Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 20 of 125
- 9.9 /10 CriticalCVE-2026-85948 Auth required
Progress MarkLogic Server - Authentication Bypass
Progress MarkLogic Server 12.x < 12.1.0 and 11.x < 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path, letting remote attackers with manage-user-level privileges gain persistent unauthorized administrative control.
- 9.9 /10 CriticalCVE-2026-85947 Auth required
Progress MarkLogic Server - Broken Access Control
Progress MarkLogic Server 12.x < 12.1.0 and 11.x < 11.3.7 contain an authorization flaw in forest-management operations, letting remote attackers with forest-management privileges create persistent unauthorized admin accounts, exploit requires forest-management privileges.
- 9.6 /10 CriticalCVE-2026-82110 Auth required
IBM DataStage on Cloud Pak for Data - Path Traversal
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal caused by improper validation of pathname, letting remote authenticated attackers execute arbitrary code.
- 9.6 /10 CriticalCVE-2026-82103 Auth required
IBM DataStage - Information Disclosure
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an information disclosure vulnerability caused by exposure of sensitive information, letting remote authenticated attackers obtain sensitive data, exploit requires authentication.
- 9.6 /10 CriticalCVE-2026-82101 Auth required
IBM DataStage on Cloud Pak for Data - Denial of Service
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability caused by improper input validation, letting remote authenticated attackers cause denial of service, exploit requires authentication.
- 9.1 /10 CriticalCVE-2026-78357 No auth
OTRS - Authentication Bypass
OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and < 2026.7.X contain an authentication token invalidation flaw caused by delayed JWT revocation after user deactivation or password change, letting attackers with previously obtained tokens maintain access until token expiration, exploit requires possession of a valid token.
- 9.9 /10 CriticalCVE-2026-77366 Auth required
obsidian-tc - Broken Access Control
obsidian-tc < 1.3.1 contains a broken access control vulnerability caused by lack of vault claim in JWT and global folder access-control list, letting attackers with valid tokens read, write, or delete contents of other vaults, exploit requires valid token.
- 9.8 /10 CriticalCVE-2026-66086 No auth
Modem OTA stack - Buffer Overflow
Modem OTA stack contains a stack-based buffer overflow caused by improper validation of scheduling information in SIB1 messages, letting remote attackers execute code or cause denial of service, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-57118 No auth
PraisonAI praisonaiagents - Broken Access Control
PraisonAI praisonaiagents < 1.6.59 contains a broken access control vulnerability caused by missing access-control checks in AgentTeam.launch and Agents alias endpoints, letting unauthenticated remote attackers enumerate agents, consume resources, access private context, and trigger side effects, exploit requires no authentication.
- 9.3 /10 CriticalCVE-2026-44828 No auth
Qexo - Broken Access Control
Qexo 4.0.0 to 4.2.0 contains a broken access control vulnerability caused by unauthenticated access to /api/init_step/ allowing reset of INIT setting and exposure of provider configuration, letting unauthenticated attackers with a valid CSRF token reset setup and access sensitive configuration, exploit requires valid CSRF token from a public page.
- 9.8 /10 CriticalCVE-2026-109575 No auth
HAProxy Data Plane API - Authentication Bypass
HAProxy Data Plane API 2.2.0 through 3.4.3 contains a broken authentication caused by process-global authentication logic improperly dropping security controls across multiple transport types, letting unauthenticated attackers bypass credentials and gain full API administrative access, exploit requires attacker to reach HTTP or UNIX management endpoints.
- 9.8 /10 CriticalCVE-2026-109566 No auth
Rapyd Admin - Authentication Bypass
Rapyd Admin 9.0.0 before 9.20.0 contains a hardcoded credentials vulnerability caused by an AuthSeeder-created admin@laravel account with password admin, letting remote unauthenticated attackers gain super-admin access, exploit requires no special conditions.
- 9.8 /10 CriticalCVE-2026-109390 No auth
AnyDesk - Remote Code Execution
AnyDesk < 8.0.3 contains a heap-based buffer overflow caused by unvalidated payload length in the stream packet handler for mode 5 in the session protocol, letting unauthenticated remote attackers execute arbitrary code as root without victim approval.
- 9.1 /10 CriticalCVE-2026-109321 No auth
Grav Login OAuth plugin - Authentication Bypass
Grav Login OAuth plugin before 1.4.3 contains a broken authentication caused by predictable username and unsalted MD5 hashed password generation, letting unauthenticated remote attackers gain administrative access by guessing provider identifiers.
- 9.9 /10 CriticalCVE-2026-108929 Auth required
Netcore NR268 - Command Injection
Netcore NR268 1.7.121109 contains a command injection caused by manipulation of the "Hostname" argument in /router/DDNSset.cgi in the DDNS component, letting remote attackers execute arbitrary commands.