Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 22 of 166

  • 9.3 /10 Critical
    CVE-2026-114357 No auth

    DJI CrystalSky - Authentication Bypass

    DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 contains a broken authentication caused by missing authentication for critical functions in the Android Debug Bridge daemon (adbd), letting attackers obtain an unauthenticated shell and escalate privileges to root, exploit requires USB ADB enabled or ADB over TCP enabled.

  • 9.8 /10 Critical
    CVE-2026-112862 No auth

    xnau webdesign Participants Database - Insecure Deserialization

    xnau webdesign Participants Database <= 2.7.8.5 contains an insecure deserialization vulnerability caused by untrusted data processing, letting attackers perform object injection remotely, exploit requires crafted input.

  • 9.3 /10 Critical
    CVE-2026-112860 No auth

    xnau webdesign Participants Database - SQL Injection

    xnau webdesign Participants Database <= 2.7.8.5 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-112859 No auth

    ThemeREX Group Little Birdies - Insecure Deserialization

    ThemeREX Group Little Birdies <= 1.3.16 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-112858 No auth

    axiomthemes Rhodos - Insecure Deserialization

    axiomthemes Rhodos <= 1.3.3 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-112857 No auth

    axiomthemes Reprizo - Insecure Deserialization

    axiomthemes Reprizo <= 1.0.8 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-112856 No auth

    ThemeREX Group Vagabonds - Insecure Deserialization

    ThemeREX Group Vagabonds <= 1.3.10 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-112855 No auth

    axiomthemes Redy - Insecure Deserialization

    axiomthemes Redy <= 1.3.5 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-112854 No auth

    axiomthemes Holistic Center - Insecure Deserialization

    axiomthemes Holistic Center <= 1.2.6 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-112853 No auth

    axiomthemes Hallelujah - Insecure Deserialization

    axiomthemes Hallelujah <= 1.1.1 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-112851 No auth

    ThemeREX Group HotLock - Insecure Deserialization

    ThemeREX Group HotLock <= 1.3.9 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-112848 No auth

    AivahThemes Hostme v2 - Insecure Deserialization

    AivahThemes Hostme v2 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection, exploit requires sending crafted serialized data.

  • 9.8 /10 Critical
    CVE-2026-112847 No auth

    ThemeREX ZenSoul - Insecure Deserialization

    ThemeREX ZenSoul <= 1.13 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-112846 No auth

    ThemeREX Group Save Life - Insecure Deserialization

    ThemeREX Group Save Life <= 1.2.14 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 9.1 /10 Critical
    CVE-2026-107685

    req_llm - Improper Certificate Validation

    req_llm 1.9.0 to < 1.29.0 contains an improper certificate validation caused by WebSockex client defaulting to insecure TLS options, letting on-path attackers read and modify OpenAI WebSocket sessions including authorization tokens, exploit requires attacker to be on the network path.