Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 21 of 166
- 9.8 /10 CriticalCVE-2026-57116 No auth
PraisonAI - Authentication Bypass
PraisonAI 4.2.1 to < 4.6.59 contains an authentication bypass caused by unauthenticated access to AgentOS FastAPI chat route, letting unauthenticated attackers execute deployed agents, exploit requires no authentication.
- 9.6 /10 CriticalCVE-2026-55981
Creative Sound Blaster Katana - Firmware Verification Bypass
Creative Sound Blaster Katana contains a firmware verification vulnerability caused by insufficient validation of firmware images, letting attackers modify and upload malicious firmware, exploit requires physical or privileged access to the device.
- 9.3 /10 CriticalCVE-2026-55486 No auth
Goobi Viewer - Reflected XSS
Goobi Viewer 25.08 to < 26.05 contains a reflected XSS caused by unvalidated origin parameter in IIIF Auth 2.0 endpoints, letting attackers execute scripts via crafted login and token requests.
- 9.6 /10 CriticalCVE-2026-54630 Auth required
Part-DB - Remote Code Execution
Part-DB < 2.12.1 contains a remote code execution caused by improper extension filtering in the attachment upload handler allowing .phar files to be executed as PHP under the web-served media directory, letting authenticated users execute arbitrary PHP code, exploit requires authenticated user in default users group.
- 9.9 /10 CriticalCVE-2026-53942 Auth required
Conda - Server-Side Template Injection
Conda Organization Infrastructure contains a server-side template injection caused by unsandboxed Jinja2 template rendering in .github/workflows/update.yml, letting attackers execute code via crafted PR comments, exploit requires attacker to control a pull request.
- 9.8 /10 CriticalCVE-2026-53921 PoC publicNo auth
odhcpd - Buffer Overflow
odhcpd prior to version 25.12 contains a stack buffer overflow caused by improper handling of DHCPv6 IA response in the DHCPv6 IA response handler, letting remote attackers execute code via crafted UDP packets, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-46652
Goobi Viewer - Path Traversal & Remote Code Execution
Goobi Viewer 24.03 to < 26.05 contains a path traversal caused by improper sanitization of Content-Disposition filename in ExternalFilesDownloader.getFilename(), letting remote attackers write files and execute code as the Tomcat OS user, exploit requires attacker-controlled HTTP server.
- 9.8 /10 CriticalCVE-2026-46651 No auth
Goobi viewer - Authentication Bypass
Goobi viewer 24.03 to < 26.05 contains an authentication bypass caused by unauthenticated access to DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket), letting unauthenticated users send download requests, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-25784 No auth
Hallo Welt! GmbH BlueSpice - Privilege Escalation
Hallo Welt! GmbH BlueSpice 5.2.3 to before 5.2.7 and 5.2.7 container images before 2026-10-19 contain a privilege escalation caused by insecure default value of $mwsgTokenAuthenticatorServiceCIDR in LocalSettings.php, letting any user with read access obtain sysop session tokens via REST API, exploit requires publicly readable wiki.
- 9.3 /10 CriticalCVE-2026-19677 No auth
frevvo registration form - Authentication Bypass
frevvo registration form 11.0.14 contains an authentication bypass caused by manipulation of registration parameters with valid tenant name and user ID, letting unauthenticated remote attackers gain TenantAdmin and Designer privileges and execute OS commands.
- 9.9 /10 CriticalCVE-2026-115931 Auth required
Postiz - Broken Access Control
Postiz contains a broken access control vulnerability caused by unrestricted function calls on connected channels, letting signed-in users read arbitrary files or cause backend process exit, exploit requires user registration.
- 9.9 /10 CriticalCVE-2026-115893 Auth required
Wasmtime - Sandbox Escape
Wasmtime < 36.0.19, 48.0.7, and 49.0.4 contains a sandbox escape caused by incorrect conditional branch target compilation of br_table instruction with over 256,000 targets in Cranelift backend on aarch64, letting user-controlled Wasm modules escape sandbox, exploit requires crafted Wasm module.
- 9.9 /10 CriticalCVE-2026-115889 Auth required
Wasmtime - Type Confusion
Wasmtime < 36.0.19 and < 43.0.0 contains a type confusion caused by bit-packing SSA value indices overflow in Cranelift compiler backend, letting attackers cause arbitrary miscompilation and escape Wasm sandbox, exploit requires crafted Wasm functions with many SSA values.
- 9.8 /10 CriticalCVE-2026-115812 No auth
Amazon Web Services Multi Model Server - Path Traversal
Amazon Web Services Multi Model Server <= 1.1.11 contains a path traversal caused by improper model archive extraction, letting remote attackers execute arbitrary code via crafted archives, exploit requires remote access.
- 9.1 /10 CriticalCVE-2026-115547 Auth required
Okta Access Gateway - Command Injection
Okta Access Gateway Admin Console contains a command injection caused by improper input validation of configuration values, letting authenticated administrators execute system commands as the OAG service account, exploit requires admin authentication.