Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 43 of 166
- 9.3 /10 CriticalCVE-2026-94388 No auth
halfdata Green Popups - SQL Injection
halfdata Green Popups < 7.6.3 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted SQL payload.
- 9.8 /10 CriticalCVE-2026-103768 No auth
ELEX WordPress HelpDesk & Customer Ticketing System - Unrestricted File Upload
ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress <= 3.3.7 contains an unrestricted file upload vulnerability caused by insufficient file type validation in the initMailPart function, letting unauthenticated attackers upload executable files and achieve remote code execution.
- 10.0 /10 CriticalCVE-2026-110958 PoC publicNo auth
Wavlink WN530HG4B - Buffer Overflow
Wavlink WN530HG4B M30HG4B_V260724 contains a heap-based buffer overflow caused by improper handling in api.cgi, letting remote attackers execute arbitrary code, exploit requires no special conditions.
- 9.1 /10 CriticalCVE-2026-55240 Auth required
Tianji - Server-Side Template Injection
Tianji < 1.31.29 contains a server-side template injection caused by unsafe use of lodash template() with default evaluate pattern in survey and monitor templates, letting workspace administrators execute arbitrary server-side JavaScript via public survey.submit endpoint, exploit requires workspace administrator to store malicious template.
- 9.4 /10 CriticalCVE-2026-105474 Auth required
SolusVM - Server-Side Template Injection
SolusVM <= 2.0.0-44576 contains a server-side template injection caused by improper input handling, letting remote authenticated users execute arbitrary code as root, exploit requires user authentication.
- 9.3 /10 CriticalCVE-2026-47218 No auth
runwasi containerd-shim-wasmtime-v1 - Remote Code Execution
runwasi containerd-shim-wasmtime-v1 < 0.6.1 contains a remote code execution caused by trusting and deserializing precompiled Wasmtime bytes from OCI image layers, letting attackers execute native code in the shim process, exploit requires victim to run crafted image.
- 9.9 /10 CriticalCVE-2026-57155 PoC publicAuth required
OPNsense - Path Traversal & Remote Code Execution
OPNsense < 26.1.11 contains a path traversal in Firewall Alias GeoIP importer's process_zip() and process_gzip() caused by unvalidated CSV country_code, letting attackers with Firewall Alias Edit privilege write files as root and execute commands, exploit requires Firewall Alias Edit privilege.
- 9.1 /10 CriticalCVE-2026-111235 No auth
OpenNMS Meridian & Horizon - Authorization Bypass
OpenNMS Meridian and Horizon contain an authorization bypass caused by case-sensitive HTTP method checks missing terminal deny rules in REST API Spring Security filter chains, letting remote unauthenticated attackers read and modify resources, exploit requires sending requests with non-canonical HTTP methods.
- 9.8 /10 CriticalCVE-2026-84731 No auth
Nutanix Prism Element - Authentication Bypass
Nutanix Prism Element contains an authentication bypass caused by misconfigured authentication filters and crafted internal management HTTP header, letting unauthenticated remote attackers gain full administrative access and execute root commands, exploit requires crafted internal management HTTP header.
- 9.6 /10 CriticalCVE-2026-57496 Auth required
Labs64 NetLicensing MCP Server - Path Traversal
Labs64 NetLicensing MCP Server < 0.1.8 contains a path traversal caused by lack of path-segment validation in product_number parameter, letting authenticated non-admin API key users retrieve plaintext tokens, exploit requires authenticated MCP client.
- 9.8 /10 CriticalCVE-2026-111329 No auth
JuggleIM im-server - Authentication Bypass
JuggleIM im-server through 1.8.16 contains a broken authentication caused by default administrator credentials admin/123456, letting unauthenticated remote attackers access the admin console and control tenant applications, exploit requires no special privileges.
- 9.1 /10 CriticalCVE-2026-102946 No auth
joserfc - Authentication Bypass
joserfc < 1.7.4 contains an authentication bypass caused by accepting JWS General JSON Serialization with an empty signatures array in jws.deserialize_json(), letting attackers supply arbitrary payloads treated as authentic, exploit requires crafted JWS General JSON input.
- 9.8 /10 CriticalCVE-2026-111281 No auth
Jooan JA-A12 - Remote Code Execution
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution caused by hard-coded credentials in jooandiag daemon, letting unauthenticated attackers execute root commands remotely via /goform/SingleHandlebyCommand.
- 9.9 /10 CriticalCVE-2026-105037 Auth required
EnergizeLab station-middleware - Path Traversal
EnergizeLab station-middleware (NestJS) 1.6.5 through 1.8.2 contains a path traversal caused by insufficient validation of file paths, letting registered low-privilege attackers read arbitrary files from the server, exploit requires attacker to be logged in.
- 9.6 /10 CriticalCVE-2026-105039 Auth required
EnergizeLab station-middleware - Broken Access Control
EnergizeLab station-middleware (NestJS) 1.6.5 through 1.8.2 contains a broken access control caused by missing user role checks on administrative APIs, letting authenticated low-privilege users retrieve AI provider keys and modify configurations and object-store contents, exploit requires user authentication.