Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 19 of 166
- 9.9 /10 CriticalCVE-2026-116231 Auth required
Oray Pugongying X5 Pro - CRLF Injection
Oray Pugongying X5 Pro 7.6.1 contains a CRLF injection caused by manipulation of the "regmsg" argument in Ser2net component, letting remote attackers inject CRLF sequences, exploit requires no special privileges.
- 9.1 /10 CriticalCVE-2026-116214 No auth
MacCMS - Authentication Bypass
MacCMS v10 < 2026.1000.4054 contains an authentication bypass caused by check_msg() not comparing msg_to in user/findpass_msg and user/findpass_reset, letting unauthenticated attackers reset any member's password.
- 10.0 /10 CriticalCVE-2026-115905 No auth
zip - Path Traversal
zip Rust library <= 9.0.4 contains a path traversal caused by inconsistent filename handling between Central Directory and Local File Headers in ZipStreamReader, letting attackers overwrite arbitrary files, exploit requires crafted archive.
- 9.1 /10 CriticalCVE-2026-115693
Benoitc hackney - Improper Certificate Validation
Benoitc hackney 1.24.0 before 4.9.0 contains an improper certificate validation caused by incorrect handling of trust anchors in hackney_ssl, letting on-path attackers impersonate servers pinned to private CAs using publicly trusted roots, exploit requires attacker to have a publicly trusted certificate for the pinned hostname.
- 9.9 /10 CriticalCVE-2026-115188 Auth required
Mautic - Unrestricted File Upload
Mautic 7 contains an unrestricted file upload vulnerability caused by improper validation of campaign archive assets in the campaign import feature, letting authenticated users with campaign import permission upload arbitrary files including server-side scripts, exploit requires authenticated user with campaign import permission.
- 9.8 /10 CriticalCVE-2026-112346
OpenHands Software Agent SDK - Remote Code Execution
OpenHands Software Agent SDK < 1.52.0 contains an unauthenticated remote code execution caused by DockerWorkspace and Apptainer workspace launchers binding the sandbox agent server to all interfaces with empty session_api_keys, letting remote attackers execute arbitrary shell commands as root and access secrets, exploit requires network access to published container port.
- 9.9 /10 CriticalCVE-2026-110720 Auth required
Consul-k8s - Broken Access Control
Consul-k8s >= 0.42.0 contains a broken access control caused by cross-namespace authorization bypass in ACL binding rules, letting attackers obtain elevated Consul privileges, exploit requires access to the cluster.
- 9.3 /10 CriticalCVE-2026-110475 No auth
CreditNirvana Collections Platform - Broken Access Control
CreditNirvana Collections Platform contains a broken authentication and access control vulnerability caused by improper authentication and authorization controls at the platform login service, letting unauthenticated remote attackers impersonate users and access sensitive data, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-107656 No auth
Fortinet FortiSandbox - Authentication Bypass
Fortinet FortiSandbox 4.2 all versions, 4.4.0 through 4.4.9, 5.0.0 through 5.0.6, and FortiSandbox PaaS versions contain an authentication bypass caused by alternate path or channel, letting attackers execute unauthorized code or commands via crafted HTTP requests, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-10757 No auth
Esri ArcGIS Server - SQL Injection
Esri ArcGIS Server <= 12.1 on Windows and Linux contains a SQL injection caused by improper sanitization of database queries, letting remote attackers with service access execute unauthorized database functions, exploit requires service access privileges.
- 9.8 /10 CriticalCVE-2026-107092 PoC publicNo auth
NexoPOS - Path Traversal
NexoPOS v6.2.4 contains a path traversal caused by insufficient validation in the api/update endpoint, letting remote attackers access arbitrary files, exploit requires network access.
- 9.9 /10 CriticalCVE-2026-102649 No auth
Burrito - Authentication Bypass
Burrito < 0.13.0 contains an authentication bypass caused by accepting unsigned GitHub and GitLab webhook events when webhookSecret is empty, letting remote attackers forge events to create or delete TerraformPullRequest resources and trigger unauthorized terraform plans, exploit requires access to burrito-server endpoint and knowledge of tracked repository URL.
- 9.1 /10 CriticalCVE-2026-116207 No auth
YesWiki - SQL Injection
YesWiki 4.6.0 < 4.7.0 and 5.0.0-alpha1 < 5.0.0-alpha4 contain an unauthenticated SQL injection caused by improper escaping of field names in SearchManager::prepareSearchRequest(), letting attackers inject subqueries and read sensitive data or exhaust database resources, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-115214
Datawiza Proxy Auth Plugin - Authentication Bypass
Datawiza Proxy Auth Plugin WordPress plugin < 1.1.1 contains a broken authentication caused by lack of verification of user-identity and role HTTP headers from trusted reverse proxy, letting unauthenticated attackers authenticate as administrators, exploit requires untrusted proxy headers.
- 9.8 /10 CriticalCVE-2026-94075 No auth
Tribulant Software Newsletters - Insecure Deserialization
Tribulant Software Newsletters newsletters-lite <= 4.18.1 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input.