Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 33 of 166

  • 9.6 /10 Critical
    CVE-2026-87347 Auth required

    Oracle HTTP Server - Broken Access Control

    Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 contain a broken access control vulnerability in the OSSL Module, letting low privileged attackers with network HTTP access modify or access critical data, exploit requires low privilege network access.

  • 10.0 /10 Critical
    CVE-2026-87337 No auth

    Oracle Access Manager - Authentication Bypass

    Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 contain an authentication bypass caused by a flaw in the Authentication Engine, letting unauthenticated attackers with network HTTP access modify or access critical data, exploit requires network access via HTTP.

  • 9.1 /10 Critical
    CVE-2026-87302 No auth

    Oracle WebLogic Server - Broken Access Control

    Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contain an unauthorized data access and modification vulnerability caused by unauthenticated network access via HTTP, letting attackers create, delete, or modify critical data without authentication.

  • 9.8 /10 Critical
    CVE-2026-87251 No auth

    Oracle Access Manager - Authentication Bypass

    Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 contain an authentication bypass caused by unauthenticated network access via SAML, letting attackers fully compromise Oracle Access Manager, exploit requires network access.

  • 9.3 /10 Critical
    CVE-2026-86471 Auth required

    Apache CouchDB - Command Injection

    Apache CouchDB <= 3.5.2 contains a command injection caused by unvalidated runtime configuration values, letting CouchDB server admins execute arbitrary shell commands as the OS user, exploit requires admin privileges.

  • 9.8 /10 Critical
    CVE-2026-83399 No auth

    Oracle WebLogic Server - Remote Code Execution

    Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contain a remote code execution caused by unauthenticated network access via T3 and IIOP protocols, letting attackers fully compromise the server, exploit requires network access to T3 or IIOP.

  • 9.8 /10 Critical
    CVE-2026-83397 No auth

    Oracle Data Integrator - Remote Code Execution

    Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 contain a remote code execution caused by unauthenticated network access via HTTP to Console / Repository Explorer, letting attackers fully compromise the system, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-83396 No auth

    Oracle Data Integrator - Remote Code Execution

    Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 contain a remote code execution caused by unauthenticated network access via RMI in Console / Repository Explorer, letting attackers fully compromise the system, exploit requires network access to RMI.

  • 10.0 /10 Critical
    CVE-2026-81212 No auth

    IBM DataStage on Cloud Pak for Data - Broken Access Control

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an unrestricted write vulnerability caused by unauthenticated access to shared Redis, letting anonymous attackers poison any tenant's cached flow parameters, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-77936 No auth

    Letta - Authentication Bypass & Remote Code Execution

    Letta <= 0.16.8 contains an authentication bypass caused by missing LETTA_SERVER_SECURE setting and default PostgreSQL credentials, letting remote attackers execute arbitrary Python, manage users, and run OS commands via API endpoints, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-77933 No auth

    DB-GPT - Hardcoded Credentials

    DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability caused by static MYSQL_ROOT_PASSWORD in default docker-compose.yml, letting attackers with network access authenticate as root and gain full database privileges.

  • 9.8 /10 Critical
    CVE-2026-77932 No auth

    DB-GPT - Remote Code Execution

    DB-GPT through 0.8.2 contains a remote code execution caused by a mock get_user_from_headers function granting admin role, letting unauthenticated attackers execute arbitrary code as root via /api/v1/chat/react-agent endpoint.

  • 9.8 /10 Critical
    CVE-2026-75128 No auth

    Langchain-Chatchat - Command Injection

    Langchain-Chatchat <= 0.3.1.3 contains a command injection caused by unauthenticated access to the /tools/call API endpoint invoking the shell tool, letting remote attackers execute arbitrary OS commands as root, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-60432 No auth

    Oracle Solaris - Remote Code Execution

    Oracle Solaris 11.3 and 11.4 contain a remote code execution vulnerability in Image Packaging System, letting unauthenticated network attackers fully compromise the system, exploit requires network access via HTTP.

  • 9.2 /10 Critical
    CVE-2026-43845

    Unknown - Authentication Bypass

    Unknown product contains an authentication bypass caused by a flaw in the password reset mechanism, letting attackers bypass authentication, exploit requires unspecified conditions.