Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 156 of 166
- 9.1 /10 CriticalCVE-2026-80945
Linux kernel crypto: iaa - Data Tampering
Linux kernel crypto: iaa contains a data tampering vulnerability caused by improper unmapping of destination buffer before software fallback on decompress, letting attackers cause data corruption, exploit requires hardware analytics error triggering fallback.
- 9.8 /10 CriticalCVE-2026-80926 No auth
Linux Kernel ksmbd - Use After Free
Linux kernel ksmbd contains a use-after-free vulnerability caused by unsynchronized access to opinfo->conn in oplock break notification, letting authenticated clients with durable batch oplocks cause memory corruption, exploit requires authenticated client with durable batch oplock.
- 10.0 /10 CriticalCVE-2026-80462 No auth
Chef Automate - Broken Access Control
Chef Automate contains a broken access control vulnerability in the API gateway and identity validation path, letting unauthenticated actors gain elevated access to protected functionality under specific conditions.
- 9.8 /10 CriticalCVE-2026-79396 No auth
Xiongmai IP Camera XM530 - Authentication Bypass
Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier contains hardcoded default credentials caused by storing static account credentials in unencrypted plaintext within bin/config.xml and Sofia executable, letting remote attackers gain full administrative control, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-79395 No auth
Xiongmai IP Camera XM530 - Authentication Bypass
Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier contains an authentication bypass caused by improper WS-Security UsernameToken verification in Sofia IPC daemon, letting remote attackers execute privileged ONVIF actions via crafted SOAP requests when the admin password is empty.
- 9.8 /10 CriticalCVE-2026-72710 No auth
SPIP - Remote Code Execution
SPIP before 4.4.18 contains a remote code execution caused by lack of editable columns allowlist in editer_objet action's arg parameter, letting attackers with valid nonce execute arbitrary PHP functions via spip_jobs table injection.
- 9.8 /10 CriticalCVE-2026-72709 No auth
SPIP - Broken Access Control
SPIP < 4.4.18 contains a missing authorization vulnerability in administrative action endpoints under ecrire/action/ caused by lack of server-side permission checks via autoriser(), letting unauthenticated attackers perform privileged actions including password resets by supplying a valid HMAC-SHA256 nonce.
- 9.8 /10 CriticalCVE-2026-71644
Robotics-STAR-Lab RACER Tested - Unsafe Trajectory Planning
Robotics-STAR-Lab RACER Tested commit abcdef1234567890 contains an unsafe trajectory planning vulnerability caused by a missing default case in the FSM stopping swarm trajectory publishing when drone enters IDLE, letting attackers cause UAV collisions, exploit requires control over drone state.
- 9.8 /10 CriticalCVE-2026-62105 No auth
ThemeREX Addons - Remote Code Execution
ThemeREX Addons < 2.45.0 contains an unauthenticated PHP Object Injection caused by improper handling of serialized data, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-62103 No auth
Everest Forms - Insecure Deserialization
Everest Forms <= 3.6.0 contains an insecure deserialization vulnerability caused by unauthenticated PHP object injection, letting remote attackers execute arbitrary code, exploit requires no authentication.
- 9.3 /10 CriticalCVE-2026-54072 No auth
Authorizer - Open Redirect
Authorizer prior to 2.2.1 contains an open redirect vulnerability caused by lack of validation of redirect_uri in /authorize endpoint, letting unauthenticated attackers steal tokens via attacker-supplied URLs, exploit requires attacker to obtain client_id from public endpoint.
- 9.8 /10 CriticalCVE-2026-53952 No auth
GetSimple CMS - Authentication Bypass
GetSimple CMS <= 3.4.0a and GetSimpleCMS-CE <= 3.3.22 contain an authentication bypass caused by a logic flaw in the automated deletion of admin/setup.php, letting unauthenticated attackers create new admin accounts, exploit requires access to setup script post-installation.
- 9.8 /10 CriticalCVE-2026-52630 No auth
Woltlab WCF - SQL Injection
Woltlab WCF <= 6.2.4 contains a SQL injection caused by improper sanitization in UserEditor.class.php and UserAction.class.php, letting remote attackers execute arbitrary SQL commands, exploit requires crafted requests.
- 9.8 /10 CriticalCVE-2026-14563 No auth
advanced-customized-prompts WordPress - Authentication Bypass
advanced-customized-prompts WordPress plugin through 1.0.1 contains an authentication bypass caused by lack of password verification before issuing authenticated sessions, letting unauthenticated attackers log in as any user or create accounts, exploit requires no authentication.
- 10.0 /10 CriticalCVE-2026-14560 No auth
teddy-bear-customize-addon WordPress - Unrestricted File Upload
teddy-bear-customize-addon WordPress plugin through 1.0.5 contains an unrestricted file upload vulnerability caused by improper validation of uploaded files relying on client-supplied content type and original filename, letting unauthenticated attackers upload and execute arbitrary PHP code on the server, exploit requires no authentication.