Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 2 of 166
- 9.9 /10 CriticalCVE-2026-120282 Auth required
WAVLINK WN536AX6-A - Command Injection
WAVLINK WN536AX6-A V260507 contains a command injection caused by manipulation of the "mac" argument in /protocol.csp host_black function, letting remote attackers execute arbitrary OS commands, exploit requires network access.
- 10.0 /10 CriticalCVE-2026-120281 No auth
WAVLINK WN536AX6-A - Buffer Overflow
WAVLINK WN536AX6-A V260507 contains a stack-based buffer overflow caused by improper handling of the openvpn_ip argument in OpenVPN Handler's /protocol.csp, letting remote attackers execute code, exploit requires crafted input.
- 10.0 /10 CriticalCVE-2026-120280 No auth
WAVLINK WN536AX6-A - Command Injection
WAVLINK WN536AX6-A V260507 contains a command injection caused by manipulation of "group_id" or "group_name" arguments in wireguard_cli_group handler of /protocol.csp, letting remote attackers execute OS commands, exploit requires crafted input.
- 10.0 /10 CriticalCVE-2026-120279 No auth
WAVLINK WN536AX6-A - Command Injection
WAVLINK WN536AX6-A V260507 contains a command injection caused by manipulation of the "file_id" argument in /protocol.csp openvpn_cli Handler, letting remote attackers execute arbitrary OS commands, exploit requires remote access.
- 10.0 /10 CriticalCVE-2026-120277 No auth
WAVLINK WN536AX6-A - Command Injection
WAVLINK WN536AX6-A V260507_2.0.0 contains a command injection caused by manipulation of the "group_name" argument in /bin/ioos WireGuard CLI Group Handler, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.
- 10.0 /10 CriticalCVE-2026-120276 No auth
WAVLINK WN536AX6-A - Command Injection
WAVLINK WN536AX6-A V260507_2.0.0 contains a command injection caused by manipulation of the argument group_name in /bin/ioos Web Management Interface, letting remote attackers execute arbitrary OS commands, exploit requires crafted input.
- 9.1 /10 CriticalCVE-2026-120213 No auth
@fastify/http-proxy - Path Traversal
@fastify/http-proxy 9.0.0 through 11.6.5 contains a path traversal caused by improper URL-decoding of route parameters in rewritePrefix, letting unauthenticated remote attackers bypass path restrictions and access unintended upstream locations.
- 9.3 /10 CriticalCVE-2026-116769 No auth
Secure Access - Authentication Bypass
Secure Access servers >= 13.0 and < 14.61 contain an authentication bypass caused by improper validation, letting attackers modify client security settings via the server, exploit requires network access.
- 9.3 /10 CriticalCVE-2026-116606 No auth
Barracuda Email Security Gateway - Authentication Bypass
Barracuda Email Security Gateway < 9.4.0.030 contains an authentication bypass caused by improper access control in configuration-import function, letting unauthenticated remote attackers modify global configuration, exploit requires crafted backup archive.
- 9.3 /10 CriticalCVE-2026-105769 No auth
kaniko - Information Disclosure
kaniko < 1.25.20 contains an information disclosure caused by improper hostname validation in Azure Container Registry credential helper, letting attackers obtain Azure AD access tokens by referencing images on attacker-controlled lookalike hosts, exploit requires crafted Dockerfile referencing malicious registry.
- 9.5 /10 CriticalCVE-2026-105606 No auth
Joomla Extension joomlaboat.com - Unrestricted File Upload
Joomla Extension joomlaboat.com < 3.7.8 contains an unrestricted file upload vulnerability caused by unauthenticated upload of polyglot files to the web-accessible tmp directory, letting unauthenticated attackers write arbitrary files, exploit requires public Custom Tables submission form exposure.
- 9.3 /10 CriticalCVE-2026-105604 No auth
Joomla Extension DJ-Classifieds - SQL Injection
Joomla Extension DJ-Classifieds < 3.11.3 contains an unauthenticated SQL injection caused by improper input sanitization in the frontend search, letting unauthenticated attackers execute arbitrary SQL queries.
- 9.4 /10 CriticalCVE-2026-105603 Auth required
Joomla Extension DJ-Classifieds - Unrestricted File Upload
Joomla Extension DJ-Classifieds < 3.11.3 contains an unrestricted file upload vulnerability caused by insufficient validation, letting unprivileged attackers upload arbitrary files leading to remote code execution, exploit requires authentication.
- 9.8 /10 CriticalCVE-2026-102435 No auth
Ultra Addons for Contact Form 7 - Arbitrary File Deletion
Ultra Addons for Contact Form 7 <= 3.5.54 contains an arbitrary file deletion vulnerability caused by insufficient file path validation in _getObjAttr function, letting unauthenticated attackers delete files remotely, exploit requires PDF Generator add-on active and CF7 form configured.
- 9.4 /10 CriticalCVE-2025-11969 No auth
WSO2 API Manager - Broken Access Control
WSO2 API Manager contains a broken access control vulnerability caused by improper enforcement of access control mechanisms in System REST APIs, letting users with lower privileges perform unauthorized administrative actions, exploit requires access to System REST APIs.