Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 44 of 125
- 9.8 /10 CriticalCVE-2026-88391 No auth
Northstar - Remote Code Execution
Northstar <= 9.1.1 contains a remote code execution caused by exposed H2 Console without authentication and default credentials, letting network-reachable attackers execute arbitrary system commands pre-authentication.
- 9.0 /10 CriticalCVE-2026-79820 No auth
HPE Integrated Lights-Out (iLO) 7 - Authentication Bypass
HPE Integrated Lights-Out (iLO) 7 firmware contains a user validation failure vulnerability, letting remote attackers bypass authentication, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-37719 No auth
dormakaba evolo Service - Remote Code Execution
dormakaba evolo Service contains a remote code execution caused by a vulnerability in a .NET component, letting remote attackers execute arbitrary code as SYSTEM, exploit requires network access.
- 9.3 /10 CriticalCVE-2026-21589 CISA KEVPoC publicNo auth
Atlassian Data Center - Arbitrary File Access
Atlassian Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye Data Center versions contain an arbitrary file access vulnerability caused by improper access control in the web application root directory, letting unauthenticated attackers access specific files with prior knowledge of exact file names and paths, exploit requires prior knowledge of target file path.
- 9.9 /10 CriticalCVE-2026-105740 CISA KEVAuth required
Langflow - Remote Code Execution
Langflow < 1.9.0 contains a remote code execution caused by unsanitized command injection in MCP server with "Stdio" transport, letting authenticated users execute arbitrary commands on the server, exploit requires user authentication.
- 9.9 /10 CriticalCVE-2026-105697
Langflow - Command Injection
Langflow < 1.10.3 contains a command injection caused by unsanitized user input in MCP server configuration commands, letting attackers execute arbitrary OS commands as the Langflow process user, exploit requires access to MCP server settings or MCP Tools component.
- 9.9 /10 CriticalCVE-2026-105691 Auth required
Penpot - Command Injection
Penpot < 2.18.0 contains a command injection caused by unsanitized fill-color value in SVG exporter executed via child_process.exec, letting attackers with file edit or public share link execute arbitrary commands, exploit requires file edit or access to malicious public share link.
- 9.8 /10 CriticalCVE-2026-105641 No auth
Plane - Authentication Bypass
Plane prior to 1.4.0 contains a broken authentication caused by fixed, publicly known SECRET_KEY and LIVE_SERVER_SECRET_KEY defaults in deployment manifests, letting attackers forge Django-signed values and bypass live-service authentication, exploit requires unchanged default secrets.
- 9.1 /10 CriticalCVE-2026-105640 No auth
Plane - Authentication Bypass
Plane prior to 1.4.0 contains an authentication bypass caused by trusting unverified email addresses from Gitea and self-managed GitLab OAuth without ownership verification, letting attackers log in as victims, exploit requires unverified OAuth email.
- 9.8 /10 CriticalCVE-2026-105639 No auth
Plane - Authentication Bypass & Broken Access Control
Plane < 1.4.0 contains an authentication bypass caused by lack of out-of-band email ownership verification in signup flow, letting unauthenticated attackers register as target users and join workspaces via invitation tokens, exploit requires attacker to register with target email.
- 9.1 /10 CriticalCVE-2026-105638 No auth
Plane - Authentication Bypass
Plane < 1.4.0 contains an authentication bypass caused by insufficient OTP verification and lack of rate limiting in magic-code email login, letting attackers brute force OTP codes without lockout, exploit requires no special privileges.
- 9.6 /10 CriticalCVE-2026-105637 Auth required
Plane - Broken Access Control
Plane prior to 1.4.0 contains a broken access control vulnerability caused by missing project_id constraint in asset retrieval, letting workspace Guests reassign assets to attacker-controlled projects and obtain presigned download URLs, exploit requires guest access in the workspace.
- 9.9 /10 CriticalCVE-2026-105636 Auth required
Plane - Server Side Request Forgery
Plane < 1.4.0 contains a server-side request forgery caused by lack of redirect target validation in webhook delivery task, letting authenticated users access internal resources via redirects, exploit requires workspace creation privilege.
- 10.0 /10 CriticalCVE-2026-105285 No auth
Totolink A3002MU - Buffer Overflow
Totolink A3002MU 1.0.0-B20230403.1455 contains a stack-based buffer overflow caused by manipulation of the addQos/comment/entry_name argument in /boafrm/formIpQoS QoS Rule Handler, letting remote attackers execute arbitrary code, exploit requires crafted request.
- 10.0 /10 CriticalCVE-2026-105284 No auth
Totolink A3002MU - Authentication Bypass
Totolink A3002MU 1.0.0-B20230403.1455 contains an improper authorization vulnerability caused by manipulation in the Authentication Check function sub_40FCFC in /bin/boa, letting remote attackers bypass authorization, exploit requires no special privileges.