Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 46 of 125
- 9.1 /10 CriticalCVE-2026-87115 No auth
VikAppointments Services Booking Calendar - Arbitrary File Deletion
VikAppointments Services Booking Calendar WordPress plugin <= 1.2.21 contains an arbitrary file deletion vulnerability caused by insufficient file path validation in the extract function, letting unauthenticated attackers delete files remotely, exploit requires a published File-type custom field on the confirmation page shortcode.
- 9.2 /10 CriticalCVE-2026-71885
Bouncy Castle - Authentication Bypass
Bouncy Castle for Java < 1.86 contains a broken authentication caused by improper binding of X.509 credentials to LeafNode signature_key in MLS implementation, letting unauthenticated attackers impersonate others and decrypt group messages, exploit requires deployment admitting external commits without independent credential checks.
- 9.8 /10 CriticalCVE-2026-105105
NASA-AMMOS AIT-Core - Authentication Bypass
NASA-AMMOS AIT-Core <= 3.1.1 contains missing authentication for critical functions caused by unauthenticated ZeroMQ message bus sockets binding to all interfaces, letting unauthenticated remote attackers inject or exfiltrate spacecraft command and telemetry data, exploit requires network access to TCP ports 5559 or 5560.
- 9.9 /10 CriticalCVE-2026-105080 PoC publicAuth required
ConvertX - Command Injection
ConvertX < 0.19.0 contains a command injection caused by passing unblocked .recipe or .downloaded_recipe files to the ebook-convert program, letting attackers execute arbitrary code, exploit requires crafted recipe files.
- 9.8 /10 CriticalCVE-2026-97637 No auth
WordPress JSON API Auth - Authentication Bypass
WordPress JSON API Auth plugin <= 3.1.2 contains an authentication bypass caused by cached session cookie disclosure in the PI-Media/json-api parent plugin, letting unauthenticated attackers fully authenticate as Administrator, exploit requires active parent plugin with Auth controller and prior admin POST.
- 9.4 /10 CriticalCVE-2026-95102 No auth
WebSocket Endpoints - Authentication Bypass
WebSocket endpoints contain a broken authentication caused by lack of proper authentication mechanisms, letting attackers impersonate charging stations and gain unauthorized access, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-94541 PoC public
WPMobile.App - Authorization Bypass
WPMobile.App – Android and iOS App Builder plugin for WordPress <= 11.82 contains an authorization bypass caused by improper user authorization verification, letting unauthenticated attackers exfiltrate password-reset URLs and take over accounts, exploit requires mail-to-push feature enabled.
- 9.9 /10 CriticalCVE-2026-93698 Auth required
Multilang - Command Injection
Multilang contains a command injection caused by insufficient validation in adminbin, letting attackers execute arbitrary commands remotely, exploit requires no special privileges.
- 9.0 /10 CriticalCVE-2026-93697 Auth required
WHM Mass Modify Accounts - Stored XSS
WHM Mass Modify Accounts interface contains a stored XSS vulnerability caused by improper input sanitization, letting attackers execute arbitrary scripts, exploit requires user interaction.
- 9.0 /10 CriticalCVE-2026-93029 Auth required
WHM Manage SSL Hosts - Stored XSS
WHM Manage SSL Hosts contains a stored XSS vulnerability caused by improper input sanitization, letting attackers execute arbitrary scripts on users, exploit requires user interaction.
- 9.9 /10 CriticalCVE-2026-90970 PoC publicAuth required
GitLab AI Gateway - Command Injection
GitLab AI Gateway 18.1.6 < 19.2.4, 19.3 < 19.3.2, and 19.4 < 19.4.1 contain a command injection caused by sandbox escape via specially crafted flow configuration in prompt template, letting authenticated users with Duo Agent Platform access execute arbitrary commands, exploit requires Duo Agent Platform access.
- 9.0 /10 CriticalCVE-2026-86345
389-ds-base - Authentication Bypass
389-ds-base contains a broken authentication caused by improper handling of buffered plaintext bytes during StartTLS negotiation, letting on-path attackers inject crafted LDAP messages causing authentication bypass, exploit requires man-in-the-middle position.
- 9.8 /10 CriticalCVE-2026-84411 PoC publicNo auth
RouterOS - Remote Code Execution & Denial of Service
RouterOS contains an integer underflow in HTTP request body handling, letting unauthenticated network attackers achieve remote code execution as root or cause denial of service using a crafted request.
- 9.8 /10 CriticalCVE-2026-82042
UTMStack - Authentication Bypass
UTMStack < 11.2.16 contains an authentication bypass caused by acceptance of a valid Utm-Internal-Key header without path restriction or rate limiting in InternalApiKeyFilter, letting remote attackers gain full administrative API access, exploit requires attacker to know INTERNAL_KEY value.
- 9.9 /10 CriticalCVE-2026-82041 Auth required
UTMStack - Command Injection
UTMStack < 11.2.16 contains a command injection caused by missing authorization checks in UTMIncidentCommandWebsocket.processCommand(), letting authenticated users execute arbitrary OS commands on monitored endpoints, exploit requires authentication.