Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 150 of 166

  • 9.6 /10 Critical
    CVE-2026-12944 PoC publicAuth required

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.10.0 contains a remote code execution caused by submission of components with socket or urllib imports, letting attackers execute arbitrary Python code with root privileges, exploit requires crafted component submission.

  • 10.0 /10 Critical
    CVE-2026-81648 PoC publicNo auth

    CryptoPayment Gateway WordPress plugin - Broken Access Control

    CryptoPayment Gateway WordPress plugin 1.2.1 to 1.2.2 contains a broken access control caused by missing authorization check on an AJAX endpoint, letting unauthenticated attackers perform administrative operations including file deletion and credential recovery.

  • 9.8 /10 Critical
    CVE-2026-90558 No auth

    sngrep - Buffer Overflow

    sngrep <= 1.8.4 contains a stack buffer overflow caused by improper handling of oversized SIP header values in attribute formatting routines, letting attackers execute arbitrary code or cause crashes during packet parsing.

  • 9.9 /10 Critical
    CVE-2026-87719 Auth required

    GitLab EE - Information Disclosure

    GitLab EE 18.3 < 19.1.8, 19.2 < 19.2.6, and 19.3 < 19.3.2 contain an information disclosure caused by bypassing serialization in GraphQL subscription arguments, letting authenticated users with Duo Chat access obtain sensitive Advanced Search configurations.

  • 10.0 /10 Critical
    CVE-2026-85706 CISA KEVPoC publicNo auth

    GitLab CE/EE - Path Traversal

    GitLab CE/EE >= 18.7, < 19.1.8, 19.2 < 19.2.6, and 19.3 < 19.3.2 contain a path traversal caused by improper path confinement and missing authentication enforcement in the repository commits API, letting unauthenticated users read arbitrary files.

  • 9.8 /10 Critical
    CVE-2026-85681 No auth

    WP Component WordPress - Broken Access Control

    WP Component WordPress plugin through 2.2.4 contains a broken access control vulnerability caused by lack of capability and nonce checks on an action, letting unauthenticated attackers overwrite site options, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-84171 No auth

    Piclect WordPress plugin - Unrestricted File Upload

    Piclect WordPress plugin <= 1.0 contains an unrestricted file upload vulnerability caused by lack of validation on uploaded file names and types, letting unauthenticated attackers upload arbitrary files and execute code on the server, exploit requires no authentication.

  • 9.9 /10 Critical
    CVE-2026-82845 Auth required

    Masteriyo LMS WordPress plugin - Insecure Deserialization

    Masteriyo LMS WordPress plugin < 3.4.1 contains an insecure deserialization vulnerability caused by user-supplied metadata being deserialized, letting attackers with minimal accounts execute arbitrary code or write files, exploit requires user account.

  • 9.8 /10 Critical
    CVE-2026-81402 No auth

    DS Ad Rotator WordPress - Unrestricted File Upload

    DS Ad Rotator WordPress plugin through 0.8 contains an unrestricted file upload vulnerability caused by lack of capability check, nonce verification, and file-type validation in the image upload handler, letting unauthenticated attackers upload arbitrary files including PHP, leading to remote code execution.

  • 9.8 /10 Critical
    CVE-2026-78159 CISA KEVPoC publicNo auth

    The Events Calendar WordPress plugin - Remote Code Execution

    The Events Calendar WordPress plugin <= 6.17.3 contains a remote code execution caused by insufficient validation of the widget 'classes' map in parse_array, letting unauthenticated attackers execute code remotely, exploit requires comments enabled on tribe_events posts with crafted wp:legacy-widget block comment.

  • 9.8 /10 Critical
    CVE-2026-78006 CISA KEVPoC publicNo auth

    The Events Calendar WordPress Plugin - Remote Code Execution

    The Events Calendar WordPress plugin <= 6.17.4 contains a remote code execution vulnerability caused by insufficient protection in is_safe_widget_instance and forged wp_hash integrity attribute, letting unauthenticated attackers execute code remotely, exploit requires comments enabled and visible on events.

  • 9.6 /10 Critical
    CVE-2026-77006 Auth required

    WebTotem Backups WordPress Plugin - Unrestricted File Deletion

    WebTotem Backups WordPress plugin through 1.0.1 contains an unrestricted file deletion vulnerability caused by lack of file path validation, capability checks, and CSRF enforcement, letting authenticated users delete arbitrary files, exploit requires user authentication.

  • 9.6 /10 Critical
    CVE-2026-77005 Auth required

    CODE MONKEYS PROPOSALS WordPress - Broken Access Control

    CODE MONKEYS PROPOSALS WordPress plugin through 1.0.1 contains a broken access control caused by lack of user capability checks and file path validation before file deletion, letting authenticated users delete arbitrary files, exploit requires user authentication.

  • 9.8 /10 Critical
    CVE-2026-75800 No auth

    Frontegg SAML SSO WordPress plugin - Authentication Bypass

    Frontegg SAML SSO WordPress plugin <= 1.0.1 contains a broken authentication caused by lack of signature and issuer verification in SAML responses, letting unauthenticated attackers log in as any user or create accounts, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-89713

    Linux Kernel NFSD - Race Condition

    Linux kernel NFSD contains a time-of-check to time-of-use (TOCTOU) vulnerability caused by checking truncate permission without inode lock, letting attackers bypass append-only file restrictions during concurrent file size changes, exploit requires concurrent file append operations.