Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 40 of 125

  • 9.9 /10 Critical
    CVE-2026-39759 Auth required

    Workreap Core - Unrestricted File Upload

    Workreap Core <= 3.4.5 contains an unrestricted file upload vulnerability in Employer / Sales Representative component, letting attackers upload arbitrary files remotely, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-39757 Auth required

    Taskbot - Unrestricted File Upload

    Taskbot <= 6.6 contains an unrestricted file upload vulnerability caused by improper validation of uploaded files, letting remote attackers upload arbitrary files, exploit requires network access.

  • 9.9 /10 Critical
    CVE-2026-39755 Auth required

    WP Duplicate - Unrestricted File Upload

    WP Duplicate <= 1.1.11 contains an unrestricted file upload vulnerability caused by improper validation of uploaded files, letting attackers upload arbitrary files, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-39753 No auth

    Taskbot - Privilege Escalation

    Taskbot <= 6.6 contains an unauthenticated privilege escalation vulnerability caused by improper access control, letting unauthenticated attackers escalate privileges without authentication.

  • 9.3 /10 Critical
    CVE-2026-39746 No auth

    Booknetic - SQL Injection

    Booknetic <= 4.8.5 contains an SQL injection caused by unsanitized input, letting unauthenticated attackers execute arbitrary SQL queries, exploit requires no authentication.

  • 10.0 /10 Critical
    CVE-2026-32579 No auth

    Kognetiks Chatbot for WordPress - Unrestricted File Upload

    Kognetiks Chatbot for WordPress <= 2.4.9 contains an unrestricted file upload vulnerability caused by lack of authentication, letting unauthenticated attackers upload arbitrary files remotely, exploit requires no authentication.

  • 9.9 /10 Critical
    CVE-2026-32568 Auth required

    WooCommerce Designer Pro - Remote Code Execution

    WooCommerce Designer Pro <= 1.9.33 contains a remote code execution caused by improper input handling, letting remote attackers execute arbitrary code, exploit requires no special privileges.

  • 9.3 /10 Critical
    CVE-2026-32557 No auth

    WooCommerce Appointments - SQL Injection

    WooCommerce Appointments <= 5.3.2 contains an unauthenticated SQL injection caused by improper input sanitization, letting remote attackers execute arbitrary SQL queries, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-106511 No auth

    MultiversX multisig-improved - Broken Access Control

    MultiversX multisig-improved contains a broken access control vulnerability caused by missing independent authorization checks, letting attackers with Proposer role move funds alone, exploit requires Proposer role.

  • 9.6 /10 Critical
    CVE-2026-106501 Auth required

    Backstage @backstage/plugin-scaffolder-backend - Information Disclosure

    Backstage @backstage/plugin-scaffolder-backend < 3.3.1, < 3.4.1, < 4.0.3, < 4.1.0 contains a sensitive information exposure caused by unauthorized access to another user's Scaffolder task data, letting authenticated users disclose internal execution data including credentials, exploit requires user authentication.

  • 9.8 /10 Critical
    CVE-2026-106446 No auth

    Handlebars - Server-Side Template Injection

    Handlebars 4.0.0 to < 4.7.10 contains a server-side template injection caused by insufficient AST validation in Handlebars.compile() and Handlebars.precompile(), letting attackers execute arbitrary code by supplying crafted AST objects, exploit requires attacker to supply an object instead of a template string.

  • 9.2 /10 Critical
    CVE-2026-106445 PoC publicNo auth

    Handlebars - Server-Side Template Injection

    Handlebars 4.0.0 to 4.7.10 contains a server-side template injection caused by lookupProperty returning Function.prototype.constructor before applying prototype-access deny list, letting attackers execute arbitrary JavaScript with server privileges, exploit requires allowProtoMethodsByDefault enabled and accessible function in template context.

  • 9.6 /10 Critical
    CVE-2026-106419 No auth

    Google Chrome - Use After Free

    Google Chrome on Android < 155.0.8059.39 contains a use after free vulnerability in ANGLE, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-106417 No auth

    Google Chrome - Integer Overflow

    Google Chrome < 155.0.8059.39 contains an integer overflow in Media component, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-106414 No auth

    Google Chrome - Remote Code Execution

    Google Chrome on iOS < 155.0.8059.39 contains a remote code execution vulnerability caused by improper input validation in Mobile component, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires social engineering.