Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 22 of 125

  • 9.1 /10 Critical
    CVE-2026-85121 No auth

    Insurify WordPress plugin - Broken Access Control

    Insurify WordPress plugin through 1.0 contains a broken access control vulnerability caused by missing authorization and nonce checks in an AJAX action, letting unauthenticated attackers overwrite arbitrary WordPress options, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-85118 No auth

    AI Content Generator Marketing WordPress - Broken Access Control

    AI Content Generator Marketing WordPress plugin through 1.0.0 contains a broken access control caused by missing nonce or capability checks on AJAX actions, letting unauthenticated attackers update and delete arbitrary WordPress options, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-84737 No auth

    Freeton WP WordPress plugin - Authentication Bypass

    Freeton WP WordPress plugin through 1.0.0 contains an authentication bypass caused by improper validation of activation codes, letting unauthenticated attackers log in as any user with a known email address.

  • 9.8 /10 Critical
    CVE-2026-84734 No auth

    Mindstien Quick Login WordPress plugin - Authentication Bypass

    Mindstien Quick Login WordPress plugin through 1.0 contains a broken authentication caused by improper validation of request values against visitor sessions, letting unauthenticated attackers obtain administrator sessions, exploit requires crafted request.

  • 9.8 /10 Critical
    CVE-2026-84254 No auth

    Click5 CRM add-on to Contact Form 7 WordPress plugin - Broken Access Control

    Click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 contains a broken access control and CSRF vulnerability caused by missing authorization and CSRF checks in REST endpoint, letting unauthenticated attackers create new admin accounts and take over the site, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-84253 No auth

    click5 CRM add-on to Gravity Forms - Broken Access Control

    click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 contains a broken access control and CSRF vulnerability caused by lack of authorization and CSRF checks in REST endpoint option updates, letting unauthenticated attackers create admin accounts and take over the site, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-84252 No auth

    click5 CRM add-on to WPForms - Broken Access Control

    click5 CRM add-on to WPForms WordPress plugin through 1.0.3 contains a broken access control and CSRF vulnerability caused by lack of authorization and CSRF checks in REST endpoint for updating options, letting unauthenticated attackers create new admin accounts and take over the site, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-84251 No auth

    click5 CRM add-on to Ninja Forms - Broken Access Control & CSRF

    click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 contains a broken access control and CSRF vulnerability caused by missing authorization and CSRF checks in REST endpoint for updating options, letting unauthenticated attackers create new admin accounts and take over the site, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-81649 No auth

    Fundin cho WooCommerce - Broken Access Control & Stored XSS

    Fundin cho WooCommerce WordPress plugin through 3.4.0 contains broken access control caused by improper authorization on REST API routes using identical credentials, letting unauthenticated attackers disclose payment credentials, modify payment settings, and perform stored XSS, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-108860

    BotSharp - Authentication Bypass

    BotSharp through 5.2.0 contains an authentication bypass caused by hard-coded Jwt:Key in WebStarter appsettings.json, letting unauthenticated remote attackers forge bearer tokens to impersonate any user including administrators, exploit requires knowledge of the hard-coded key.

  • 9.4 /10 Critical
    CVE-2026-108753 No auth

    Agnaistic agnai - Authentication Bypass

    Agnaistic agnai 1.0.555 contains a hardcoded credentials vulnerability caused by fixed admin password and public JWT secret in self-host.docker-compose.yml, letting unauthenticated attackers impersonate admin, reset passwords, and change configuration, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-108707 No auth

    Wukong_HRM - Authentication Bypass

    Wukong_HRM through commit 186115e contains an authentication bypass caused by omission of the AUTH-TOKEN header in ParamAspect, letting unauthenticated attackers gain HR administrator access to all API endpoints, exploit requires omission of AUTH-TOKEN header.

  • 10.0 /10 Critical
    CVE-2026-108576 No auth

    TOZED X300 - Command Injection

    TOZED X300 <= 6.01.3 contains a command injection caused by manipulation of the "Host" argument in IPPingDiagnostics Handler's process_ping function, letting remote attackers execute OS commands remotely, exploit requires network access.

  • 9.9 /10 Critical
    CVE-2026-108540 Auth required

    OpenSpug Spug - Command Injection

    OpenSpug Spug <= 3.4.0/4.0.1 contains a command injection caused by manipulation in /exec/transfer file transfer component, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-104028 No auth

    Anton Extensions WordPress - Unrestricted File Upload

    Anton Extensions WordPress plugin through 1.2.2 contains an unrestricted file upload vulnerability caused by lack of capability check, nonce verification, and file-type validation, letting unauthenticated attackers upload arbitrary PHP files and achieve remote code execution.