Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 28 of 125
- 9.3 /10 CriticalCVE-2026-96330 No auth
tagDiv tagDiv Opt-In Builder - SQL Injection
tagDiv tagDiv Opt-In Builder <= 1.7.6 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection, exploit requires crafted input.
- 9.3 /10 CriticalCVE-2026-96328 No auth
jegtheme JNews - Pay Writer - SQL Injection
jegtheme JNews - Pay Writer <= 12.0.1 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted SQL payload.
- 9.3 /10 CriticalCVE-2026-96327 No auth
VibeThemes WPLMS - SQL Injection
VibeThemes WPLMS wplms_plugin < 1.9.9.8.2 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.
- 10.0 /10 CriticalCVE-2026-94503 CISA KEVPoC publicNo auth
PX-lab Zombify - Unrestricted File Upload
PX-lab Zombify <= 1.7.7 contains an unrestricted file upload vulnerability caused by lack of proper file type validation, letting attackers upload web shells to the server, exploit requires no special privileges.
- 9.3 /10 CriticalCVE-2026-93947 No auth
Shinetheme Traveler - SQL Injection
Shinetheme Traveler <= 3.2.9 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-86405 No auth
Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module - Authentication Bypass
Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module >= 26.8.1 < 26.9.1 contains a signature spoofing vulnerability caused by improper cryptographic signature verification, letting attackers spoof signatures, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-85531 No auth
Sipay OpenCart Virtual POS Module - Authentication Bypass
Sipay OpenCart Virtual POS Module >= 26.8.2 < 26.9.1 contains a signature spoofing vulnerability caused by improper cryptographic signature verification, letting attackers bypass signature validation, exploit requires crafted signature input.
- 9.8 /10 CriticalCVE-2026-78835
Rocket Software Rocket Remote Desktop - Authentication Bypass
Rocket Software Rocket Remote Desktop 18.0.8583.1 contains an insufficiently protected credentials vulnerability caused by inadequate credential protection, letting attackers potentially access sensitive credentials, exploit requires attacker access to stored credentials.
- 9.8 /10 CriticalCVE-2026-78797 No auth
iStoreOS - Remote Code Execution
iStoreOS istoreos-24.10.7 and before contains a remote code execution caused by improper handling of task_id in tasks-lib.lua, letting remote attackers execute arbitrary code, exploit requires network access.
- 9.1 /10 CriticalCVE-2026-7826 No auth
FalkorDB - Out-of-Bounds Read
FalkorDB < 4.18.4 contains a heap-based out-of-bounds read caused by improper bounds checking in BufferSerializerIOv2_ReadBuffer function, letting remote attackers issuing Redis replication commands cause denial of service or memory disclosure, exploit requires ability to send replication commands.
- 9.8 /10 CriticalCVE-2026-5759 No auth
FalkorDB - Use After Free
FalkorDB < 4.18.1 contains a double free and use-after-free vulnerability caused by improper length check in RdbLoadDeletedNodes function of RDB graph decoders, letting remote attackers issuing Redis replication commands cause denial of service or remote code execution, exploit requires ability to issue replication commands.
- 9.8 /10 CriticalCVE-2026-15340 No auth
lwIP SMTP client - Buffer Overflow
lwIP SMTP client contains a buffer overflow caused by lack of input size validation, letting attackers potentially execute arbitrary code, exploit requires crafted input.
- 9.1 /10 CriticalCVE-2026-108269
Remote Attestation TLS Clients - Authentication Bypass
Remote Attestation TLS Clients < 0.5.0 contain a replay attack vulnerability caused by quote ReportData not being bound to the active TLS session in Rust and Go RA-TLS challenge verifiers, letting attackers relay genuine quotes to impersonate attested enclaves, exploit requires attacker to obtain enclave TLS private key.
- 9.1 /10 CriticalCVE-2026-108268
Enclave OS Virtual - Man-in-the-Middle
Enclave OS Virtual prior to tdx-v0.2.43 and tdx-gpu-v0.6.27 contains a man-in-the-middle vulnerability caused by omission of a value bound to the active TLS session in quote ReportData, letting attackers relay genuine quotes to impersonate attested enclaves, exploit requires attacker to obtain enclave TLS private key.
- 9.1 /10 CriticalCVE-2026-108267
Privasys Go - Authentication Bypass
Privasys Go prior to v0.5.1-go1.26.5 contains a replay attack vulnerability caused by challenge-mode RA-TLS certificates not binding the quote ReportData to the active TLS session, letting attackers relay genuine quotes to impersonate attested enclave connections, exploit requires attacker to obtain enclave TLS private key.