Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 27 of 166
- 9.8 /10 CriticalCVE-2022-51026 No auth
Bytebase - Authentication Bypass
Bytebase < 1.0.1 contains an authentication bypass caused by trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST endpoint, letting unauthenticated attackers impersonate any user.
- 9.1 /10 CriticalCVE-2022-51022 CISA KEVNo auth
YiShaAdmin - Path Traversal
YiShaAdmin 2.2 through 3.1 contains an unauthenticated path traversal caused by improper validation of the filePath parameter in /admin/File/DownloadFile endpoint, letting attackers read or delete arbitrary files remotely, exploit requires crafted GET requests with directory traversal sequences.
- 9.8 /10 CriticalCVE-2021-48016 CISA KEVNo auth
DedeCMS - Command Injection
DedeCMS through 5.8.1-beta contains a command injection caused by unsanitized HTTP Referer header in ShowMsg() function, letting unauthenticated attackers execute arbitrary PHP and system commands remotely, exploit requires crafted Referer header.
- 9.8 /10 CriticalCVE-2021-48014 CISA KEVNo auth
FineReport - Path Traversal & Remote Code Execution
FineReport 9.0 contains a path traversal vulnerability caused by improper validation of the filePath parameter in /WebReport/ReportServer design_save_svg operation, letting unauthenticated attackers write arbitrary files and achieve remote code execution.
- Critical
PHP2Shell: Unauthenticated RCE in PHP (CVE-2026-109618, CVE-2026-109619)
Two critical PHP engine flaws allow unauthenticated RCE, and exploitation attempts began before disclosure. What is affected and what to do today.
- Critical
HTTP2Shell: Out-of-Bounds Write in the Brotli Decoder (CVE-2026-111497)
A Brotli decoder flaw first called Node2Shell reaches Node.js, Bun, Python, Envoy and .NET. Who is exposed, how to patch, what to do until you can.
- 9.8 /10 CriticalCVE-2026-96639 No auth
Pillow - Buffer Overflow
Pillow 11.0.0 to 13.0.0 contains a buffer overflow caused by stale ImagingCore allocation reuse in multi-frame loaders, letting attackers cause out-of-bounds writes, crashes, and potential command execution via crafted frames.
- 9.1 /10 CriticalCVE-2026-91403 PoC publicNo auth
Oracle Java SE & GraalVM - Broken Access Control
Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition [affected versions: Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; GraalVM for JDK 17.0.21, 21.0.13; GraalVM Enterprise Edition 21.3.20] contain an unauthorized data access and modification vulnerability caused by insecure API handling in JSSE component, letting unauthenticated network attackers create, delete, or modify critical data, exploit requires network access without authentication.
- 9.1 /10 CriticalCVE-2026-87095 No auth
Acronis Cyber Infrastructure - Broken Access Control
Acronis Cyber Infrastructure (ACI) < 6.0.1-112, < 6.1.1-64, < 6.2.1-71 contains a broken access control vulnerability caused by improper authorization checks, letting attackers disclose and manipulate sensitive information, exploit requires attacker to bypass authorization.
- 9.9 /10 CriticalCVE-2026-76531 Auth required
Cisco - Information Disclosure
Cisco products contain a security vulnerability related to files or directories accessible to external parties, caused by improper file or directory permissions, letting attackers access sensitive files, exploit requires external access.
- 9.3 /10 CriticalCVE-2026-76475 No auth
Cisco Unified Communications - Stored XSS
Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, Cisco Unified Communications Manager Session Management Edition, and Cisco Unity Connection contain a stored XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in users' browsers, exploit requires user interaction.
- 9.8 /10 CriticalCVE-2026-76474
Cisco Unified Communications - Authentication Bypass
Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, Cisco Unified Communications Manager Session Management Edition, and Cisco Unity Connection contain improper authentication vulnerabilities caused by flawed authentication mechanisms, letting attackers bypass authentication, exploit requires unspecified conditions.
- 9.8 /10 CriticalCVE-2026-76473
Cisco Unified Communications - Resource Lifetime Control Vulnerability
Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, Cisco Unified Communications Manager Session Management Edition, and Cisco Unity Connection contain improper control of resource lifetime vulnerabilities (CWE-74), letting attackers potentially manipulate resource states, exploit requires internal conditions.
- 9.8 /10 CriticalCVE-2026-76466
Cisco Expressway Series - Remote Code Execution
Cisco Expressway Series contains a remote code execution caused by use of persistent cookies and insufficient client certificate validation in database service, letting unauthenticated remote attackers execute arbitrary OS commands as root, exploit requires possession of persistent cookies.
- 9.9 /10 CriticalCVE-2026-76302
Cisco - Security Bypass
Cisco products contain an improper neutralization vulnerability (CWE-707) caused by insufficient input sanitization, letting attackers potentially bypass security controls, exploit requires unspecified conditions.