Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 36 of 125
- 9.8 /10 CriticalCVE-2026-107204 No auth
LMCache - Remote Code Execution
LMCache <= 0.5.5 contains a remote code execution caused by unauthenticated script posting to /run_script endpoint, letting remote attackers execute arbitrary Python code, exploit requires no authentication.
- 9.1 /10 CriticalCVE-2026-107202 No auth
h-ui - Command Injection
h-ui v0.0.25 and below contains a command injection caused by improper validation of the listen configuration field in the administrative API, letting authenticated administrators execute arbitrary OS commands as root, exploit requires administrator authentication.
- 9.2 /10 CriticalCVE-2026-107194 No auth
Sungrow iSolarCloud - Authentication Bypass
Sungrow iSolarCloud < 2026 contains an authentication bypass caused by improper handling of "login_type":"5" in login requests, letting attackers bypass authentication and take over accounts, exploit requires user email address.
- 9.3 /10 CriticalCVE-2026-107104 No auth
ERP system - Insecure Deserialization
ERP system contains an insecure deserialization vulnerability caused by unsafe deserialization of user-controlled data, letting unauthenticated remote attackers execute arbitrary code or manipulate data, exploit requires crafted input.
- 9.3 /10 CriticalCVE-2026-107103 No auth
ERP system - SQL Injection
ERP system contains a SQL injection caused by insufficient validation and parameterization of user input in an API endpoint, letting unauthenticated remote attackers execute arbitrary SQL commands, exploit requires crafted input.
- 9.3 /10 CriticalCVE-2026-107102 No auth
ERP system - Authentication Bypass
ERP system contains an authentication bypass caused by improper validation of payment callback parameters and inadequate authentication controls in API endpoint, letting unauthenticated remote attackers gain unauthorized access to user accounts, exploit requires crafted parameter manipulation.
- 9.2 /10 CriticalCVE-2026-105324 No auth
ADM - HTTP Header Injection
ADM 4.1.0 through 4.3.3.RWC1 and 5.0.0 through 5.1.4.RL21 contain an HTTP header injection caused by crafted HTTP requests with injected headers via the state parameter in start-page-loader.cgi, letting unauthenticated remote attackers read arbitrary files using X-Sendfile.
- 9.8 /10 CriticalCVE-2026-105192 PoC public
LMCache - Remote Code Execution
LMCache multiprocess mode contains a remote code execution caused by unauthenticated ZeroMQ ROUTER message deserialization via pickle.loads, letting unauthenticated attackers execute code as the LMCache process user, exploit requires network access to the transport port.
- 9.8 /10 CriticalCVE-2026-104334 No auth
IBM Langflow OSS - Remote Code Execution
IBM Langflow OSS 1.0.0 through 1.12.2 contains a remote code execution caused by improper control of code generation, letting remote attackers execute arbitrary code, exploit requires no special privileges.
- 9.3 /10 CriticalCVE-2026-103416
Eclipse ThreadX NetX Duo - Out-of-Bounds Write
Eclipse ThreadX NetX Duo 6.5.1.202602 contains an out-of-bounds write caused by a TLS 1.3 handshake message larger than the cache in the handshake message cache, letting a malicious or compromised server corrupt memory before certificate authentication completes, exploit requires a malicious server to send crafted handshake messages.
- 9.3 /10 CriticalCVE-2026-102782 PoC publicNo auth
Joomla Extension ordasoft.com Simple Membership - SQL Injection
Joomla Extension ordasoft.com Simple Membership < 7.4.0 contains an unauthenticated SQL injection caused by unsanitized input in site/simplemembership.php dispatching task=checkLoginPass, letting remote attackers execute arbitrary SQL queries, exploit requires no authentication.
- 10.0 /10 CriticalCVE-2026-102255 CISA KEVPoC publicNo auth
SMA1000 Appliance - Server Side Request Forgery
SMA1000 Appliance Work Place interface contains a server side request forgery caused by an unintended alternate access path, letting remote unauthenticated attackers perform unauthorized internal requests, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2025-70521 No auth
Fanvil x7a - Command Injection
Fanvil x7a firmware version 2.6.0.1182 contains a command injection vulnerability caused by insecure handling of user-supplied input in the management portal's diagnostic ping tool, letting unauthenticated attackers execute arbitrary code on the underlying Android OS, exploit requires no authentication.
- 10.0 /10 CriticalCVE-2025-70518 No auth
Fanvil x7a - Command Injection
Fanvil x7a firmware version 2.6.0.1182 contains a command injection caused by insecure handling of user input in the management portal's diagnostic ping tool, letting unauthenticated attackers execute arbitrary code on the underlying Android OS, exploit requires no authentication.
- 9.1 /10 CriticalCVE-2025-70516 No auth
Fanvil x7a - Broken Access Control
Fanvil x7a firmware version 2.6.0.1182 contains a broken access control caused by lack of authentication restrictions in the websocket handler, letting unauthenticated users view device resources and perform diagnostic requests, exploit requires no authentication.