Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 28 of 166

  • 9.9 /10 Critical
    CVE-2026-76299

    Cisco - Broken Access Control

    Cisco products contain an improper access control vulnerability caused by insufficient authorization checks, letting attackers gain unauthorized access, exploit requires specific conditions not detailed.

  • 9.9 /10 Critical
    CVE-2026-71195 Auth required

    OpenStack Manila - Broken Access Control

    OpenStack Manila before 23.0.1 contains a broken access control vulnerability caused by improper authorization checks on public shares, letting authenticated project members perform unauthorized operations on shares they do not own.

  • 9.0 /10 Critical
    CVE-2026-20043 No auth

    Cisco Snort 3 - Out of Bounds Write

    Cisco Snort 3 contains an out-of-bounds write vulnerability caused by improper bounds checking, letting attackers potentially corrupt memory or cause denial of service, exploit requires crafted input.

  • 9.2 /10 Critical
    CVE-2026-114509 PoC publicNo auth

    Laravel - Authentication Bypass

    Laravel < 12.68.0 and < 13.29.0 contains an authentication bypass caused by TokenGuard accepting crafted non-string credentials, letting unauthenticated attackers bypass authentication and take over accounts on protected routes.

  • 10.0 /10 Critical
    CVE-2026-114383 No auth

    TOTOLINK EX200 - Buffer Overflow

    TOTOLINK EX200 5.2.3c.7200 contains a stack-based buffer overflow caused by manipulation of the "macAddress" argument in setWiFiAclAddConfig function of /cgi-bin/cstecgi.cgi in wireless.so, letting remote attackers execute arbitrary code, exploit requires crafted request.

  • 10.0 /10 Critical
    CVE-2026-114382 No auth

    TOTOLINK EX200 - Buffer Overflow

    TOTOLINK EX200 5.2.3c.7200 contains a stack-based buffer overflow caused by manipulation of the "Comment" argument in setStaticDhcpConfig function of /cgi-bin/cstecgi.cgi (lan.so), letting remote attackers execute arbitrary code, exploit requires crafted request.

  • 9.9 /10 Critical
    CVE-2026-114268 Auth required

    Tenda BE3L Pro - Buffer Overflow

    Tenda BE3L Pro 16.03.60.62 contains a buffer overflow caused by manipulation of the "security_5g" argument in /goform/WifiBasicSet, letting remote attackers cause memory corruption, exploit requires crafted request.

  • 9.1 /10 Critical
    CVE-2026-114139

    Sentry-Javascript - Authentication Bypass

    Sentry-Javascript 9.36.0 to < 9.47.2, 10.75.2, and 11.0.0-rc.1 contains an authentication bypass caused by webpack integration skipping middleware on configured tunnelRoute paths, letting unauthenticated requests reach protected routes, exploit requires tunnelRoute configuration, webpack build, colliding route, and middleware as sole authorization.

  • 9.8 /10 Critical
    CVE-2026-114119 No auth

    Best Practice Software Bp Premier - Authentication Bypass & Remote Code Execution

    Best Practice Software Bp Premier < 1.14.1.1128 contains a hardcoded Microsoft SQL Server administrative password, letting attackers with network access to the database authenticate as sysadmin and execute OS commands as SYSTEM, exploit requires network access to the database.

  • 9.8 /10 Critical
    CVE-2026-114108 No auth

    HKUDS Vibe-Trading - Authentication Bypass

    HKUDS Vibe-Trading > 0.1.0 < 0.1.7 contains a missing authentication vulnerability caused by require_auth() returning early when API_AUTH_KEY is unset, letting unauthenticated attackers execute root shell commands, upload files, read session histories, and obtain partial API keys.

  • 9.4 /10 Critical
    CVE-2026-113788 Auth required

    Lagoon - Command Injection

    Lagoon < 2.33.2 contains a command injection caused by vulnerability in the ssh service, letting authenticated attackers execute arbitrary code and potentially escalate privileges, exploit requires a valid Lagoon user account.

  • 10.0 /10 Critical
    CVE-2026-113744 No auth

    Tenda AC19 - Buffer Overflow

    Tenda AC19 16.03.10.07 contains a stack-based buffer overflow caused by manipulation of the "firewallEn" argument in /goform/SetFirewallCfg in httpd Web Management Service, letting remote attackers execute arbitrary code, exploit requires crafted request.

  • 9.8 /10 Critical
    CVE-2026-113736 No auth

    D-Link DHP-W610AV - Authentication Bypass

    D-Link DHP-W610AV 1.02EUb03 contains a broken authentication caused by manipulation of the Password argument in login_prepare_hnap of etc/defnodes/defaultvalue.xml, letting remote attackers set empty passwords, exploit requires remote access.

  • 9.3 /10 Critical
    CVE-2026-111852 No auth

    WPdreams Ajax Search Lite - SQL Injection

    WPdreams Ajax Search Lite <= 4.14.6 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.

  • 9.9 /10 Critical
    CVE-2026-111834 Auth required

    Kitae Park Mang Board WP - Unrestricted File Upload

    Kitae Park Mang Board WP <= 2.4.4 contains an unrestricted file upload vulnerability caused by insufficient validation of uploaded file types, letting attackers upload web shells to the server, exploit requires no special privileges.