Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 17 of 125

  • 9.9 /10 Critical
    CVE-2026-109108 Auth required

    Wavlink WL-WN530BE1-A - Command Injection

    Wavlink WL-WN530BE1-A 251117 contains a command injection caused by manipulation of the "Type" argument in /cgi-bin/uploadVpn.cgi popen function, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-108971 No auth

    D-Link DCS-930L - Authentication Bypass

    D-Link DCS-930L contains a broken authentication caused by improper verification of cryptographic signature in Emergency HTTP Recovery Server's mpfd_decode function, letting remote attackers bypass signature verification, exploit requires crafted firmware argument.

  • 9.3 /10 Critical
    CVE-2026-106630 No auth

    Adobe Experience Manager - Stored XSS

    Adobe Experience Manager contains a stored XSS caused by improper sanitization of form fields, letting attackers inject malicious scripts executed in victim browsers, exploit requires victim to visit the vulnerable page.

  • 9.3 /10 Critical
    CVE-2026-106629 No auth

    Adobe Experience Manager - Stored XSS

    Adobe Experience Manager contains a stored XSS caused by improper sanitization of form fields, letting attackers inject malicious scripts executed in victim browsers, exploit requires victim to visit the vulnerable page.

  • 9.1 /10 Critical
    CVE-2026-106626 Auth required

    Adobe Experience Manager - Remote Code Execution

    Adobe Experience Manager contains an improper input validation vulnerability that allows attackers with high privileges to execute arbitrary code in the context of the current user, exploit requires high privileges.

  • 10.0 /10 Critical
    CVE-2026-106624 No auth

    ColdFusion - Code Injection

    ColdFusion contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 10.0 /10 Critical
    CVE-2026-106622 No auth

    ColdFusion - Server-Side Request Forgery

    ColdFusion contains a server-side request forgery caused by improper validation of URLs, letting attackers escalate privileges, exploit requires no user interaction.

  • 9.1 /10 Critical
    CVE-2026-106621 No auth

    ColdFusion - Code Injection

    ColdFusion contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.6 /10 Critical
    CVE-2026-106620 Auth required

    ColdFusion - Broken Access Control

    ColdFusion contains an incorrect authorization vulnerability caused by flawed access control, letting low-privileged attackers bypass security measures and gain unauthorized write access, exploit requires no user interaction.

  • 9.0 /10 Critical
    CVE-2026-106619 No auth

    ColdFusion - Improper Input Validation

    ColdFusion contains an improper input validation vulnerability that allows attackers to execute arbitrary code in the context of the current user, exploit requires conditions beyond attacker control.

  • 9.9 /10 Critical
    CVE-2026-106612 Auth required

    ColdFusion - Broken Access Control

    ColdFusion contains an incorrect authorization vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.8 /10 Critical
    CVE-2026-106173 No auth

    Fortinet FortiSIEM - Path Traversal

    Fortinet FortiSIEM 7.5.0 contains a path traversal caused by improper limitation of a pathname to a restricted directory, letting attackers execute unauthorized code or commands via specially crafted packets, exploit requires network access.

  • 9.9 /10 Critical
    CVE-2026-106042 Auth required

    Ivanti Xtraction - Broken Access Control

    Ivanti Xtraction < 2026.4 contains an external control of file name or path vulnerability caused by improper validation of application-generated request destinations, letting remote authenticated attackers redirect requests and obtain EPMM connector credentials.

  • 9.9 /10 Critical
    CVE-2026-105903 Auth required

    ColdFusion - Code Injection

    ColdFusion contains a code injection vulnerability caused by improper control of code generation, letting low-privileged attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 10.0 /10 Critical
    CVE-2026-105899 No auth

    ColdFusion - Unrestricted File Upload

    ColdFusion contains an unrestricted file upload vulnerability allowing dangerous file types, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.