Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 157 of 166
- 9.8 /10 CriticalCVE-2026-14559 No auth
teddy-bear-customize-addon WordPress - Authentication Bypass
teddy-bear-customize-addon WordPress plugin through 1.0.5 contains a broken authentication caused by lack of password verification before user authentication, letting unauthenticated attackers log in as any registered user by supplying only the user's email address.
- 9.8 /10 CriticalCVE-2026-9163 No auth
GIS Informatics GisLab Laboratory Management System - SQL Injection
GIS Informatics GisLab Laboratory Management System >= 1.4.03 and < 1.5 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.
- 9.9 /10 CriticalCVE-2026-89094 Auth required
Forgejo - Remote Code Execution
Forgejo < 16.0.4 contains a remote code execution caused by mishandled template expansion in .forgejo/template files, letting remote attackers execute arbitrary code, exploit requires crafted template repository.
- 9.1 /10 CriticalCVE-2026-89086 No auth
jose OCaml - Authentication Bypass
jose package for OCaml < 0.11.0 contains a broken authentication caused by incomplete RSA signature validation that only checks PKCS #1 decoding without verifying the public key, letting attackers bypass signature verification, exploit requires crafted signature input.
- 9.9 /10 CriticalCVE-2026-89049 Auth required
Amazon AWS Systems Manager Agent - Server-Side Request Forgery
Amazon AWS Systems Manager Agent (SSM Agent) < 3.3.4851.0 contains a server-side request forgery caused by improper validation of equivalent address representations in port forwarding, letting authenticated remote users bypass denylist and access link-local endpoints, exploit requires authentication.
- 9.1 /10 CriticalCVE-2026-89042 No auth
passport-saml-encrypted - Authentication Bypass
passport-saml-encrypted <= 0.1.13 contains an authentication bypass caused by conditional SAML signature verification based on an optional cert option, letting attackers submit unsigned SAML responses to bypass authentication, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-88899 PoC publicNo auth
OpenCode - Path Traversal
OpenCode < 0.31.0 contains a path traversal caused by improper validation of the x-opencode-directory header in /api/opencode proxy endpoint, letting remote attackers perform file operations outside the project root, exploit requires crafted request.
- 9.8 /10 CriticalCVE-2026-88877 PoC publicNo auth
Traefik - Authentication Bypass & Broken Access Control
Traefik v3.7.0 to v3.7.11 contains a broken access control vulnerability caused by mishandling of Kubernetes ingress-nginx annotations, letting attackers bypass authentication and other middlewares, exploit requires crafted Host header with non-numeric or empty port.
- 9.3 /10 CriticalCVE-2026-88869 No auth
AVideo - Stored XSS
AVideo contains a stored XSS caused by improper escaping of the "label" parameter in AD_Server plugin's log.php endpoint, letting unauthenticated attackers execute arbitrary JavaScript in admin browser sessions.
- 9.1 /10 CriticalCVE-2026-88864 Auth required
Capgo - Broken Access Control
Capgo contains a broken access control vulnerability caused by unrestricted write access to the public.sso_providers table via Supabase PostgREST, letting attackers with a full API key bypass SSO provisioning controls and enforce arbitrary SSO, exploit requires possession of a full API key.
- 9.4 /10 CriticalCVE-2026-88285 No auth
GeoVision GV-LPC2211 - Broken Access Control
GeoVision GV-LPC2211 V1.13 contains a broken access control vulnerability caused by an unauthenticated network-accessible PTZ control service, letting remote attackers retrieve PTZ information and issue PTZ or raw serial commands, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-88278
GeoVision GV-LPC2211 - Authentication Bypass
GeoVision GV-LPC2211 V1.13 contains a replay attack vulnerability caused by failure to enforce WS-Security UsernameToken freshness or nonce reuse protection, letting attackers replay captured PasswordDigest tokens for ONVIF operations, exploit requires captured token.
- CriticalCVE-2026-88062 CISA KEV
OmniRoute - Remote Code Execution
OmniRoute <= 3.8.49 contains a remote code execution caused by insufficient validation of interpreter arguments in the POST /api/acp/agents endpoint, letting remote attackers execute arbitrary code, exploit requires anonymous access when requireLogin is false or management session/API key when true.
- 9.1 /10 CriticalCVE-2026-88056 PoC public
Angular - Server-Side Request Forgery
Angular < 20.3.30, 21.2.22, 22.1.4 contains a server-side request forgery caused by improper URL trimming in resolveUrl and parseUrl utilities, letting attackers cause SSRF and credential disclosure, exploit requires sensitive server-side credentials attached to requests.
- 9.1 /10 CriticalCVE-2026-88044 No auth
rclone - Authentication Bypass
rclone 1.70.0 to 1.75.1 contains an authentication proxy bypass caused by incorrect checking of process-global proxy.Opt.AuthProxy instead of per-server proxyOpt.AuthProxy in FTP and S3 constructors, letting attackers bypass intended proxy authentication, exploit requires crafted requests to affected RC interface.