Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 17 of 166

  • 9.1 /10 Critical
    CVE-2026-112352 No auth

    Sunhillo SureLine - Authentication Bypass

    Sunhillo SureLine < 9.1.5 contains an authentication bypass caused by forging session cookies with cleartext usernames lacking integrity protection, letting unauthenticated remote attackers impersonate users and execute root commands, exploit requires active web session.

  • 9.1 /10 Critical
    CVE-2026-108142 No auth

    CDP Coordinator Service - Authorization Bypass

    CDP Coordinator Service contains an authorization bypass vulnerability caused by improper access control, letting unauthenticated attackers bypass authorization, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-108015 No auth

    HCL Notes Client - Man in the Middle

    HCL Notes Client contains a man in the middle vulnerability caused by compromised private keys of eight eMudhra intermediate CA certificates, letting unauthenticated network attackers intercept or modify outbound TLS connections, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-108014 No auth

    HCL Domino Server - Man In The Middle

    HCL Domino Server is impacted by compromised private keys of eight eMudhra intermediate CA certificates, allowing unauthenticated network attackers to perform man-in-the-middle attacks on outbound TLS connections, exploit requires network access.

  • 9.0 /10 Critical
    CVE-2026-106076 Auth required

    Veeam Backup for Microsoft 365 - SQL Injection

    Veeam Backup for Microsoft 365 contains an SQL injection caused by authenticated organization-transfer peer input in the configuration database, letting attackers read/write cross-tenant data and execute code remotely, exploit requires authentication.

  • 10.0 /10 Critical
    CVE-2026-105781 No auth

    Adobe Campaign Classic - SQL Injection

    Adobe Campaign Classic contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL commands and potentially gain elevated access, exploit requires no user interaction.

  • 9.9 /10 Critical
    CVE-2026-105780 Auth required

    Adobe Campaign Classic - Broken Access Control

    Adobe Campaign Classic contains an incorrect authorization vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.1 /10 Critical
    CVE-2026-105779 Auth required

    Adobe Campaign Classic - SQL Injection

    Adobe Campaign Classic contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting low-privileged attackers bypass security and gain unauthorized read and limited write access, exploit requires no user interaction.

  • 9.9 /10 Critical
    CVE-2026-105489 Auth required

    Adobe Campaign Classic - SQL Injection

    Adobe Campaign Classic contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting low-privileged attackers execute arbitrary code, exploit requires no user interaction.

  • 9.1 /10 Critical
    CVE-2026-104354 Auth required

    Adobe Campaign Classic - SQL Injection

    Adobe Campaign Classic contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers with high privileges execute arbitrary code, exploit requires high privileges.

  • 9.9 /10 Critical
    CVE-2026-104353 Auth required

    Adobe Campaign Classic - OS Command Injection

    Adobe Campaign Classic contains an OS command injection caused by improper neutralization of special elements, letting low-privileged attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.9 /10 Critical
    CVE-2026-104351 Auth required

    Adobe Campaign Classic - Command Injection

    Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting low-privileged attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.3 /10 Critical
    CVE-2026-104350 No auth

    Adobe Campaign Classic - Reflected XSS

    Adobe Campaign Classic contains a reflected XSS caused by improper input sanitization, letting attackers inject malicious scripts to gain elevated access or control, exploit requires victim interaction with crafted URL or page.

  • 9.5 /10 Critical
    CVE-2026-103594

    WatchGuard Fireware OS - Buffer Overflow

    WatchGuard Fireware OS contains a stack-based buffer overflow caused by improper WireGuard configuration processing, letting remote attackers with man-in-the-middle TLS-decrypted access cause denial of service or execute arbitrary code, exploit requires MITM TLS-decrypted access.

  • 9.3 /10 Critical
    CVE-2026-102789 No auth

    Joomla Extension balbooa.com Gridbox - Broken Access Control

    Joomla Extension balbooa.com Gridbox < 2.20.4.2 contains a broken access control caused by missing authorization check in EditorController::getBlogPosts(), letting attackers bypass edit level restrictions, exploit requires authenticated user.