Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 41 of 166

  • 9.8 /10 Critical
    CVE-2026-112296 No auth

    FlyCms - Authentication Bypass

    FlyCms contains a default credentials vulnerability caused by hardcoded flycms account with password admin123, letting unauthenticated remote attackers gain super administrator access via POST /api/auth/login, exploit requires solving image captcha.

  • 9.8 /10 Critical
    CVE-2026-112292 No auth

    CheckCle - Broken Access Control

    CheckCle through 1.6.0 contains a broken access control vulnerability caused by empty API rules in shipped PocketBase collections, letting unauthenticated attackers read, modify, and delete records remotely, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-111862 No auth

    Rank Math SEO PRO - Supply Chain Compromise

    Rank Math SEO PRO for WordPress 3.0.123 packages downloaded between October 15-16, 2026 contain a supply-chain compromise caused by malware in plugin files, letting attackers establish persistent access and expose sensitive credentials, exploit requires activation of affected plugin.

  • 9.9 /10 Critical
    CVE-2026-111406 Auth required

    PT Norther Lights Production MapSVG - Unrestricted File Upload

    PT Norther Lights Production MapSVG <= 8.16.1 contains an unrestricted file upload vulnerability caused by lack of file type restrictions, letting attackers upload web shells to the server, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-111058 PoC public

    Mercury - Remote Code Execution

    Mercury < 3.2.6 contains a remote code execution caused by tokenless deployments allowing anonymous clients to create Jupyter kernels and send arbitrary execute_request messages, letting attackers execute arbitrary Python code remotely, exploit requires tokenless deployment.

  • 10.0 /10 Critical
    CVE-2026-111057 No auth

    Mercury - Command Injection

    Mercury 3.0.0 to 3.2.4 contains a command injection caused by a missing comma in BLOCKED_PATTERNS concatenating regex literals, letting unauthenticated attackers execute commands via Jupyter Server's terminal API, exploit requires no authentication.

  • 9.9 /10 Critical
    CVE-2026-110887 Auth required

    HivePress HivePress - File Inclusion

    HivePress HivePress <= 1.7.32 contains a file inclusion vulnerability caused by improper control of code generation, letting remote attackers include and execute arbitrary code, exploit requires crafted request.

  • 9.8 /10 Critical
    CVE-2026-109437 No auth

    Cognition - Remote Code Execution

    Cognition < 0.13.0 contains a remote code execution caused by unauthenticated access to REST/SSE API allowing attacker-directed shell commands via local execution backend, letting unauthenticated attackers execute code remotely.

  • 9.8 /10 Critical
    CVE-2026-109432 No auth

    Camunda - Expression Language Injection

    Camunda 7.24.0 < 7.24.14 and 7.23.0 < 7.23.17 contain an expression injection caused by improper validation of sub-query expression maps in orQueries field in TaskQueryDto, letting authenticated users execute arbitrary OS commands via malicious JUEL expressions.

  • 9.8 /10 Critical
    CVE-2026-108983

    CVE-2026-108983

    A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .

  • 9.6 /10 Critical
    CVE-2026-107188 Auth required

    Unspecified Product - Unrestricted File Upload

    An unspecified product contains an unrestricted file upload vulnerability caused by allowing upload of JSP/JSPX files, letting attackers execute commands remotely, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-107083 PoC publicNo auth

    SENAYAN Library Management System (SLiMS) Bulian - SQL Injection

    SENAYAN Library Management System (SLiMS) Bulian 9.8.0 contains a sql injection caused by improper sanitization of the fileID parameter in admin/modules/reporting/customs/dl_detail.php, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted request.

  • 9.3 /10 Critical
    CVE-2026-103091 No auth

    Google OSS Agent Mesh - Broken Access Control

    Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 through 0.1.0-alpha.8 contains missing authorization and insecure default initialization in MCP proxy and OIDC registration flow, letting remote attackers self-enroll and execute arbitrary actions across MCP backend nodes, exploit requires valid OIDC token.

  • 9.3 /10 Critical
    CVE-2026-102503 No auth

    Google OSS Agent Mesh - Broken Access Control

    Google OSS Agent Mesh (SAM) 0.1.0-alpha.1 through 0.1.0-alpha.2 contains missing authentication and authorization in /libp2p-http ingress server, letting unauthenticated remote libp2p peers bypass Biscuit capability policy and invoke arbitrary backend services, exploit requires network access to ingress server.

  • 9.8 /10 Critical
    CVE-2026-111998 No auth

    Vanus - Authentication Bypass

    Vanus 0.8.0 through 0.9.0 contains a hardcoded credentials vulnerability caused by a fixed admin token in the gateway gRPC proxy port, letting unauthenticated remote attackers gain cluster-admin access.