Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 33 of 125
- 9.1 /10 CriticalCVE-2026-107510 Auth required
Unspecified Product - Privilege Escalation
An unspecified product contains a privilege escalation caused by injection of arguments in troubleshooting commands, letting authenticated high privilege users escalate their privileges.
- 9.8 /10 CriticalCVE-2026-107459 No auth
Openfind SecuShare Pro - Command Injection
Openfind SecuShare Pro contains an OS command injection caused by improper input sanitization, letting unauthenticated remote attackers execute arbitrary OS commands on the server, exploit requires no authentication.
- 9.5 /10 CriticalCVE-2026-107406 PoC public
Citrix NetScaler ADC - Remote Code Execution & Denial of Service
Citrix NetScaler ADC and NetScaler Gateway in specified versions contain a memory overflow vulnerability caused by improper handling in SAML SP or IdP configurations, letting attackers cause remote code execution or denial of service, exploit requires SAML SP or IdP configuration.
- 9.9 /10 CriticalCVE-2026-106126 Auth required
Tenable Identity Exposure - Command Injection
Tenable Identity Exposure (SaaS) contains a command injection caused by improper input handling in Active Directory Events Listener, letting authenticated low-privileged attackers execute arbitrary commands as SYSTEM on the PDCe, exploit requires authentication.
- 9.8 /10 CriticalCVE-2026-105110 No auth
Iskratel Innbox GPON ONT - Command Injection
Iskratel Innbox GPON ONT contains a command injection caused by improper sanitization of the CLI parameter in the login.xgi CGI endpoint, letting unauthenticated remote attackers execute arbitrary commands as root.
- 9.1 /10 CriticalCVE-2026-104076 No auth
TVU Networks Receiver/Transceiver - Authentication Bypass
TVU Networks Receiver/Transceiver devices < 7.9 contain a missing authentication vulnerability caused by unprotected REST API endpoints on port 8288, letting remote unauthenticated attackers read sensitive information and modify device configuration.
- 9.8 /10 CriticalCVE-2026-104075 No auth
TVU Networks Receiver/Transceiver - Authentication Bypass
TVU Networks Receiver/Transceiver devices < 7.9 contain an authentication bypass caused by improper validation of the UserName parameter in the web management login endpoint, letting remote unauthenticated attackers gain administrative sessions, exploit requires crafted HTTP request.
- 9.8 /10 CriticalCVE-2026-103692 No auth
Frontend Dashboard WordPress - Broken Access Control
Frontend Dashboard WordPress plugin < 3.0.5 contains a broken access control vulnerability caused by lack of authorization and nonce checks on actions, letting unauthenticated attackers take over any account including administrators.
- 9.4 /10 CriticalCVE-2026-103663
Ollama - Path Traversal & Remote Code Execution
Ollama < 0.35.0 contains a path traversal caused by insufficient validation of layer digests in /api/pull endpoint, letting unauthenticated remote attackers write malicious files outside the model store, leading to remote code execution as root, exploit requires server process write access to /usr/lib/ollama.
- 9.8 /10 CriticalCVE-2026-103646 No auth
Ultimate Multisite WordPress - Authentication Bypass
Ultimate Multisite WordPress plugin < 2.17.0 contains an authentication bypass caused by inconsistent email normalization in duplicate-account check, letting unauthenticated attackers log in as existing users, exploit requires checkout form without password and target account without customer record.
- 9.1 /10 CriticalCVE-2026-97720 No auth
Apache Impala - Authentication Bypass
Apache Impala <= 4.5.2 contains a broken authentication caused by improper JWT/OAuth token signature validation in executor webserver, letting attackers access protected resources, exploit requires webserver configured to accept JWT/OAuth tokens.
- 9.4 /10 CriticalCVE-2026-96408 No auth
Movable Type - Code Injection
Movable Type contains a code injection vulnerability in the upgrade script, letting unauthenticated attackers execute arbitrary Perl scripts or SQL queries remotely, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-95606 No auth
Liquid Web / StellarWP The Events Calendar - Insecure Deserialization
Liquid Web / StellarWP The Events Calendar <= 6.17.4 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input.
- 9.3 /10 CriticalCVE-2026-95605 No auth
Passionate Programmer Peter WP Data Access - SQL Injection
Passionate Programmer Peter WP Data Access <= 5.5.82 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-93674 PoC publicNo auth
IBM Langflow OSS - Command Injection
IBM Langflow OSS 1.0.0 through 1.12.2 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote attackers execute arbitrary code, exploit requires network access.