Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 3 of 125
- 9.1 /10 CriticalCVE-2026-47168 Auth required
EspoCRM - Insecure Deserialization
EspoCRM < 9.3.7 contains an insecure deserialization vulnerability caused by unrestricted deserialization of crafted serialized PHP objects in MassAction or Export parameters, letting authenticated administrators execute arbitrary code on the server.
- 9.3 /10 CriticalCVE-2026-34006 No auth
sMedio DTCP MOVE - Authentication Bypass
sMedio DTCP MOVE < 1.4.5 contains a broken authentication caused by missing authentication for critical functions, letting remote attackers gain unauthorized access, exploit requires no special privileges.
- 9.3 /10 CriticalCVE-2026-19863 No auth
EthereumAuthenticator - Authentication Bypass
EthereumAuthenticator contains an authentication bypass caused by unanchored substring matching of the login path, letting unauthenticated clients access protected resources, exploit requires the protected path to contain the login path as a later segment.
- 9.4 /10 CriticalCVE-2026-16438 Auth required
Mitsubishi Electric GENESIS64 - Incorrect Privilege Assignment
Mitsubishi Electric GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64 (all versions or <= 10.97.3) contain an incorrect privilege assignment caused by default DCOM permissions granted to administrator accounts, letting logged-in administrators locally or remotely launch and operate DCOM objects without UAC elevation, exploit requires attacker to log in with administrator account.
- 9.2 /10 CriticalCVE-2026-16436 No auth
Mitsubishi Electric GENESIS - Authentication Bypass
Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz (various versions) contain a weak password recovery mechanism caused by a fixed, common challenge response, letting remote attackers unlock the system, exploit requires obtaining the challenge response.
- 10.0 /10 CriticalCVE-2026-110957 No auth
Wavlink WL-WN530BE2-A - OS Command Injection
Wavlink WL-WN530BE2-A <= M30BE2_V250604 contains an OS command injection caused by improper handling of the REMOTE_ADDR argument in api.cgi login processing, letting remote attackers execute arbitrary commands, exploit requires remote access.
- 9.8 /10 CriticalCVE-2026-110911 No auth
Wheels - SQL Injection
Wheels 1.1.8 through 4.1.1 contains a SQL injection caused by improper parsing of caller-supplied quoted values in dynamic finders and query builder methods, letting attackers access unauthorized data, exploit requires passing crafted input to vulnerable APIs.
- 9.8 /10 CriticalCVE-2026-109892 No auth
Frontend Admin by DynamiApps - Broken Access Control
Frontend Admin by DynamiApps <= 3.29.13 contains a broken access control vulnerability caused by incorrect privilege assignment in acf-frontend-form-element, letting attackers escalate privileges, exploit requires no special conditions.
- 9.3 /10 CriticalCVE-2026-109698 No auth
Kitae Park Mang Board WP - SQL Injection
Kitae Park Mang Board WP <= 2.4.4 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-109694 No auth
WP ManageNinja LLC Fluent CRM - Broken Access Control
WP ManageNinja LLC Fluent CRM <= 3.2.5 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires attacker to have initial access.
- 9.3 /10 CriticalCVE-2026-109688 No auth
Link Whisper INC Link Whisper Free - SQL Injection
Link Whisper INC Link Whisper Free <= 0.9.7 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-109686 No auth
Link Whisper INC Link Whisper Free - Insecure Deserialization
Link Whisper INC Link Whisper Free <= 0.9.7 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-109145 No auth
User Rights Access Manager WordPress - Broken Access Control
User Rights Access Manager WordPress plugin through 1.1.3 contains a broken access control caused by unrestricted access to an AJAX account-registration handler, letting unauthenticated attackers register administrator-equivalent accounts and take over the site, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-108587 No auth
10Web Booster - Unrestricted File Upload
10Web Booster WordPress plugin <= 2.34.10 contains an unrestricted file upload vulnerability caused by missing file type validation and leaked REST nonce, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit requires obtaining a world-readable REST nonce.
- 9.3 /10 CriticalCVE-2026-108497 No auth
TMS Amelia ameliabooking - SQL Injection
TMS Amelia ameliabooking <= 2.4.10 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.