Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 29 of 125
- 9.1 /10 CriticalCVE-2026-108266
Privasys rustls - Man-in-the-Middle
Privasys rustls before v0.8.1 contains a replay attack vulnerability caused by RA-TLS challenge certificates binding quote ReportData to public key and client nonce but not active TLS session, letting attackers relay genuine quotes to impersonate attested enclaves, exploit requires attacker to obtain enclave TLS private key.
- 9.1 /10 CriticalCVE-2026-108265
Enclave OS Mini - Authentication Bypass
Enclave OS Mini prior to wasm-v0.40.0 contains a replay attack vulnerability caused by omission of a value bound to the active TLS session in RA-TLS challenge certificate path, letting attackers relay genuine quotes to impersonate enclaves, exploit requires attacker to obtain enclave TLS private key.
- 9.1 /10 CriticalCVE-2026-108264 Auth required
Wizarr - Remote Code Execution & Stored XSS
Wizarr prior to 2026.9.1 contains a remote code execution caused by unsafe evaluation of Markdown in a non-sandboxed Jinja2 environment, letting authenticated users or admins execute arbitrary Python and OS commands, exploit requires authenticated user or admin importing untrusted bundles.
- 9.9 /10 CriticalCVE-2026-108263 Auth required
Astron Agent - Remote Code Execution
Astron Agent < 1.1.2 contains a remote code execution caused by default use of LocalExecutor without sandbox restrictions in dynamic code execution, letting authenticated low-privilege tenants execute code as root and bypass tenant checks.
- 9.3 /10 CriticalCVE-2026-108261 No auth
TinaCMS - Broken Access Control
TinaCMS < 3.14.0 and @tinacms/app < 2.5.14 contain a broken access control vulnerability caused by improper origin validation in admin preview routing, letting unauthenticated attackers trick signed-in editors into executing GraphQL operations with their credentials.
- 9.1 /10 CriticalCVE-2026-108109 No auth
PHPNuxBill - Authentication Bypass
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability caused by lack of attempt limits on 6-digit otp_code in customer password reset flow in system/controllers/forgot.php, letting unauthenticated attackers hijack accounts by brute-forcing OTP and reading new password from HTTP response, exploit requires knowing a customer username.
- 9.8 /10 CriticalCVE-2026-108107 No auth
PHPNuxBill - SQL Injection
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection caused by interpolation of request parameters in radius.php FreeRADIUS REST endpoint, letting attackers extract customer records and credentials via time-based blind SQL injection, exploit requires no authentication.
- 9.3 /10 CriticalCVE-2026-107935 No auth
gvisor-tap-vsock gvproxy - Path Traversal
gvisor-tap-vsock gvproxy contains a path traversal caused by improper validation of socket path in /services/forwarder/expose endpoint, letting unauthenticated attackers delete arbitrary files on the host system, exploit requires no authentication.
- 9.1 /10 CriticalCVE-2026-107909 No auth
FalkorDB - Denial of Service
FalkorDB < 4.20.0 contains a heap-based out-of-bounds write caused by improper bounds checking in ws_read_frame and buffer_apply_mask functions, letting remote unauthenticated attackers cause denial of service and heap corruption by sending crafted WebSocket frames, exploit requires Bolt endpoint enabled.
- 9.8 /10 CriticalCVE-2026-107908 No auth
FalkorDB - Out of Bounds Read/Write
FalkorDB < 4.20.0 contains a heap-based out-of-bounds write caused by improper size validation in BoltReadHandler, letting remote unauthenticated attackers cause denial of service or execute arbitrary code via crafted Bolt RESET messages, exploit requires Bolt endpoint enabled.
- 9.3 /10 CriticalCVE-2026-107845 No auth
Contao - Stored XSS
Contao 4.0.0 to 5.3.50 and 5.7.12 contains a stored XSS caused by insufficient attribute and URL encoding in listComments() in comments-bundle/contao/dca/tl_comments.php, letting unauthenticated visitors execute scripts in backend user sessions, exploit requires backend user to open Comments module.
- 9.3 /10 CriticalCVE-2026-107824
x64dbg-MCP Server - Remote Code Execution
x64dbg-MCP Server < 1.1 contains a remote code execution vulnerability caused by unauthenticated exposure of debugger tools over HTTP and SSE, letting unauthenticated network attackers execute arbitrary commands and write files, exploit requires network access to default ports.
- 9.4 /10 CriticalCVE-2026-107806 PoC publicAuth required
Nginx UI - Command Injection
Nginx UI 2.3.8 to 2.5.0 contains a command injection caused by trusting attacker-controlled backup key material and manifest in /api/restore, letting authenticated administrators execute arbitrary commands, exploit requires active secure session.
- 9.8 /10 CriticalCVE-2026-105278
openPDC - Authentication Bypass
openPDC Docker image contains a broken authentication caused by fixed administrative credentials with no forced change on first use, letting attackers with network access gain full administrative control, exploit requires network access to management interface.
- 9.8 /10 CriticalCVE-2026-100730
openPDC & openHistorian - Insecure Deserialization
openPDC and openHistorian contain an insecure deserialization vulnerability caused by deserializing client-supplied data structures in the service console interface, letting attackers execute remote code under service account privileges, exploit requires authentication on Windows Authentication systems or none otherwise.