Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 18 of 166

  • 9.3 /10 Critical
    CVE-2026-102788 No auth

    Joomla Extension balbooa.com Gridbox - SQL Injection

    Joomla Extension balbooa.com Gridbox < 2.20.4.2 contains an SQL injection caused by improper validation of the sort-by URL parameter in GridboxHelper::getBlogPosts(), letting unauthenticated attackers execute arbitrary SQL queries.

  • 9.3 /10 Critical
    CVE-2026-93328 No auth

    Google Cloud MCP Toolbox for Databases - Path Traversal & Broken Access Control

    Google Cloud MCP Toolbox for Databases 1.2.0 through 1.4.0 contains a path traversal and missing authorization vulnerability caused by crafted tool invocation parameters in cloud-storage source, letting unauthenticated remote attackers exfiltrate host files and overwrite arbitrary local files.

  • 9.3 /10 Critical
    CVE-2026-77055 Auth required

    boneIO black_debian_images - Privilege Escalation

    boneIO black_debian_images before 1.6.0 contains a privilege escalation caused by excessive privileges granted to the boneio service account, letting local attackers escalate to root after compromising the boneio user, exploit requires local access.

  • 9.8 /10 Critical
    CVE-2026-65184 No auth

    wsserver - Command Injection

    wsserver terminal-bridge daemon contains a command injection caused by unsanitized client-supplied WebSocket fields passed to system() and popen(), letting remote attackers execute arbitrary commands, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-59107

    vSolution Matrix - Authentication Bypass

    vSolution Matrix main/master station with file sharing enabled contains an authentication bypass caused by shared cryptographic trust configuration, letting attackers with the private key authenticate as root via SSH, exploit requires possession of private key.

  • 9.8 /10 Critical
    CVE-2026-59106 No auth

    WolfProt - Command Injection

    WolfProt interface contains a command injection caused by insufficient neutralization of user-controlled input, letting unauthenticated attackers with network access execute operating-system commands with application service privileges.

  • 10.0 /10 Critical
    CVE-2026-116508 No auth

    TOTOLINK A950RG - Buffer Overflow

    TOTOLINK A950RG 4.1.2cu.5268_B20221104 contains a stack-based buffer overflow caused by manipulation of the CONTENT_LENGTH argument in infostat.cgi Device-Information CGI, letting remote attackers execute code, exploit requires crafted request.

  • 9.9 /10 Critical
    CVE-2026-116506 Auth required

    TOTOLINK A950RG - Command Injection

    TOTOLINK A950RG 4.1.2cu.5268_B20221104 contains a command injection caused by manipulation in apmib_set function of firewall.so, letting remote attackers execute arbitrary commands, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-116505 Auth required

    TOTOLINK A950RG - Command Injection

    TOTOLINK A950RG 4.1.2cu.5268_B20221104 contains a command injection caused by manipulation of the MAC address argument in getDeviceInfo function of device-information Handler, letting remote attackers execute arbitrary commands, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-116504 Auth required

    TOTOLINK A950RG - Command Injection

    TOTOLINK A950RG 4.1.2cu.5268_B20221104 contains a command injection caused by manipulation of the FileName argument in setCloudUpgradeFW function of lib/cste_modules/upgrade.so, letting remote attackers execute arbitrary commands, exploit requires remote access.

  • 9.8 /10 Critical
    CVE-2026-116485 No auth

    danmu_api - Authentication Bypass

    danmu_api before 1.21.7 contains an authentication bypass caused by default TOKEN usage and unset ADMIN_TOKEN, letting unauthenticated attackers modify server environment configuration via specific API endpoints, exploit requires default token configuration.

  • 9.1 /10 Critical
    CVE-2026-116235 Auth required

    Oray Pugongying X5 Pro - CRLF Injection

    Oray Pugongying X5 Pro 7.6.1 contains a CRLF injection caused by manipulation of the Username argument in L2TP Authentication, letting remote attackers inject CRLF sequences, exploit requires crafted input.

  • 9.1 /10 Critical
    CVE-2026-116234 Auth required

    Oray Pugongying X5 Pro - CRLF Injection

    Oray Pugongying X5 Pro 7.6.1 contains a CRLF injection caused by manipulation of the "secproto" argument in /etc/ipsec.conf in IPsec Policy Handler, letting remote attackers inject CRLF sequences, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-116233 Auth required

    Oray Pugongying X5 Pro - CRLF Injection

    Oray Pugongying X5 Pro 7.6.1 contains a CRLF injection caused by manipulation of the "rent_time" argument in Dnsmasq component, letting remote attackers inject CRLF sequences, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-116232 Auth required

    Oray Pugongying X5 Pro - CRLF Injection

    Oray Pugongying X5 Pro 7.6.1 contains a CRLF injection caused by manipulation of the argument info.community in SNMP Handler's snmp_set function, letting remote attackers inject CRLF sequences, exploit requires crafted input.