 - Buffer Overflow
D-Link DIR-878 120B05 contains a stack-based buffer overflow caused by manipulation of the IPv6Address/Hostname argument in SetDynamicDNSIPv6Settings, letting remote attackers execute arbitrary code, exploit requires crafted request.
- 9.9 /10 CriticalCVE-2026-90680 Auth required
D-Link DIR-823G - Buffer Overflow
D-Link DIR-823G 1.0.2B05_20181207 contains a stack-based buffer overflow caused by improper handling of PAddress/SubnetMask/Gateway arguments in /HNAP1/SetStaticRouteSettings, letting remote attackers execute code, exploit requires crafted request.
- 9.9 /10 CriticalCVE-2026-90608 Auth required
Totolink A3002MU - Buffer Overflow
Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "service_type" argument in /boafrm/formPortFw component boa, letting remote attackers cause memory corruption, exploit requires no special privileges.
- 9.9 /10 CriticalCVE-2026-90607 Auth required
Totolink A3002MU - Buffer Overflow
Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "submit-url" argument in /boafrm/formNewSchedule component boa, letting remote attackers cause memory corruption, exploit requires no special privileges.
- 9.9 /10 CriticalCVE-2026-90606 Auth required
Totolink A3002MU - Buffer Overflow
Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "static_ipv6" argument in /boafrm/formIpv6Setup component boa, letting remote attackers cause memory corruption, exploit requires no special privileges.
- 9.9 /10 CriticalCVE-2026-90605 Auth required
Totolink A3002MU - Buffer Overflow
Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "ip6addr" argument in /boafrm/formFilter component boa, letting remote attackers cause memory corruption, exploit requires crafted request.
- 9.1 /10 CriticalCVE-2026-87802
Apache Syncope - Authentication Bypass
Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an authentication bypass caused by improper verification of cryptographic signatures in OAuth 2.0 SRA configuration without JWKS URI, letting attackers forge JWTs to impersonate users and gain full access, exploit requires misconfigured OAuth 2.0 SRA without JWKS URI.