Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 29 of 166

  • 10.0 /10 Critical
    CVE-2026-111832 No auth

    WP Mailster - Unrestricted File Upload

    WP Mailster wp-mailster <= 1.9.1.0 contains an unrestricted file upload vulnerability caused by insufficient validation of uploaded file types, letting attackers upload web shells to the server, exploit requires no special privileges.

  • 9.3 /10 Critical
    CVE-2026-111816 No auth

    Apache Traffic Server - HTTP Request Smuggling

    Apache Traffic Server 8.0.0 to 8.1.11, 9.0.0 to 9.2.15, 10.0.0 to 10.1.4, and 10.2.0 contains a cache poisoning and response-framing desync vulnerability caused by malformed 302 response with Transfer-Encoding: chunked bypassing parse error rejection, letting attackers poison cache, exploit requires sending malformed HTTP responses.

  • 10.0 /10 Critical
    CVE-2026-111815 No auth

    Apache Traffic Server - Authentication Bypass

    Apache Traffic Server 8.0.0 to 8.1.11, 9.0.0 to 9.2.15, 10.0.0 to 10.1.4, and 10.2.0 contains a broken authentication caused by resuming TLS sessions across SNI virtual hosts without re-verifying client certificates, letting attackers bypass client certificate verification, exploit requires TLS session resumption across SNI hosts.

  • 10.0 /10 Critical
    CVE-2026-111814 No auth

    Apache Traffic Server - Authentication Bypass

    Apache Traffic Server 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 contains a broken authentication caused by reuse of pooled TLS sessions authenticated with one client certificate for transactions configured to present a different one, letting attackers bypass client certificate authentication, exploit requires default outbound session-sharing policy.

  • 10.0 /10 Critical
    CVE-2026-111813 No auth

    Apache Traffic Server - Command Injection

    Apache Traffic Server 8.0.1 to 8.1.11, 9.0.0 to 9.2.15, 10.0.0 to 10.1.4, and 10.2.0 contains a command injection caused by unauthenticated clients controlling ImageMagick convert arguments in the magick plugin default configuration, letting attackers execute arbitrary commands remotely, exploit requires default unsigned configuration.

  • 10.0 /10 Critical
    CVE-2026-111812 No auth

    Apache Traffic Server - Authentication Bypass

    Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 contains an authentication bypass caused by origin_server_auth plugin allowing clients to force signing of attacker-chosen AWS request headers under proxy credentials, letting attackers impersonate the proxy, exploit requires crafted AWS request headers.

  • 9.0 /10 Critical
    CVE-2026-111811 No auth

    Apache Traffic Server - Unrestricted File Upload

    Apache Traffic Server 8.0.0 to 8.1.11, 9.0.0 to 9.2.15, 10.0.0 to 10.1.4, and 10.2.0 contains an unrestricted file upload vulnerability in the experimental tsmemcache plugin, letting unauthenticated attackers read, write, and delete shared proxy cache data remotely, exploit requires network access.

  • 9.3 /10 Critical
    CVE-2026-111809 No auth

    Apache Traffic Server - HTTP Request Smuggling

    Apache Traffic Server 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 contains an HTTP request smuggling vulnerability caused by improper handling of HEAD requests with Content-Length or Transfer-Encoding headers, letting remote attackers smuggle requests, exploit requires crafted HEAD requests.

  • 9.8 /10 Critical
    CVE-2026-111183

    GStreamer - Remote Code Execution

    GStreamer contains a heap-based buffer overflow caused by improper validation of RTP payload length in rtpL16depay, letting remote attackers execute arbitrary code, exploit requires interaction with the library.

  • 9.8 /10 Critical
    CVE-2026-109618 CISA KEVPoC publicNo auth

    PHP - Remote Code Execution

    PHP contains a remote code execution caused by improper handling of out-of-memory errors using longjmp(), letting remote attackers execute arbitrary code by triggering uninitialized memory usage during request cleanup, exploit requires crafted requests causing OOM.

  • 10.0 /10 Critical
    CVE-2026-105944 No auth

    Apache Pulsar Manager - Broken Access Control

    Apache Pulsar Manager >= 0.3.0 contains broken access control caused by unauthenticated creation of admin accounts and unrestricted proxying of Pulsar admin API requests, letting unauthenticated attackers gain full administrative control and access cluster credentials, exploit requires network access to Pulsar Manager.

  • 9.2 /10 Critical
    CVE-2026-105869 No auth

    Apache Pulsar - Authorization Bypass

    Apache Pulsar 2.8.1 < 4.0.14 and 4.1.0 < 4.2.5 contain an authorization bypass caused by MultiRolesTokenAuthorizationProvider trusting unverified JWT claims when anonymousUserRole fallback is enabled, letting unauthenticated clients gain arbitrary roles including super-user, exploit requires anonymousUserRole setting enabled with fallback allowed.

  • 9.1 /10 Critical
    CVE-2026-9869 Auth required

    TOTOLINK X2000R - Buffer Overflow

    TOTOLINK X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 contains a stack-based buffer overflow caused by improper handling in formTR069Config functionality, letting authenticated attackers execute arbitrary code remotely, exploit requires authentication.

  • 9.1 /10 Critical
    CVE-2026-9827 Auth required

    TOTOLINK X2000R - Remote Code Execution

    TOTOLINK X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 contains an arbitrary file write vulnerability caused by improper handling in formUploadFile functionality, letting authenticated attackers execute arbitrary code remotely, exploit requires authentication.

  • 9.1 /10 Critical
    CVE-2026-9817 Auth required

    TOTOLINK X2000R - Buffer Overflow

    TOTOLINK X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 contains a stack-based buffer overflow caused by improper handling in formUploadFile functionality, letting authenticated attackers execute arbitrary code remotely, exploit requires authentication.