Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 4 of 125
- 9.2 /10 CriticalCVE-2026-102469 No auth
Eclipse Vert.x - Insecure Deserialization
Eclipse Vert.x versions [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], and 5.2.0 contain an insecure deserialization vulnerability in vertx-db2-client caused by deserializing UDT column data without filtering, letting a malicious or MITM DRDA server execute remote code or cause DoS, exploit requires attacker-controlled DRDA server or MITM position.
- 9.3 /10 CriticalCVE-2026-101287 No auth
Stela - Authentication Bypass
Stela < 1.60.1 contains an authentication bypass caused by unvalidated manipulation of the "authProcess" cookie storing userId and validSteps, letting remote attackers impersonate any account including SUPER_ADMIN, exploit requires no valid credentials or user interaction.
- 9.0 /10 CriticalCVE-2026-111283 No auth
BMC Helix Network Management - Authentication Bypass
BMC Helix Network Management on-prem < 26.3.01 contains an authentication bypass caused by improper SAML single sign-on validation, letting unauthenticated attackers log in as local administrator, exploit requires SAML SSO configuration.
- 9.3 /10 CriticalCVE-2026-102764 CISA KEVNo auth
BeyondTrust Remote Support - Broken Access Control
BeyondTrust Remote Support contains a broken access control vulnerability caused by inadequate validation of message origins in internal components, letting attackers perform unauthorized file operations on the appliance, exploit requires specific message conditions.
- 9.8 /10 CriticalCVE-2026-111322 No auth
Archon - Authentication Bypass
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability caused by unauthenticated access to the /api/* control API binding to 0.0.0.0, letting unauthenticated attackers execute commands on the host as the Archon user, exploit requires network access.
- 9.9 /10 CriticalCVE-2026-110812 Auth required
Amazon Neptune - Insecure Deserialization
Amazon Neptune engine contains an insecure deserialization vulnerability in the Gremlin graph data import component, letting authenticated remote actors with standard database permissions execute arbitrary code and access internal credentials.
- 9.8 /10 CriticalCVE-2026-97668 No auth
Abandoned Cart Pro for WooCommerce - SQL Injection
Abandoned Cart Pro for WooCommerce <= 10.8.0 contains a SQL injection caused by insufficient escaping of user-supplied data in update_guest_persistent_cart(), letting unauthenticated attackers extract and modify usermeta data, exploit requires crafted input in checkout fields.
- 9.8 /10 CriticalCVE-2026-97657 PoC publicNo auth
Abandoned Cart Pro for WooCommerce - Authentication Bypass
Abandoned Cart Pro for WooCommerce <= 10.8.0 contains an authentication bypass caused by malleable AES-CTR encryption and bypassable HMAC in cart-recovery tokens, letting unauthenticated attackers achieve full account takeover via crafted cart IDs, exploit requires possession of a legitimate cart-recovery link.
- 9.8 /10 CriticalCVE-2026-93388 No auth
Printcart Store WooCommerce - Remote Code Execution
Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce <= 2.9.1 contains an unauthenticated arbitrary file upload vulnerability caused by improper validation of the gapi[name] parameter in nbdesigner_copy_image_from_url AJAX action, letting unauthenticated attackers upload and execute arbitrary PHP code remotely, exploit requires no authentication.
- 9.3 /10 CriticalCVE-2026-92152 No auth
F´ (F Prime) - Buffer Overflow
F´ (F Prime) 4.1.0 to 4.2.0 contains a buffer overflow caused by lack of range check on deserialized port field in Svc::GenericHub output-port dispatch, letting remote attackers cause heap corruption or remote code execution, exploit requires remote hub packet with out-of-bounds port index.
- 9.1 /10 CriticalCVE-2026-92097 No auth
Click to Chat for WhatsApp - Template Injection
Click to Chat for WhatsApp WordPress plugin <= 4.44 contains an arbitrary shortcode execution vulnerability caused by unsanitized URL input passed to do_shortcode() in greetings templates, letting unauthenticated attackers execute arbitrary shortcodes.
- 9.0 /10 CriticalCVE-2026-91881 No auth
Dell Terraform Provider for Redfish - Improper Certificate Validation
Dell Terraform Provider for Redfish < 1.6.2 contains an improper certificate validation vulnerability in the HTTP transport component, letting unauthenticated remote attackers perform man-in-the-middle attacks to intercept sensitive data, exploit requires network access.
- 9.9 /10 CriticalCVE-2026-89310 Auth required
Unspecified Product - SQL Injection
An unspecified product contains a SQL injection caused by unparameterized and unescaped input from the request body, letting remote attackers execute arbitrary SQL statements in the database context, exploit requires crafted request.
- 9.8 /10 CriticalCVE-2026-87855 No auth
JTL-Connector for WooCommerce - Unrestricted File Upload
JTL-Connector for WooCommerce WordPress plugin <= 2.4.3 contains an arbitrary file upload vulnerability caused by insufficient file type validation and improper authentication in saveImage(), letting unauthenticated attackers upload executable files and achieve remote code execution.
- 9.0 /10 CriticalCVE-2026-86002 Auth required
Dokku - Command Injection
Dokku < 0.38.25 contains a command injection caused by unsafe evaluation of docker-options plugin strings in Bash eval, letting users with app-level access and SSH execute arbitrary commands with dokku user privileges.