Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 44 of 166

  • 9.8 /10 Critical
    CVE-2026-105038 No auth

    EnergizeLab Eilik and EilikO FastAPI - Broken Access Control

    EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services contain a broken access control caused by unauthenticated exposure of AI model administration functions, letting unauthenticated remote attackers change AI model configuration and switch models at runtime.

  • 9.1 /10 Critical
    CVE-2026-105032 No auth

    EnergizeLab Eilik and EilikO - Path Traversal

    EnergizeLab Eilik and EilikO AI skill upload endpoint contains a path traversal vulnerability caused by lack of authentication and file path constraints, letting unauthenticated remote attackers write arbitrary files and tamper AI skill files, exploit requires no authentication.

  • 9.3 /10 Critical
    CVE-2026-99999 PoC publicNo auth

    Linux Kernel - Denial of Service

    Linux kernel contains a denial of service caused by improper validation of checksum_start in the ipv4 stack, letting attackers cause network header corruption, exploit requires sending malformed packets.

  • 9.5 /10 Critical
    CVE-2026-93483 No auth

    Znuny - Authentication Bypass

    Znuny through 7.3.6 contains an authentication bypass caused by trusting the attacker-controlled Remote-User HTTP header in HTTPBasicAuth modules, letting attackers impersonate any user including administrators without a password.

  • 9.3 /10 Critical
    CVE-2026-50619 No auth

    Qsirch - Path Traversal

    Qsirch contains a path traversal vulnerability caused by improper input validation, letting remote attackers read arbitrary files, exploit requires no special privileges.

  • 9.4 /10 Critical
    CVE-2026-50612 Auth required

    QuMagie - Privilege Escalation

    QuMagie < 2.9.2 contains a symbolic link following vulnerability caused by improper handling of symlinks, letting remote attackers with user accounts compromise system security, exploit requires attacker to have a user account.

  • 9.3 /10 Critical
    CVE-2026-47786 No auth

    HybridDesk Station - Command Injection

    HybridDesk Station contains a command injection caused by unsanitized input, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-47168 Auth required

    EspoCRM - Insecure Deserialization

    EspoCRM < 9.3.7 contains an insecure deserialization vulnerability caused by unrestricted deserialization of crafted serialized PHP objects in MassAction or Export parameters, letting authenticated administrators execute arbitrary code on the server.

  • 9.3 /10 Critical
    CVE-2026-34006 No auth

    sMedio DTCP MOVE - Authentication Bypass

    sMedio DTCP MOVE < 1.4.5 contains a broken authentication caused by missing authentication for critical functions, letting remote attackers gain unauthorized access, exploit requires no special privileges.

  • 9.3 /10 Critical
    CVE-2026-19863 No auth

    EthereumAuthenticator - Authentication Bypass

    EthereumAuthenticator contains an authentication bypass caused by unanchored substring matching of the login path, letting unauthenticated clients access protected resources, exploit requires the protected path to contain the login path as a later segment.

  • 9.4 /10 Critical
    CVE-2026-16438 Auth required

    Mitsubishi Electric GENESIS64 - Incorrect Privilege Assignment

    Mitsubishi Electric GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64 (all versions or <= 10.97.3) contain an incorrect privilege assignment caused by default DCOM permissions granted to administrator accounts, letting logged-in administrators locally or remotely launch and operate DCOM objects without UAC elevation, exploit requires attacker to log in with administrator account.

  • 9.2 /10 Critical
    CVE-2026-16436 No auth

    Mitsubishi Electric GENESIS - Authentication Bypass

    Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz (various versions) contain a weak password recovery mechanism caused by a fixed, common challenge response, letting remote attackers unlock the system, exploit requires obtaining the challenge response.

  • 10.0 /10 Critical
    CVE-2026-110957 No auth

    Wavlink WL-WN530BE2-A - OS Command Injection

    Wavlink WL-WN530BE2-A <= M30BE2_V250604 contains an OS command injection caused by improper handling of the REMOTE_ADDR argument in api.cgi login processing, letting remote attackers execute arbitrary commands, exploit requires remote access.

  • 9.8 /10 Critical
    CVE-2026-110911 No auth

    Wheels - SQL Injection

    Wheels 1.1.8 through 4.1.1 contains a SQL injection caused by improper parsing of caller-supplied quoted values in dynamic finders and query builder methods, letting attackers access unauthorized data, exploit requires passing crafted input to vulnerable APIs.

  • 9.8 /10 Critical
    CVE-2026-109892 No auth

    Frontend Admin by DynamiApps - Broken Access Control

    Frontend Admin by DynamiApps <= 3.29.13 contains a broken access control vulnerability caused by incorrect privilege assignment in acf-frontend-form-element, letting attackers escalate privileges, exploit requires no special conditions.