Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 42 of 166
- 9.8 /10 CriticalCVE-2026-110886 No auth
QuantumCloud Conversational Forms for ChatBot - Insecure Deserialization
QuantumCloud Conversational Forms for ChatBot <= 1.5.1 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-110372 No auth
Brainstorm Force OttoKit - Broken Access Control
Brainstorm Force OttoKit <= 1.1.40 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires attacker to trigger privilege assignment flaw.
- 9.3 /10 CriticalCVE-2026-109894 No auth
Arraytics Booktics - SQL Injection
Arraytics Booktics <= 1.0.29 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-111911 No auth
phpMyFAQ - Authentication Bypass
phpMyFAQ < 4.1.9 contains an authentication bypass caused by WebAuthn registration endpoints attaching credentials without authentication or challenge validation, letting attackers bypass passwords and TOTP for account takeover.
- 9.8 /10 CriticalCVE-2026-111823 PoC publicNo auth
Mage OSS - Authentication Bypass
Mage OSS <= 0.9.80 before 76c4f46 contains an authentication bypass caused by improper handling of unknown OAuth providers during session creation, letting attackers bypass authentication, exploit requires encountering an unknown OAuth provider.
- 9.1 /10 CriticalCVE-2026-110653 No auth
LatePoint WordPress Plugin - Authentication Bypass
LatePoint WordPress plugin <= 5.7.4 contains an authentication bypass via race condition caused by non-atomic OTP verification attempts counter update in verifyOTP function, letting unauthenticated attackers brute-force OTP and access accounts, exploit requires concurrent requests to auth__verify_otp endpoint.
- 9.8 /10 CriticalCVE-2026-104736 PoC publicNo auth
LearnPress WordPress Plugin - PHP Object Injection
LearnPress WordPress plugin <= 4.4.10 contains a PHP Object Injection caused by deserialization of untrusted 'checkout-email' parameter in checkout AJAX action, letting unauthenticated attackers inject PHP objects remotely.
- 9.8 /10 CriticalCVE-2026-111444 PoC publicNo auth
Wheels - SQL Injection
Wheels 4.1.2 contains a SQL injection caused by improper handling of backslash escaping in inline-literal paths, letting attackers alter queries via crafted input, exploit requires parameterize=false or unbound query parts.
- 9.3 /10 CriticalCVE-2026-111472 No auth
TSG Profleet - SQL Injection
TSG Profleet contains an SQL injection caused by unsanitized 'Identificación' parameter in /cgi-bin/index.php, letting attackers retrieve, create, update, and delete database data remotely, exploit requires crafted GET request.
- 10.0 /10 CriticalCVE-2026-94169 No auth
Theme-one The Grid - Command Injection
Theme-one The Grid <= 2.8.1 contains a command injection caused by improper control of code generation, letting attackers execute arbitrary commands remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-89079 No auth
Theme My Login WordPress Plugin - Privilege Escalation
Theme My Login WordPress plugin <= 7.2.1 contains a privilege escalation caused by improper user identity validation before password update, letting unauthenticated attackers change arbitrary user passwords on multi-site setups, exploit requires specific multi-site configuration.
- 9.8 /10 CriticalCVE-2026-104730 No auth
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers - Insecure Deserialization
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers WordPress plugin <= 3.7.4 contains a PHP Object Injection caused by deserialization of untrusted input, letting unauthenticated attackers inject PHP objects if a POP chain is present in other plugins/themes, exploit requires presence of a POP chain in other installed plugins or themes.
- 9.8 /10 CriticalCVE-2026-104798 No auth
My Calendar – Accessible Event Manager - Privilege Escalation
My Calendar – Accessible Event Manager WordPress plugin <= 3.8.7 contains a privilege escalation caused by unsanitized 'mcs' GET parameter allowing unauthenticated attackers to invoke arbitrary PHP functions, letting attackers gain full admin access, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-109219 No auth
Mang Board WordPress Plugin - Unrestricted File Upload
Mang Board WordPress plugin <= 2.4.4 contains an arbitrary file upload vulnerability caused by missing file extension validation in mbw_file_upload function, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit requires guest posts enabled.
- 9.8 /10 CriticalCVE-2026-109515 No auth
MailOptin WordPress Plugin - Privilege Escalation
MailOptin WordPress plugin <= 1.2.78.6 contains a privilege escalation caused by lack of allow-list validation on optin_data[form_custom_field_mappings] in subscribe_to_email_list endpoint, letting unauthenticated attackers overwrite any user password and take over accounts, exploit requires a published WordPress User Registration opt-in form.