Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 4 of 166
- 10.0 /10 CriticalCVE-2026-120198 No auth
WAVLINK WL-WN530BE1-A - Command Injection
WAVLINK WL-WN530BE1-A V251117 contains a command injection caused by manipulation of the argument group_name/IP-FROM in con_check_read_finish function, letting remote attackers execute arbitrary commands, exploit requires crafted input.
- 9.9 /10 CriticalCVE-2026-120197 Auth required
WAVLINK WL-WN530HG4B - Command Injection
WAVLINK WL-WN530HG4B M_V260724 contains a command injection caused by manipulation of the "Name" argument in /cgi-bin/wapi.cgi port_forward function, letting remote attackers execute arbitrary OS commands, exploit requires crafted request.
- 9.9 /10 CriticalCVE-2026-120196 Auth required
WAVLINK WN579X3-D - Command Injection
WAVLINK WN579X3-D V250402 contains a command injection caused by manipulation of the "Name" argument in /cgi-bin/wapi.cgi port_forward function, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.
- 10.0 /10 CriticalCVE-2026-120195 No auth
WAVLINK WL-WN579A3-A - Command Injection
WAVLINK WL-WN579A3-A 2026-03-10-94f93d4 contains a command injection caused by manipulation of the "wlan_ssid" argument in /cgi-bin/adm.cgi set_wzdgwMesh function, letting remote attackers execute arbitrary OS commands, exploit requires crafted request.
- 10.0 /10 CriticalCVE-2026-120189 No auth
D-Link DIR-505 - Buffer Overflow
D-Link DIR-505 1.10B02 contains a stack-based buffer overflow caused by manipulation of the TFTP Upload Filename Handler in /usr/bin/tftpd, letting remote attackers execute arbitrary code, exploit requires remote access.
- 9.1 /10 CriticalCVE-2026-89270 No auth
Popup Builder - Authorization Bypass
Popup Builder WordPress plugin <= 4.4.5 contains an authorization bypass caused by improper user authorization verification and flawed SGPopup::find() logic, letting unauthenticated attackers trash all published popups via crafted GET requests.
- 9.8 /10 CriticalCVE-2026-120209 No auth
AJ-Report - Remote Code Execution
AJ-Report through 1.7.1 contains a remote code execution caused by hard-coded JWT secret allowing attackers to forge share tokens and execute scripts via testTransform endpoint, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-120201 No auth
Jpom - Authentication Bypass
Jpom 2.10.0 through 2.11.12 contains an authentication bypass caused by injection of query conditions into the JPOM-USER-TOKEN header, letting unauthenticated attackers gain super-administrator access and execute commands, exploit requires crafted header injection.
- 9.8 /10 CriticalCVE-2026-119096 CISA KEVNo auth
Uncanny Toolkit for LearnDash - Authentication Bypass
Uncanny Toolkit for LearnDash WordPress plugin <= 3.8.2 contains an authentication bypass caused by parser-differential flaw in email parameter handling in uo_login_action(), letting unauthenticated attackers bypass account verification and suspension controls, exploit requires nonce from ult-refresh-nonce endpoint.
- 9.8 /10 CriticalCVE-2026-118636 No auth
Apache MINA - Insecure Deserialization
Apache MINA 3.0 codec module contains an insecure deserialization vulnerability caused by JavaNativeMessageDecoder calling ObjectInputStream.readObject() without a class filter, letting attackers execute remote code via crafted frames, exploit requires untrusted peer interaction.
- 9.8 /10 CriticalCVE-2026-118235 No auth
SimpleForm WordPress Plugin - Unrestricted File Upload
SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications WordPress plugin <= 3.10.2 contains an arbitrary file upload vulnerability caused by missing server-side file key allowlist and improper extension validation in handle_upload, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit requires access to the nonce in public form data.
- 9.3 /10 CriticalCVE-2026-117656 No auth
Assent - Authentication Bypass
Assent 0.1.25 to < 0.3.2 contains an acceptance of extraneous untrusted data vulnerability in Sign in with Apple strategy caused by unverified user parameter merging over verified ID token claims, letting unauthenticated remote attackers impersonate users via the authorization callback user parameter.
- 9.1 /10 CriticalCVE-2026-116557 No auth
WP Booking System - Booking Calendar - Broken Access Control
WP Booking System - Booking Calendar plugin for WordPress <= 2.1.0.5 contains a broken access control caused by missing capability check in wpbs_action_ajax_calendar_remove_note() function, letting authenticated attackers with Subscriber-level access delete arbitrary calendar notes.
- 9.8 /10 CriticalCVE-2026-116512 CISA KEVNo auth
Project Manager - Remote Code Execution
Project Manager WordPress plugin <= 4.1.1 contains a remote code execution caused by unsanitized 'id' parameter concatenated into a validation rule string, letting unauthenticated attackers execute arbitrary code remotely, exploit requires crafted REST request.
- 9.8 /10 CriticalCVE-2026-109220 No auth
PDF Invoice for WooCommerce + Drag and Drop Template Builder - Remote Code Execution
PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress <= 7.1.1 contains a PHP Object Injection caused by insufficient sanitization of the 'customer_note' parameter, letting unauthenticated attackers execute code on the server, exploit requires triggering checkout via public Store API with specific payment methods.