Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 20 of 166

  • 9.6 /10 Critical
    CVE-2026-115995 No auth

    Unitree Robotics Unitree Go2 - Command Injection

    Unitree Robotics Unitree Go2 <= 1.1.11.4 contains a command injection caused by manipulation of the "Value" argument in set_volume function of chat_go component, letting remote attackers execute arbitrary OS commands, exploit requires remote access.

  • 9.9 /10 Critical
    CVE-2026-115933 Auth required

    Postiz - Authentication Bypass

    Postiz contains a broken authentication caused by shared secret signing of multiple token types without differentiation, letting attackers forge tokens for sessions, invitations, or password resets, exploit requires crafted token submission.

  • 9.6 /10 Critical
    CVE-2026-115932 Auth required

    Postiz - Path Traversal

    Postiz contains a path traversal caused by insufficient validation of media paths outside the upload directory, letting registered users read arbitrary files and send them to external Discord servers, exploit requires user registration.

  • 9.8 /10 Critical
    CVE-2026-115806 No auth

    WordPress Prime Mover Backup and Migration - Remote Code Execution

    Prime Mover Backup and Migration plugin for WordPress <= 2.2.1 contains a PHP Object Injection caused by deserialization of untrusted input in migration search-and-replace routine, letting unauthenticated attackers execute code during admin export or restore.

  • 9.4 /10 Critical
    CVE-2026-115557 No auth

    Python ssl - Security Enhancement

    Python ssl module contains a security enhancement caused by adding a denylist for known compromised certificates, letting users avoid connections with compromised certificates, exploit requires no special conditions.

  • 9.1 /10 Critical
    CVE-2026-114820 PoC publicNo auth

    Oracle Java SE - Broken Access Control

    Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (affected versions: Oracle Java SE 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK 17.0.21.0.2, 21.0.13.0.2; Oracle GraalVM Enterprise Edition 21.3.20.0.2) contain an unauthorized data access and modification vulnerability caused by insecure API handling in JSSE component, letting unauthenticated network attackers create, delete, or modify critical data, exploit requires network access without authentication.

  • 9.8 /10 Critical
    CVE-2026-114196 No auth

    paytiumsupport Paytium - Insecure Deserialization

    paytiumsupport Paytium <= 5.0.5 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 9.3 /10 Critical
    CVE-2026-112866 PoC publicNo auth

    WPFactory Product Filter by WBW - SQL Injection

    WPFactory Product Filter by WBW woo-product-filter <= 3.4.6 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 9.3 /10 Critical
    CVE-2026-111402 No auth

    Tribulant Software Newsletters - SQL Injection

    Tribulant Software Newsletters newsletters-lite <= 4.18.1 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-110956 No auth

    asVereinbase WordPress Plugin - Authentication Bypass

    asVereinbase WordPress plugin < 1.1.8 contains an authentication bypass caused by treating empty stored password or second factor as valid, letting unauthenticated attackers log in as any user including administrators.

  • 9.8 /10 Critical
    CVE-2026-99079 No auth

    Linux kernel - Use After Free

    Linux kernel contains a use-after-free vulnerability in net/mlx5e caused by stale XSK buffer release on refill retry in legacy cyclic RQ, letting attackers cause double publication of UMEM frames, exploit requires AF_XDP socket RX ring to be full.

  • 9.8 /10 Critical
    CVE-2026-99078

    Linux kernel - Use After Free

    Linux kernel net/mlx5e contains a use-after-free vulnerability caused by stale XSK buffer release on MPWQE refill retry in AF_XDP striding RQ, letting attackers cause memory corruption, exploit requires AF_XDP usage with specific buffer allocation failures.

  • 9.8 /10 Critical
    CVE-2026-98959 No auth

    Linux Kernel btrfs - Data Corruption

    Linux kernel btrfs contains a data corruption vulnerability caused by improper initialization of btrfs_dir_item when replacing xattrs of different sizes in packed items, letting local attackers cause filesystem corruption, exploit requires ability to set extended attributes.

  • 9.0 /10 Critical
    CVE-2026-94267 No auth

    Advanced Custom Fields: Extended WordPress Plugin - Broken Access Control

    Advanced Custom Fields: Extended WordPress plugin < 0.9.2.8 and Advanced Custom Fields: Extended PRO WordPress plugin < 0.9.2.8 contain a broken access control vulnerability caused by missing capability checks in front-end post update actions, letting unauthenticated visitors overwrite arbitrary posts and execute arbitrary code on the server, exploit requires a published form mapping post-update target and content to visitor inputs.

  • 9.8 /10 Critical
    CVE-2026-63244 No auth

    WizLearn Technologies Learning Management System - Authentication Bypass

    WizLearn Technologies Learning Management System contains an authentication bypass caused by a specially crafted POST request, letting unauthenticated remote attackers gain unauthorized access and full administrative control.