Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 26 of 166
- 9.1 /10 CriticalCVE-2026-114611
OCO-Server - Authentication Bypass
OCO-Server < 1.2.3 contains a broken authentication caused by improper PKCS#7 signature verification with PKCS7_NOVERIFY in frontend/api-mdm.php, letting attackers impersonate victim devices and hijack MDM relationships, exploit requires knowledge of a registered device's serial number.
- 9.1 /10 CriticalCVE-2026-114607
Better Auth - Authentication Bypass
Better Auth 1.4.0-beta.18 to 1.7.7 contains an authentication bypass caused by OAuth sign-in state and Magic Link token collision in verification records, letting unauthenticated attackers obtain sessions or create verified accounts, exploit requires specific configuration settings.
- 10.0 /10 CriticalCVE-2026-114575 No auth
TOTOLINK A950RG - Command Injection
TOTOLINK A950RG 4.1.2cu.5268_B20221104 contains a command injection caused by manipulation of the argument FileMd5 in UploadCustomModule function of lib/cste_modules/product.so, letting remote attackers execute arbitrary commands, exploit requires no special privileges.
- 9.1 /10 CriticalCVE-2026-114220
NewType Infortech NT OneAPP - Weak Cryptography
NewType Infortech NT OneAPP contains an improper certificate validation vulnerability caused by failure to validate server certificate and hostname, letting unauthenticated network-adjacent attackers perform man-in-the-middle attacks, exploit requires network adjacency.
- 9.8 /10 CriticalCVE-2026-112832 No auth
CozyThemes Rootblox - File Inclusion
CozyThemes Rootblox <= 1.0.6 contains a file inclusion vulnerability caused by improper control of filename in include/require statements, letting remote attackers include local files, exploit requires crafted input.
- 9.3 /10 CriticalCVE-2026-112327 No auth
TMS Amelia ameliabooking - SQL Injection
TMS Amelia ameliabooking <= 2.4.11 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-112241 No auth
Brainstorm Force SureCart - Authentication Bypass
Brainstorm Force SureCart <= 4.9.5 contains an authentication bypass caused by spoofing, letting attackers abuse authentication mechanisms, exploit requires crafted spoofing conditions.
- 9.2 /10 CriticalCVE-2026-111497 PoC publicNo auth
Google Brotli - Buffer Overflow
Google Brotli 1.0.3 through 1.2.0 contains a buffer overflow caused by improper handling in the decoder component, letting remote unauthenticated attackers corrupt memory, disclose data, cause DoS, or execute code using crafted Brotli streams.
- 10.0 /10 CriticalCVE-2026-110264 PoC publicNo auth
GitLab CE/EE - Remote Code Execution
GitLab CE/EE < 18.11.13, 19.0 < 19.0.10, 19.1 < 19.1.9, 19.2 < 19.2.9, 19.3 < 19.3.6, 19.4 < 19.4.3, and 19.5 < 19.5.1 contain a remote code execution caused by integer overflow in regular expression compilation, letting unauthenticated users execute arbitrary code on the server, exploit requires crafted regex input.
- 9.9 /10 CriticalCVE-2026-110243 Auth required
Kiloview E3 NDI encoder - Command Injection
Kiloview E3 NDI encoder firmware contains a command injection caused by improper validation of network interface name in link maintenance address configuration endpoint, letting authenticated web users with network configuration permissions execute arbitrary OS commands as root.
- 10.0 /10 CriticalCVE-2026-110063 No auth
Azure VM Inspector - Privilege Escalation
Azure VM Inspector contains a privilege escalation caused by improper link resolution before file access, letting unauthorized attackers elevate privileges over a network, exploit requires network access.
- 9.1 /10 CriticalCVE-2026-109122 Auth required
Kiloview E3 NDI encoder - Command Injection
Kiloview E3 NDI encoder firmware contains a command injection caused by improper sanitization of a field in static route configuration via the web management API, letting authenticated users execute arbitrary OS commands as root, exploit requires authenticated web user with static route configuration permission.
- 9.9 /10 CriticalCVE-2026-107861 Auth required
Kiloview E3 NDI encoder - Command Injection
Kiloview E3 NDI encoder firmware contains a command injection caused by unsanitized hostname parameter in device naming endpoint, letting authenticated users execute arbitrary OS commands as root, exploit requires authentication.
- 9.1 /10 CriticalCVE-2026-105014 No auth
Azure Pipelines - Command Injection
Azure Pipelines contains a command injection caused by improper neutralization of special elements in commands, letting unauthorized attackers execute code remotely, exploit requires network access.
- 10.0 /10 CriticalCVE-2026-102785 PoC publicNo auth
Joomla Extension yootheme.com - Remote Code Execution
Joomla Extension yootheme.com YOOtheme Pro 5.0.0-5.0.52 contains an unauthenticated remote code execution caused by incomplete binding of image operations and output destination in the image transformation handler, letting attackers write executable files remotely, exploit requires no authentication.