Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 40 of 166
- 9.1 /10 CriticalCVE-2026-10133 Auth required
TOTOLINK X2000R - Buffer Overflow
TOTOLINK X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 contains a stack-based buffer overflow caused by improper handling in batchupg functionality, letting authenticated attackers execute arbitrary code remotely, exploit requires authentication.
- 9.1 /10 CriticalCVE-2026-10132 Auth required
TOTOLINK X2000R - Buffer Overflow
TOTOLINK X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 contains a stack-based buffer overflow caused by improper handling in boa formIpQos mac functionality, letting authenticated attackers execute arbitrary code remotely, exploit requires authenticated HTTP request.
- 9.1 /10 CriticalCVE-2026-10131 Auth required
TOTOLINK X2000R - OS Command Injection
TOTOLINK X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 contains an OS command injection caused by improper input handling in boa formPasswordSetup functionality, letting authenticated attackers execute arbitrary code remotely, exploit requires authentication.
- 9.1 /10 CriticalCVE-2026-101296 No auth
Apache Tomcat - Authentication Bypass
Apache Tomcat 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122 contain an authentication bypass caused by missing critical authentication step in JNDI realm with non-GSSAPI SASL mechanism, letting attackers authenticate without correct password, exploit requires JNDI realm configuration with non-GSSAPI SASL.
- 9.8 /10 CriticalCVE-2026-90910 No auth
Apache Answer - Broken Access Control
Apache Answer <= 2.0.2 contains a broken access control caused by missing authentication enforcement in the reaction API, letting unauthorized users read restricted reaction metadata and modify their own reactions, exploit requires no authentication.
- 10.0 /10 CriticalCVE-2026-78162 PoC public
Apache Camel - Insecure Deserialization
Apache Camel 4.0.0 before 4.18.5, 4.19.0 before 4.22.1 contains an insecure deserialization vulnerability caused by missing JavaSerializationFilterConfig in certain Hazelcast configuration paths, letting attackers publishing to the Hazelcast cluster achieve remote code execution, exploit requires attacker to publish malicious serialized objects to the Hazelcast cluster.
- 9.8 /10 CriticalCVE-2026-71253 No auth
Apache Johnzon - Unsafe Reflection
Apache Johnzon 1.0.0 before 2.2.0 contains an unsafe reflection vulnerability caused by ClassConverter loading and static-initializing attacker-named classes from untrusted JSON, letting attackers execute arbitrary code remotely, exploit requires crafted JSON input.
- 9.2 /10 CriticalCVE-2026-112900
Pillow - Command Injection
Pillow 2.6.0 to 13.0.0 contains a command injection caused by unsafe handling of caller-controlled EPS input filenames in EpsImagePlugin.Ghostscript, letting attackers inject Ghostscript arguments, exploit requires control of filename and referenced argument-file.
- 9.8 /10 CriticalCVE-2026-112779
Grav API plugin - Denial of Service & Broken Access Control
Grav API plugin 1.0.40 before 1.0.42 contains a denial of service caused by caching full translation dictionaries for every language code on unauthenticated GET /api/v1/translations/{lang}, and broken access control in sync and batch copy endpoints, letting unauthenticated attackers exhaust disk or APCu and authenticated users with api.pages.write overwrite translations or create pages bypassing page-level rules.
- 9.8 /10 CriticalCVE-2026-112776 No auth
Craft CMS - Authorization Bypass
Craft CMS > 5.0.0 < 5.11.0 contains an authorization bypass caused by lack of requireAllowedSite() enforcement in site-scoped GraphQL tokens, letting attackers mutate other sites' content using site-A tokens, exploit requires valid site-scoped token.
- 9.2 /10 CriticalCVE-2026-112403 No auth
Pillow - Heap Corruption & Remote Code Execution
Pillow < 13.0.0 contains a heap corruption vulnerability caused by improper verification of JPEG decoder output width and component count when using draft scaling, letting attackers supply crafted JPEGs to cause crashes or code execution, exploit requires processing crafted JPEG images.
- 9.2 /10 CriticalCVE-2026-112398
Pillow - Buffer Overflow
Pillow < 13.0.0 contains a buffer overflow caused by improper handling of FlashPix JPEG-tile decoding in ImagingJpegDecode, letting attackers supply crafted OLE2 FlashPix files to execute arbitrary code, exploit requires olefile dependency and untrusted input.
- 9.2 /10 CriticalCVE-2026-112393 No auth
Pillow - Buffer Overflow
Pillow 2.0.0 to 13.0.0 contains a heap buffer overflow and stale-heap disclosure caused by incorrect allocation sizing in _tiffWriteProc when saving compressed TIFF data to targets without usable fileno(), letting attackers cause crashes or code execution, exploit requires saving TIFF to non-file targets like BytesIO.
- 9.9 /10 CriticalCVE-2026-112371 Auth required
H3C Magic NX15 - Command Injection
H3C Magic NX15 NX15V100R017 contains a command injection caused by manipulation of the "path" argument in /api/esps RPC Interface, letting remote attackers execute arbitrary code remotely, exploit requires crafted request.
- 9.9 /10 CriticalCVE-2026-112370 Auth required
H3C Magic NX15 - Command Injection
H3C Magic NX15 100R017 contains a command injection caused by manipulation in sub_416874 function of /usr/bin/usrlist, letting remote attackers execute arbitrary OS commands, exploit requires network access.