Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 31 of 166

  • 9.3 /10 Critical
    CVE-2026-91622 No auth

    Oracle Agile Product Lifecycle Management for Process - Broken Access Control

    Oracle Agile Product Lifecycle Management for Process 6.2.4 contains a broken access control vulnerability in Product Quality Management, letting unauthenticated attackers with network access via HTTP create, delete, or modify critical data, exploit requires user interaction from a different person.

  • 9.8 /10 Critical
    CVE-2026-91495 No auth

    Oracle WebCenter Content - Remote Code Execution

    Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 contain a remote code execution caused by unauthenticated network access via HTTP, letting attackers fully compromise the system, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-91491 No auth

    Oracle Identity Manager Connector - Remote Code Execution & Takeover

    Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 contains a remote takeover vulnerability caused by unauthenticated network access via LDAP, letting attackers fully compromise the system, exploit requires network access via LDAP.

  • 9.1 /10 Critical
    CVE-2026-91490 No auth

    Oracle Identity Manager Connector - Broken Access Control

    Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 contains an unauthorized access vulnerability caused by unauthenticated network access via LDAP, letting attackers create, delete, or modify critical data without authentication.

  • 9.8 /10 Critical
    CVE-2026-91408 No auth

    Oracle Identity Manager - Remote Code Execution

    Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 contain a remote code execution caused by unauthenticated network access via T3 and IIOP protocols, letting attackers fully compromise the system without authentication.

  • 9.9 /10 Critical
    CVE-2026-91354 Auth required

    Oracle Fusion Middleware Outside In Technology - Remote Code Execution

    Oracle Fusion Middleware Outside In Technology 8.5.8 contains a remote code execution caused by an easily exploitable vulnerability in Outside In Clean Content SDK, letting low privileged attackers with network access via HTTP take over the system, exploit requires low privilege network access.

  • 9.1 /10 Critical
    CVE-2026-91341 No auth

    Oracle Outside In Technology - Integrity & Availability Impact

    Oracle Outside In Technology 8.5.8 contains an integrity and availability vulnerability caused by unauthenticated network access via HTTP, letting attackers modify critical data or cause denial of service, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-91323 No auth

    Oracle WebLogic Server - Remote Code Execution

    Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contain a remote code execution vulnerability caused by an easily exploitable flaw in the core component, letting unauthenticated attackers with network HTTP access fully compromise the server, exploit requires network access via HTTP.

  • 9.1 /10 Critical
    CVE-2026-91305 No auth

    Oracle JD Edwards EnterpriseOne Tools - Broken Access Control

    Oracle JD Edwards EnterpriseOne Tools 9.2.0.0-9.2.26.5 contains an unauthorized access vulnerability caused by insufficient installation security, letting unauthenticated network attackers via HTTPS create, delete, or modify critical data, exploit requires network access.

  • 10.0 /10 Critical
    CVE-2026-91299 No auth

    Oracle JD Edwards EnterpriseOne Orchestrator - Remote Code Execution

    Oracle JD Edwards EnterpriseOne Orchestrator 9.2.0.0-9.2.26.5 contains a remote code execution caused by unauthenticated network access via HTTP, letting unauthenticated attackers fully compromise the orchestrator and impact related products, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-91265 No auth

    Oracle JD Edwards EnterpriseOne Tools - Broken Access Control

    Oracle JD Edwards EnterpriseOne Tools 9.2.0.0-9.2.26.5 contains an unauthorized data access and modification vulnerability caused by insufficient access controls in Enterprise Infrastructure SEC, letting unauthenticated network attackers via HTTP create, delete, or modify critical data, exploit requires network access via HTTP.

  • 9.9 /10 Critical
    CVE-2026-91251 Auth required

    Oracle SOA Suite - Remote Code Execution

    Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 contain a remote code execution caused by a vulnerability in Adapters component, letting low privileged attackers with network access via HTTP take over the system, exploit requires low privilege network access.

  • 9.9 /10 Critical
    CVE-2026-91250 Auth required

    Oracle SOA Suite - Remote Code Execution

    Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 contain a remote code execution caused by multiple protocol network access in Adapters component, letting low privileged attackers fully compromise the system, exploit requires network access.

  • 9.6 /10 Critical
    CVE-2026-91243 Auth required

    Oracle Business Process Management Suite - Broken Access Control

    Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0 contain a broken access control vulnerability caused by improper authorization in the Fabric Layer, letting low privileged attackers with network access via HTTP modify or access critical data, exploit requires low privileged network access.

  • 9.1 /10 Critical
    CVE-2026-91241 Auth required

    Oracle Business Intelligence Enterprise Edition - Remote Code Execution

    Oracle Business Intelligence Enterprise Edition 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 contain a remote code execution caused by a vulnerability in Analytics Web Administration, letting high privileged attackers with network access via HTTP take over the system, exploit requires high privileges.