Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 45 of 166
- 9.3 /10 CriticalCVE-2026-109698 No auth
Kitae Park Mang Board WP - SQL Injection
Kitae Park Mang Board WP <= 2.4.4 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-109694 No auth
WP ManageNinja LLC Fluent CRM - Broken Access Control
WP ManageNinja LLC Fluent CRM <= 3.2.5 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires attacker to have initial access.
- 9.3 /10 CriticalCVE-2026-109688 No auth
Link Whisper INC Link Whisper Free - SQL Injection
Link Whisper INC Link Whisper Free <= 0.9.7 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-109686 No auth
Link Whisper INC Link Whisper Free - Insecure Deserialization
Link Whisper INC Link Whisper Free <= 0.9.7 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-109145 No auth
User Rights Access Manager WordPress - Broken Access Control
User Rights Access Manager WordPress plugin through 1.1.3 contains a broken access control caused by unrestricted access to an AJAX account-registration handler, letting unauthenticated attackers register administrator-equivalent accounts and take over the site, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-108587 No auth
10Web Booster - Unrestricted File Upload
10Web Booster WordPress plugin <= 2.34.10 contains an unrestricted file upload vulnerability caused by missing file type validation and leaked REST nonce, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit requires obtaining a world-readable REST nonce.
- 9.3 /10 CriticalCVE-2026-108497 No auth
TMS Amelia ameliabooking - SQL Injection
TMS Amelia ameliabooking <= 2.4.10 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries, exploit requires crafted input.
- 9.2 /10 CriticalCVE-2026-102469 No auth
Eclipse Vert.x - Insecure Deserialization
Eclipse Vert.x versions [4.0.0, 4.5.34], [5.0.0, 5.0.12], [5.1.0, 5.1.9], and 5.2.0 contain an insecure deserialization vulnerability in vertx-db2-client caused by deserializing UDT column data without filtering, letting a malicious or MITM DRDA server execute remote code or cause DoS, exploit requires attacker-controlled DRDA server or MITM position.
- 9.3 /10 CriticalCVE-2026-101287 No auth
Stela - Authentication Bypass
Stela < 1.60.1 contains an authentication bypass caused by unvalidated manipulation of the "authProcess" cookie storing userId and validSteps, letting remote attackers impersonate any account including SUPER_ADMIN, exploit requires no valid credentials or user interaction.
- 9.0 /10 CriticalCVE-2026-111283 No auth
BMC Helix Network Management - Authentication Bypass
BMC Helix Network Management on-prem < 26.3.01 contains an authentication bypass caused by improper SAML single sign-on validation, letting unauthenticated attackers log in as local administrator, exploit requires SAML SSO configuration.
- 9.3 /10 CriticalCVE-2026-102764 CISA KEVNo auth
BeyondTrust Remote Support - Broken Access Control
BeyondTrust Remote Support contains a broken access control vulnerability caused by inadequate validation of message origins in internal components, letting attackers perform unauthorized file operations on the appliance, exploit requires specific message conditions.
- 9.8 /10 CriticalCVE-2026-111322 No auth
Archon - Authentication Bypass
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability caused by unauthenticated access to the /api/* control API binding to 0.0.0.0, letting unauthenticated attackers execute commands on the host as the Archon user, exploit requires network access.
- 9.9 /10 CriticalCVE-2026-110812 Auth required
Amazon Neptune - Insecure Deserialization
Amazon Neptune engine contains an insecure deserialization vulnerability in the Gremlin graph data import component, letting authenticated remote actors with standard database permissions execute arbitrary code and access internal credentials.
- 9.8 /10 CriticalCVE-2026-97668 No auth
Abandoned Cart Pro for WooCommerce - SQL Injection
Abandoned Cart Pro for WooCommerce <= 10.8.0 contains a SQL injection caused by insufficient escaping of user-supplied data in update_guest_persistent_cart(), letting unauthenticated attackers extract and modify usermeta data, exploit requires crafted input in checkout fields.
- 9.8 /10 CriticalCVE-2026-97657 PoC publicNo auth
Abandoned Cart Pro for WooCommerce - Authentication Bypass
Abandoned Cart Pro for WooCommerce <= 10.8.0 contains an authentication bypass caused by malleable AES-CTR encryption and bypassable HMAC in cart-recovery tokens, letting unauthenticated attackers achieve full account takeover via crafted cart IDs, exploit requires possession of a legitimate cart-recovery link.