Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 45 of 125

  • 9.8 /10 Critical
    CVE-2026-104711 PoC public

    Apache Struts - Expression Language Injection

    Apache Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0 contain an expression language injection caused by improper neutralization of OGNL expressions in legacy RESTful action mapper, letting remote attackers execute arbitrary code, exploit requires legacy RESTful action mapper and OGNL allowlist disabled.

  • 9.5 /10 Critical
    CVE-2026-103510 No auth

    P4 Search - Authentication Bypass

    P4 Search < 2026.4.2 contains a broken authentication caused by failure to securely handle blank service authentication tokens, letting unauthenticated attackers with network access gain highest application privileges.

  • 9.3 /10 Critical
    CVE-2026-103352 No auth

    WP BASE Booking - SQL Injection

    WP BASE Booking <= 6.4.0 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-102780 No auth

    Joomla Extension joomlafry.com - Broken Access Control

    Joomla Extension joomlafry.com 2.9.0 - 2.9.4 contains an unauthenticated cross-record publication and mass assignment vulnerability caused by unfiltered raw jform data in RecordController, letting guest attackers modify any TF Content record including published, access, and created_by fields, exploit requires obtaining a valid token from Joomla's public login form.

  • 9.8 /10 Critical
    CVE-2026-102428 PoC publicNo auth

    Joomla OrdaSoft CCK - SQL Injection

    OrdaSoft Joomla CCK < 8.3.16 contains an SQL injection caused by improper validation of the user-provided order column, letting unauthenticated attackers execute arbitrary SQL commands remotely.

  • 10.0 /10 Critical
    CVE-2026-100103 No auth

    Perforce P4 Search - Authentication Bypass

    Perforce P4 Search container images < 2026.4.2 contain an authentication token reset to a publicly documented default, letting unauthenticated attackers with network access gain highest privileges and execute arbitrary code.

  • 9.5 /10 Critical
    CVE-2026-100102 No auth

    Perforce P4 Search - Remote Code Execution

    Perforce P4 Search container images < 2026.4.2 contain a remote code execution caused by an unauthenticated Java debug interface, letting attackers with network access execute arbitrary code as the P4 Search service account.

  • 9.1 /10 Critical
    CVE-2017-20285 No auth

    YAML Perl - Insecure Deserialization

    YAML for Perl < 1.30 contains an insecure deserialization vulnerability caused by loading documents that trigger DESTROY methods of arbitrary classes, letting attackers execute arbitrary code, exploit requires crafted YAML input.

  • 9.1 /10 Critical
    CVE-2026-105215 No auth

    ZITADEL - Authentication Bypass

    ZITADEL < 3.4.14 and 4.x < 4.16.2 contain an authentication bypass caused by trusting client-supplied external identity fields without completed IdP callback in hosted Login V1 UI, letting unauthenticated attackers pre-create accounts bound to victim's external IdP identity.

  • 9.6 /10 Critical
    CVE-2026-105209 Auth required

    ZITADEL - Broken Access Control

    ZITADEL 3.x < 3.4.15 and 4.x < 4.17.1 contain an improper authorization vulnerability caused by insufficient organization verification in passkey or passwordless enrollment code issuance, letting attackers with user-write permission in one organization take over accounts in another organization, exploit requires user-write permission in one organization.

  • 9.8 /10 Critical
    CVE-2026-105207 No auth

    ZITADEL - Authentication Bypass

    ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 contains an authentication bypass caused by linking user accounts to external identity providers without verifying primary factors or caller permissions, letting unauthenticated attackers bind external identities and sign in as victims, exploit requires knowledge of victim's login name.

  • 10.0 /10 Critical
    CVE-2026-105135 No auth

    InternLM MindSearch - Command Injection

    InternLM MindSearch 0.1.0 contains a command injection caused by manipulation of the "inputs" argument in ExecutionAction.run of Planner Agent, letting remote attackers execute arbitrary code, exploit requires crafted input.

  • 10.0 /10 Critical
    CVE-2026-105134 CISA KEVPoC publicNo auth

    Ahsay AhsayCBS - Command Injection

    Ahsay AhsayCBS <= 10.3.2 contains a command injection caused by manipulation of the "random" argument in /rps/api/json/UpdateReceivers.do of Replication Receiver, letting remote attackers execute OS commands, exploit requires crafted request.

  • 9.3 /10 Critical
    CVE-2026-103355 PoC publicNo auth

    Unlimited Elements Unlimited Elements For Elementor - SQL Injection

    Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.20 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 9.1 /10 Critical
    CVE-2026-92084 PoC publicNo auth

    Beaver Builder Page Builder - Remote Code Execution

    Beaver Builder Page Builder for WordPress <= 2.11.0.5 contains an arbitrary shortcode execution vulnerability caused by improper validation before running do_shortcode, letting unauthenticated attackers execute arbitrary shortcodes, exploit requires a Beaver Builder page with Sidebar module containing attacker-controlled widget text.