Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 39 of 166
- 9.9 /10 CriticalCVE-2026-101528 Auth required
Oracle Enterprise Manager - Remote Code Execution
Oracle Enterprise Manager for Oracle Database 13.5 and 24.1 contains a remote code execution caused by a vulnerability in Data Guard Management, letting low privileged attackers with network access via HTTP takeover the system, exploit requires low privileges.
- 9.8 /10 CriticalCVE-2026-101521 No auth
Oracle APEX - Remote Code Execution
Oracle APEX 24.1.0-24.1.21, 24.2.0-24.2.20, and 26.1.0-26.1.4 contain a remote code execution caused by an easily exploitable vulnerability in the General component, letting unauthenticated attackers with network access via HTTPS take over Oracle APEX, exploit requires network access via HTTPS.
- 9.9 /10 CriticalCVE-2026-101503 Auth required
Oracle Trusted Answer Search - Remote Code Execution
Oracle Trusted Answer Search 26.1 contains a remote code execution caused by a vulnerability in the PLSQL package, letting low privileged attackers with network access via Oracle Net take over the system, exploit requires network access.
- 9.9 /10 CriticalCVE-2026-101501 Auth required
Oracle Trusted Answer Search - Broken Access Control
Oracle Trusted Answer Search 26.1 contains a broken access control vulnerability in the PLSQL package, letting low privileged attackers with network access via Oracle Net create, delete, modify, or read critical data and cause denial of service, exploit requires network access and low privileges.
- 9.8 /10 CriticalCVE-2026-101499 No auth
Oracle WebCenter Sites - Remote Code Execution
Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 contain a remote code execution vulnerability caused by unauthenticated network access via HTTP, letting attackers fully compromise the system, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-101484 No auth
Oracle Secure Backup - Remote Code Execution
Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 contain a remote code execution caused by unauthenticated network access via TCP, letting attackers fully compromise the system, exploit requires network access.
- 9.9 /10 CriticalCVE-2026-101446 Auth required
Oracle Siebel CRM Cloud Applications - Remote Code Execution
Oracle Siebel CRM Cloud Applications 17.0-26.9 contains a remote code execution caused by an easily exploitable vulnerability in Siebel Cloud Manager, letting low privileged attackers with network access takeover the application, exploit requires network access via HTTP.
- 9.6 /10 CriticalCVE-2026-101420 Auth required
Oracle PeopleSoft PeopleTools - Broken Access Control
Oracle PeopleSoft PeopleSoft Enterprise PeopleTools 8.61-8.63 contains a broken access control vulnerability in SQR component, letting low privileged attackers with network access via HTTP create, delete, or modify critical data, exploit requires low privilege network access.
- 9.1 /10 CriticalCVE-2026-10141 Auth required
TOTOLINK X2000R - Unrestricted File Upload
TOTOLINK X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 contains an unsigned firmware vulnerability caused by lack of firmware signature verification in the Firmware Update functionality, letting authenticated attackers perform arbitrary firmware updates, exploit requires authenticated HTTP request.
- 9.1 /10 CriticalCVE-2026-10139 Auth required
TOTOLINK X2000R - Buffer Overflow
TOTOLINK X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 contains a stack-based buffer overflow caused by improper handling of HTTP requests in Mcli functionality, letting authenticated attackers execute arbitrary code remotely, exploit requires authentication.
- 9.1 /10 CriticalCVE-2026-10138 Auth required
TOTOLINK X2000R - OS Command Injection
TOTOLINK X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 contains an OS command injection caused by improper input handling in boa formUpload() functionality, letting authenticated attackers execute arbitrary code remotely, exploit requires authentication.
- 9.1 /10 CriticalCVE-2026-10137 Auth required
TOTOLINK X2000R - Buffer Overflow
TOTOLINK X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 contains a stack-based buffer overflow caused by improper handling in formUpload() functionality, letting authenticated attackers execute arbitrary code remotely, exploit requires authentication.
- 9.1 /10 CriticalCVE-2026-10136 Auth required
TOTOLINK X2000R - Remote Code Execution
TOTOLINK X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 contains a heap-based buffer overflow caused by improper handling in formUpload() functionality, letting authenticated attackers execute arbitrary code remotely, exploit requires authentication.
- 9.1 /10 CriticalCVE-2026-101356 No auth
Apache Tomcat - Broken Access Control
Apache Tomcat 11.0.22-11.0.26, 10.1.55-10.1.60, 9.0.118-9.0.122 contains a broken access control caused by incorrect object recycling and re-use in HTTP/2 asynchronous servlet processing, letting attackers cause request/response mix-up between users, exploit requires HTTP/2 asynchronous servlet usage.
- 9.1 /10 CriticalCVE-2026-10135 Auth required
TOTOLINK X2000R - Command Injection
TOTOLINK X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 contains a command injection caused by improper input handling in batchupg functionality, letting authenticated attackers execute arbitrary code remotely, exploit requires authentication.