Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 3 of 166

  • 9.3 /10 Critical
    CVE-2026-62048 No auth

    Liquid Web / StellarWP BookIt - SQL Injection

    Liquid Web / StellarWP BookIt <= 2.6.0.6 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries remotely, exploit requires crafted input.

  • 10.0 /10 Critical
    CVE-2026-120338 No auth

    Prefab UI - Unrestricted File Read & Write and Remote Code Execution

    Prefab UI 0.14.0 through 0.20.2 contains a file system read and write vulnerability caused by unrestricted Deno permissions and exposed Deno API in the JavaScript global object, letting attackers with code execution read/write files as the server OS user and persist code execution, exploit requires ability to supply code to the sandbox.

  • 9.9 /10 Critical
    CVE-2026-120308 Auth required

    Beta9 - Path Traversal

    Beta9 contains a path traversal caused by improper validation of volume identifiers in the gateway and worker components, letting tenants with workspace tokens read and write arbitrary files on the worker filesystem, exploit requires valid workspace token.

  • 9.9 /10 Critical
    CVE-2026-120307 Auth required

    Beta9 Worker - Broken Access Control

    Beta9 worker before 0.1.756 contains a broken access control vulnerability caused by improper path resolution in sandbox file API, letting tenants with workspace tokens read, write, list, and delete files on the host as root, exploit requires tenant to have a workspace token and running sandbox.

  • 9.9 /10 Critical
    CVE-2026-120306 Auth required

    Beta9 - Privilege Escalation

    Beta9 worker < 0.1.756 contains a privilege escalation caused by Buildah RUN steps executing with shared namespaces and CAP_DAC_OVERRIDE, letting tenant users escalate privileges by accessing the worker container filesystem, exploit requires tenant workspace token.

  • 9.9 /10 Critical
    CVE-2026-120240 Auth required

    WAVLINK WN553X1-B - Command Injection

    WAVLINK WN553X1-B V260403_2.0.0 contains a command injection caused by manipulation of group_id/group_name argument in /bin/ioos WireGuard CLI Group Handler, letting remote attackers execute OS commands remotely, exploit requires crafted input.

  • 9.9 /10 Critical
    CVE-2026-120239 Auth required

    WAVLINK WN553X1-B - Command Injection

    WAVLINK WN553X1-B V260403_2.0.0 contains a command injection caused by manipulation of the "file_id" argument in /bin/ioos WireGuard CLI Handler, letting remote attackers execute arbitrary OS commands, exploit requires crafted input.

  • 9.9 /10 Critical
    CVE-2026-120238 Auth required

    WAVLINK WN553X1-B - Command Injection

    WAVLINK WN553X1-B 260403_2.0.0 contains a command injection caused by manipulation of the "file_id" argument in /bin/ioos ovpn_file Handler, letting remote attackers execute arbitrary OS commands, exploit requires crafted input.

  • 9.9 /10 Critical
    CVE-2026-120231 Auth required

    WAVLINK WN553X1-B - Command Injection

    WAVLINK WN553X1-B V260403_2.0.0 contains a command injection caused by manipulation of the argument file_id in /bin/ioos OpenVPN CLI Handler, letting remote attackers execute arbitrary OS commands, exploit requires remote access.

  • 9.9 /10 Critical
    CVE-2026-120230 Auth required

    WAVLINK WN701AE - Command Injection

    WAVLINK WN701AE 260105 contains a command injection caused by manipulation of the "vlan_name" argument in del_vlan_group of ioos Web Backend, letting remote attackers execute arbitrary OS commands, exploit requires crafted request.

  • 9.1 /10 Critical
    CVE-2026-120229 Auth required

    WAVLINK WN553X1-B - Command Injection

    WAVLINK WN553X1-B 260403_2.0.0 contains a command injection caused by manipulation of the "file_id" argument in /bin/ioos, letting remote attackers execute arbitrary OS commands, exploit requires network access.

  • 9.9 /10 Critical
    CVE-2026-120228 Auth required

    WAVLINK WN553X1-B - Command Injection

    WAVLINK WN553X1-B V260403_2.0.0 contains a command injection caused by manipulation of group_id/group_name arguments in /bin/ioos ioos Service, letting remote attackers execute arbitrary OS commands, exploit requires network access.

  • 9.9 /10 Critical
    CVE-2026-120227 Auth required

    WAVLINK WN701AE - Command Injection

    WAVLINK WN701AE M01AE_V260105 contains a command injection caused by manipulation of the "rule_name" argument in del_staticrule function of static_route_setting.sh in ioos Web Backend, letting remote attackers execute arbitrary OS commands.

  • 9.1 /10 Critical
    CVE-2026-120225 Auth required

    Oray Pugongying X5 Pro - Path Traversal

    Oray Pugongying X5 Pro <= 7.6.1 contains a path traversal caused by manipulation of the "filename" argument in config_restore_ex function of /etc/openwrt_release, letting remote attackers access arbitrary files, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-120224 Auth required

    Oray Pugongying X5 Pro - Broken Access Control

    Oray Pugongying X5 Pro <= 7.6.1 contains an improper authorization vulnerability caused by manipulation in run_apis_by_json/run_async_task API Authorization component, letting remote attackers bypass authorization, exploit requires no special privileges.