Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 35 of 166
- 9.1 /10 CriticalCVE-2026-35499 Auth required
Totolink X2000R - Command Injection
Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 contains a command injection caused by improper input handling in boa formWsc peerRptPin functionality, letting authenticated attackers execute arbitrary code remotely.
- 9.1 /10 CriticalCVE-2026-33568 Auth required
TOTOLINK X2000R - Command Injection
TOTOLINK X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 contains a command injection caused by improper input handling in boa formMapDelDevice macstr functionality, letting authenticated attackers execute arbitrary code remotely, exploit requires authentication.
- 9.1 /10 CriticalCVE-2026-28763 Auth required
TOTOLINK X2000R - Buffer Overflow
TOTOLINK X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 contains a stack-based buffer overflow caused by improper handling in boa formMapDelDevice hostname functionality, letting authenticated attackers execute arbitrary code remotely, exploit requires authentication.
- 9.8 /10 CriticalCVE-2026-113802 No auth
Wavlink WL-WN530BE1-A - Command Injection
Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains a command injection caused by unsanitized file_id parameter in /protocol.csp?opt=ovpn_file with type=del, letting remote unauthenticated attackers execute arbitrary commands as root by sending a forged IP-FROM: 127.0.0.1 header.
- 9.9 /10 CriticalCVE-2026-113709 Auth required
Argo CD - Command Injection
Argo CD 2.1.0 to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 contains a command injection caused by helmGlobals.configHome pointing Helm's config directories to a repository-controlled location, letting attackers execute commands as repo-server user, exploit requires --enable-helm enabled by operator.
- 9.9 /10 CriticalCVE-2026-113708 Auth required
Argo CD - Command Injection
Argo CD 2.7.0 to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 contains a command injection caused by improper handling of ref or version query values in Kustomize URLs, letting attackers execute commands as repo-server user via local transport, exploit requires Application get permission.
- 9.3 /10 CriticalCVE-2026-113703 No auth
SuggestArr - Authentication Bypass
SuggestArr before 3.0.0 contains an authentication bypass caused by trusting the spoofable X-Forwarded-For header in local_bypass mode, letting attackers gain unauthenticated admin access, exploit requires crafted X-Forwarded-For header.
- 9.9 /10 CriticalCVE-2026-113678 Auth required
Froxlor - Privilege Escalation
Froxlor < 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats, letting authenticated customers escalate privileges by abusing root-run traffic cron to take ownership of arbitrary host directories.
- 9.9 /10 CriticalCVE-2026-113672 Auth required
Argo CD - Path Traversal
Argo CD 0.9.0 to <3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 contains a path traversal caused by unrestricted import evaluation in .jsonnet files in repo-server, letting attackers read arbitrary files and exhaust memory, exploit requires Application get permission on existing directory Application.
- 9.8 /10 CriticalCVE-2026-113620
Eclipse ioFog Controller - Authentication Bypass
Eclipse ioFog Controller 3.8.0 through 3.9.1 contains a broken authentication caused by lack of bearer JWT verification on operator WebSocket upgrades for exec and log routes, letting attackers open exec or log sessions for known microservices or fogs without proper authorization, exploit requires attacker to know target UUID.
- 9.9 /10 CriticalCVE-2026-113506 Auth required
aaPanel - Command Injection
aaPanel <= 8.25.0 contains an OS command injection caused by manipulation of the sfile/dfile/access/user arguments in ExecShell function of File Manager, letting authenticated remote attackers execute arbitrary commands.
- 9.9 /10 CriticalCVE-2026-113391 Auth required
DrayTek Vigor2960 - Command Injection
DrayTek Vigor2960 1.5.1.6 contains a command injection caused by manipulation of uploadlangs function in /cgi-bin/mainfunction.cgi Upload Endpoint, letting remote attackers execute arbitrary commands, exploit requires no special privileges.
- 9.9 /10 CriticalCVE-2026-113390 Auth required
DrayTek Vigor2960 - Command Injection
DrayTek Vigor2960 1.5.1.6 Revision 8218 contains an OS command injection caused by manipulation of the usefile/usescript/option arguments in /cgi-bin/mainfunction.cgi CGI Interface, letting remote attackers execute arbitrary commands, exploit requires no special privileges.
- 9.9 /10 CriticalCVE-2026-113389 Auth required
DrayTek Vigor2960 - Command Injection
DrayTek Vigor2960 1.5.1.6 Revision 8218 contains a command injection caused by manipulation of the "sectiontype" argument in /cgi-bin/mainfunction.cgi set_table function, letting remote attackers execute arbitrary commands, exploit requires no special privileges.
- 9.3 /10 CriticalCVE-2026-113380 No auth
Signal RingRTC - Denial of Service
Signal RingRTC library < 2.72.0 contains a denial of service caused by a peer saturating a call's FSM queue, letting attackers interfere with local hangup and call teardown, exploit requires a malicious peer.