Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 38 of 166
- 9.9 /10 CriticalCVE-2026-112380 Auth required
Kiro Crew - Broken Access Control
Kiro Crew contains a broken access control caused by missing authorization in the WhatsApp group channel, letting remote group members execute arbitrary commands on the host, exploit requires membership in the operator-configured WhatsApp group.
- 9.8 /10 CriticalCVE-2026-109442 No auth
piflow - Remote Code Execution
piflow 2.0.0 through 2.0.1 contains a remote code execution caused by lack of authentication in DeepAgents chat agent POST /chat and POST /chat/stream endpoints, letting attackers run arbitrary commands and access environment secrets, exploit requires no authentication.
- 9.1 /10 CriticalCVE-2026-109395 No auth
Ning compress-lzf - Out-of-Bounds Read/Write
Ning compress-lzf < 1.2.0 contains an out-of-bounds memory access vulnerability caused by improper validation of back-references and literal runs in UnsafeChunkDecoder, letting attackers leak JVM heap memory or crash the JVM, exploit requires crafted LZF streams.
- 9.1 /10 CriticalCVE-2026-105772 No auth
Google ADK TypeScript - Path Traversal
Google ADK TypeScript (@google/adk) < 0.6.0 contains a path traversal caused by crafted relative or percent-encoded sequences in userId or sessionId parameters in FileArtifactService, letting remote unauthenticated attackers read or write files outside intended storage, exploit requires non-default FileArtifactService enabled.
- 9.9 /10 CriticalCVE-2026-105312 Auth required
Kubernetes Console - Broken Access Control
Kubernetes with Console custom resources allows tenants with create permission to set arbitrary container images in spec.containers.api.spec.image, letting attackers deploy pods with elevated Strimzi CRD permissions, exploit requires create permission on Console custom resources.
- 9.1 /10 CriticalCVE-2026-103119 No auth
Apache Tomcat - Buffer Overflow
Apache Tomcat 11.0.0-M25 through 11.0.26 contains a buffer under-read caused by improper handling of large non-blocking writes, letting attackers cause request failures and possible data leakage between responses, exploit requires crafted requests on the same connection.
- 10.0 /10 CriticalCVE-2026-101809 No auth
Oracle E-Business Suite Workflow - Remote Code Execution
Oracle E-Business Suite Workflow 12.2.3-12.2.15 contains a remote code execution caused by unauthenticated network access via HTTP in Workflow Notification Mailer, letting unauthenticated attackers fully compromise Workflow and related products, exploit requires network access.
- 9.1 /10 CriticalCVE-2026-101808 No auth
Oracle Product Workbench - Broken Access Control
Oracle E-Business Suite Product Workbench 12.2.3-12.2.15 contains an unauthorized access vulnerability in WebUI, letting unauthenticated attackers with network access via HTTP create, delete, or modify critical data.
- 9.8 /10 CriticalCVE-2026-101767 No auth
Oracle Application Object Library - Remote Code Execution
Oracle Application Object Library 12.2.3-12.2.15 contains a remote code execution caused by an unauthenticated network access via HTTP, letting attackers fully compromise the application, exploit requires network access.
- 9.1 /10 CriticalCVE-2026-101765 No auth
Oracle Communications Billing and Revenue Management - Broken Access Control
Oracle Communications Billing and Revenue Management 15.0.0.0.0 to 15.2.0.0.0 contains a broken access control vulnerability caused by improper authorization, letting unauthenticated network attackers create, delete, or modify critical data, exploit requires network access via HTTP.
- 9.8 /10 CriticalCVE-2026-101763 No auth
Oracle Communications BRM - Elastic Charging Engine - Remote Code Execution
Oracle Communications BRM - Elastic Charging Engine 15.0.0.0.0 to 15.2.0.0.0 contains a remote code execution caused by unauthenticated network access via RMI, letting unauthenticated attackers fully compromise the system, exploit requires network access to RMI.
- 9.1 /10 CriticalCVE-2026-101634 No auth
Oracle Mobile Field Service - Unauthorized Access & Denial of Service
Oracle Mobile Field Service 12.2.3-12.2.15 contains an unauthenticated network access vulnerability in Internal Operations, letting attackers gain unauthorized access to critical data or cause denial of service, exploit requires network access via HTTP.
- 9.1 /10 CriticalCVE-2026-101590 No auth
Oracle Fusion Middleware Helidon - Broken Access Control
Oracle Fusion Middleware Helidon 4.0.0-4.5.5 contains an unauthorized access vulnerability in helidon-microprofile-security, letting unauthenticated attackers with network HTTP access create, delete, or modify critical data, exploit requires network access via HTTP.
- 9.8 /10 CriticalCVE-2026-101537 No auth
Oracle Solaris - Remote Code Execution
Oracle Solaris 11.4 contains a remote code execution vulnerability in Utility component, letting unauthenticated network attackers fully compromise the system, exploit requires network access via TCP.
- 9.9 /10 CriticalCVE-2026-101529 Auth required
Oracle Enterprise Manager - Remote Code Execution
Oracle Enterprise Manager for Oracle Database 13.5 and 24.1 contains a remote code execution caused by a vulnerability in Data Guard Management, letting low privileged attackers with network access via HTTP takeover the system, exploit requires low privileges and network access.