Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 2 of 125
- 9.1 /10 CriticalCVE-2026-111235 No auth
OpenNMS Meridian & Horizon - Authorization Bypass
OpenNMS Meridian and Horizon contain an authorization bypass caused by case-sensitive HTTP method checks missing terminal deny rules in REST API Spring Security filter chains, letting remote unauthenticated attackers read and modify resources, exploit requires sending requests with non-canonical HTTP methods.
- 9.8 /10 CriticalCVE-2026-84731 No auth
Nutanix Prism Element - Authentication Bypass
Nutanix Prism Element contains an authentication bypass caused by misconfigured authentication filters and crafted internal management HTTP header, letting unauthenticated remote attackers gain full administrative access and execute root commands, exploit requires crafted internal management HTTP header.
- 9.6 /10 CriticalCVE-2026-57496 Auth required
Labs64 NetLicensing MCP Server - Path Traversal
Labs64 NetLicensing MCP Server < 0.1.8 contains a path traversal caused by lack of path-segment validation in product_number parameter, letting authenticated non-admin API key users retrieve plaintext tokens, exploit requires authenticated MCP client.
- 9.8 /10 CriticalCVE-2026-111329 No auth
JuggleIM im-server - Authentication Bypass
JuggleIM im-server through 1.8.16 contains a broken authentication caused by default administrator credentials admin/123456, letting unauthenticated remote attackers access the admin console and control tenant applications, exploit requires no special privileges.
- 9.1 /10 CriticalCVE-2026-102946 No auth
joserfc - Authentication Bypass
joserfc < 1.7.4 contains an authentication bypass caused by accepting JWS General JSON Serialization with an empty signatures array in jws.deserialize_json(), letting attackers supply arbitrary payloads treated as authentic, exploit requires crafted JWS General JSON input.
- 9.8 /10 CriticalCVE-2026-111281 No auth
Jooan JA-A12 - Remote Code Execution
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution caused by hard-coded credentials in jooandiag daemon, letting unauthenticated attackers execute root commands remotely via /goform/SingleHandlebyCommand.
- 9.9 /10 CriticalCVE-2026-105037 Auth required
EnergizeLab station-middleware - Path Traversal
EnergizeLab station-middleware (NestJS) 1.6.5 through 1.8.2 contains a path traversal caused by insufficient validation of file paths, letting registered low-privilege attackers read arbitrary files from the server, exploit requires attacker to be logged in.
- 9.6 /10 CriticalCVE-2026-105039 Auth required
EnergizeLab station-middleware - Broken Access Control
EnergizeLab station-middleware (NestJS) 1.6.5 through 1.8.2 contains a broken access control caused by missing user role checks on administrative APIs, letting authenticated low-privilege users retrieve AI provider keys and modify configurations and object-store contents, exploit requires user authentication.
- 9.8 /10 CriticalCVE-2026-105038 No auth
EnergizeLab Eilik and EilikO FastAPI - Broken Access Control
EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services contain a broken access control caused by unauthenticated exposure of AI model administration functions, letting unauthenticated remote attackers change AI model configuration and switch models at runtime.
- 9.1 /10 CriticalCVE-2026-105032 No auth
EnergizeLab Eilik and EilikO - Path Traversal
EnergizeLab Eilik and EilikO AI skill upload endpoint contains a path traversal vulnerability caused by lack of authentication and file path constraints, letting unauthenticated remote attackers write arbitrary files and tamper AI skill files, exploit requires no authentication.
- 9.3 /10 CriticalCVE-2026-99999 PoC publicNo auth
Linux Kernel - Denial of Service
Linux kernel contains a denial of service caused by improper validation of checksum_start in the ipv4 stack, letting attackers cause network header corruption, exploit requires sending malformed packets.
- 9.5 /10 CriticalCVE-2026-93483 No auth
Znuny - Authentication Bypass
Znuny through 7.3.6 contains an authentication bypass caused by trusting the attacker-controlled Remote-User HTTP header in HTTPBasicAuth modules, letting attackers impersonate any user including administrators without a password.
- 9.3 /10 CriticalCVE-2026-50619 No auth
Qsirch - Path Traversal
Qsirch contains a path traversal vulnerability caused by improper input validation, letting remote attackers read arbitrary files, exploit requires no special privileges.
- 9.4 /10 CriticalCVE-2026-50612 Auth required
QuMagie - Privilege Escalation
QuMagie < 2.9.2 contains a symbolic link following vulnerability caused by improper handling of symlinks, letting remote attackers with user accounts compromise system security, exploit requires attacker to have a user account.
- 9.3 /10 CriticalCVE-2026-47786 No auth
HybridDesk Station - Command Injection
HybridDesk Station contains a command injection caused by unsanitized input, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.