Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 158 of 166

  • 9.8 /10 Critical
    CVE-2026-88018 No auth

    rclone - Authentication Bypass

    rclone < 1.75.1 contains an authentication bypass caused by authPairMiddleware registering any client-chosen accessKeyID with an empty secret in s3 serve mode with --auth-proxy but without --auth-key, letting unauthenticated network attackers access backend services, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-88008 PoC public

    Traefik - Authentication Bypass

    Traefik 2.11.26 to 2.11.57 and 3.7.13 contain an authentication bypass caused by forwarding client-supplied Upgrade headers to backends supporting h2c, letting unauthenticated attackers access protected routes, exploit requires backend accepting h2c and returning 101 Switching Protocols.

  • 9.1 /10 Critical
    CVE-2026-88007

    Traefik - Authentication Bypass

    Traefik 2.11.0 to 2.11.57 and 3.7.13 contain an authentication bypass caused by shared backend transport usage in HTTP/3 ConnContext, letting attackers reuse authenticated backend connections to impersonate victims, exploit requires HTTP/3 and connection-bound NTLM or Negotiate authentication enabled.

  • 9.6 /10 Critical
    CVE-2026-87931 No auth

    Behavioral Technology Group Pavlok Behavioral Conditioning Wearable - Buffer Overflow

    Behavioral Technology Group Pavlok Behavioral Conditioning Wearable <= 20260707 contains a buffer overflow caused by manipulation in Apple Notification Center Service Event Handler, letting local network attackers cause memory corruption, exploit requires local network access.

  • 9.1 /10 Critical
    CVE-2026-85228 No auth

    Amazon Deep Java Library - Integer Overflow

    Amazon Deep Java Library (DJL) 0.13.0 through 0.36.0 contains an integer overflow caused by improper tensor buffer validation, letting remote unauthenticated actors cause denial of service or information disclosure via crafted tensor payloads.

  • 9.8 /10 Critical
    CVE-2026-85025 No auth

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.11.5 contains a remote code execution caused by improper enforcement of public-flow security restrictions and session isolation controls in MCP project endpoints, letting unauthenticated attackers execute arbitrary code and access or modify chat sessions, exploit requires publicly shared MCP project endpoints.

  • 9.1 /10 Critical
    CVE-2026-84939 No auth

    Apache FreeMarker - Path Traversal

    Apache FreeMarker 2.2.0 through 2.3.34 contains a path traversal caused by specifying a malformed locale identifier with localized lookup enabled, letting attackers access unintended template files, exploit requires localized lookup enabled.

  • 9.3 /10 Critical
    CVE-2026-8323 No auth

    Armiya Information Technologies Ltd. Co. Access Control System - Open Redirect

    Armiya Information Technologies Ltd. Co. Access Control System < 2 contains an open redirect vulnerability caused by improper validation of redirect URLs, letting attackers redirect users to untrusted sites, exploit requires user interaction.

  • 9.6 /10 Critical
    CVE-2026-82107 Auth required

    IBM DataStage - Authentication Bypass

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a broken authentication caused by improper authentication, letting remote authenticated attackers obtain sensitive information and bypass security restrictions.

  • 9.6 /10 Critical
    CVE-2026-82100 Auth required

    IBM DataStage on Cloud Pak for Data - Denial of Service

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability caused by improper input validation, letting remote authenticated attackers cause denial of service, exploit requires authentication.

  • 9.3 /10 Critical
    CVE-2026-81800 No auth

    Verified Reviews (Avis Vérifiés) - SQL Injection

    Verified Reviews (Avis Vérifiés) <= 2.4.6 contains an unauthenticated SQL injection caused by improper input sanitization, letting remote attackers execute arbitrary SQL queries, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-81468 Auth required

    Dell ThinOS - OS Command Injection

    Dell ThinOS < 2605_10.2616 contains an OS command injection caused by improper neutralization of special elements, letting high privileged remote attackers execute arbitrary commands.

  • 9.8 /10 Critical
    CVE-2026-81467 No auth

    Dell ThinOS - OS Command Injection

    Dell ThinOS < 2605_10.2616 contains an OS command injection caused by improper neutralization of special elements, letting unauthenticated remote attackers execute arbitrary commands, exploit requires remote access.

  • 9.8 /10 Critical
    CVE-2026-81204 No auth

    IBM Langflow OSS - Command Injection

    IBM Langflow OSS 1.0.0 through 1.11.5 contains a command injection caused by code injection during graph construction, letting remote attackers execute arbitrary code remotely, exploit requires crafted input.

  • 9.6 /10 Critical
    CVE-2026-81048 No auth

    Dell ThinOS - Command Injection

    Dell ThinOS < 2605_10.2616 contains a command injection caused by improper neutralization of special elements in command processing, letting unauthenticated adjacent network attackers execute remote code.