Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 43 of 125

  • 9.9 /10 Critical
    CVE-2026-105778 Auth required

    Tenda AC5 - Buffer Overflow

    Tenda AC5 02.03.01.111_multi contains a stack-based buffer overflow caused by manipulation of the "wifiPwd" argument in /goform/setWifi Wifi Handler, letting remote attackers cause memory corruption, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-105763 Auth required

    Twenty - Information Disclosure

    Twenty 1.20.10 to 2.7.0 contains an information disclosure caused by unprotected /metadata GraphQL connectedAccounts query exposing plaintext passwords, letting workspace members access other members' external-service credentials, exploit requires membership in the workspace.

  • 10.0 /10 Critical
    CVE-2026-105484 No auth

    TOTOLINK X6000R - Command Injection

    TOTOLINK X6000R 9.4.0cu.652_B20230116 contains a command injection caused by manipulation of the "file_name" argument in firmware_check function of /cgi-bin/cstecgi.cgi UploadFirmwareFile Handler, letting remote attackers execute arbitrary OS commands.

  • 9.8 /10 Critical
    CVE-2026-104070 No auth

    SPIP Crayons - Broken Access Control

    Crayons plugin for SPIP < 3.5.0 contains a missing authorization vulnerability caused by omission of the secu_ anti-forgery parameter in crayons_store.php, letting unauthenticated attackers modify editable object fields and execute arbitrary PHP code, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-103059

    Gitea - Authentication Bypass

    Gitea contains a broken authentication caused by case-insensitive SQL LIKE comparison of SSH public keys, letting attackers with derived private keys authenticate as other users, exploit requires SSH server enabled.

  • 9.6 /10 Critical
    CVE-2026-102322 No auth

    Google Chrome - Broken Access Control

    Google Chrome < 155.0.8059.39 contains an incorrect authorization vulnerability in SiteIsolation, letting remote attackers execute arbitrary code via crafted HTML pages, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-102159 No auth

    CV-CUE - Broken Access Control

    CV-CUE backend contains an access control flaw allowing unauthenticated network attackers to access internal service functionality, potentially exposing sensitive location information or disrupting services, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-101155 Auth required

    Software Management Studio - Broken Access Control

    Software Management Studio contains a broken access control vulnerability caused by improper validation of file operations in the Software Repository, letting authenticated attackers with specific permissions read or write files beyond intended scope, exploit requires specific permissions.

  • 9.1 /10 Critical
    CVE-2026-101023 No auth

    Gitea - Authentication Bypass

    Gitea contains an OAuth2 token endpoint vulnerability caused by improper validation of token type in refresh_token grant, letting attackers with access tokens extend access beyond original lifetime, exploit requires valid access token.

  • 9.8 /10 Critical
    CVE-2025-71383 No auth

    Dbit WIFI4 N300 - Denial of Service

    Dbit WIFI4 N300 1.0.0 contains a denial of service caused by an error in JSON parser when a request from local Wi-Fi network lacks /api/login username or password field, letting local attackers crash the management interface.

  • 9.8 /10 Critical
    CVE-2026-97283 No auth

    Liquid Web / StellarWP Advanced Post Manager - Insecure Deserialization

    Liquid Web / StellarWP Advanced Post Manager <= 4.5.5 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 9.3 /10 Critical
    CVE-2026-91107 Auth required

    openSIS Classic - Broken Access Control

    openSIS Classic 9.3 contains a broken access control vulnerability caused by improper authorization in the School Information update path, letting authenticated users with teacher role reset arbitrary staff passwords, exploit requires teacher role authentication.

  • 9.8 /10 Critical
    CVE-2026-88424 No auth

    FineAdmin - SQL Injection

    FineAdmin v1.0 contains a sql injection caused by unsanitized input in the field/order parameter at ButtonService.GetListByFilter(), letting attackers access sensitive database information via crafted SQL statements, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-88395 No auth

    GouGuOA - SQL Injection

    GouGuOA <= 6.0.5 contains a sql injection caused by unsanitized keywords parameter in /home/message/rubbish, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted request.

  • 9.8 /10 Critical
    CVE-2026-88393 No auth

    WookTeam - Remote Code Execution

    WookTeam <= 1.6.6 contains a remote code execution caused by unsafe eval of base64-decoded data parameter in /api/project/task/export, letting attackers execute arbitrary PHP code remotely, exploit requires crafted request.