Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 47 of 125

  • 9.4 /10 Critical
    CVE-2026-75937 No auth

    Affected device - Command Injection

    Affected device contains a command injection caused by a specially crafted HTTP POST request to the web administration interface, letting unauthenticated attackers execute arbitrary OS commands with root privileges.

  • 9.8 /10 Critical
    CVE-2026-51922 No auth

    agentscope - Command Injection

    agentscope v1.0.20 contains a command injection caused by unsanitized input in execute_shell_command in src/agentscope/tool/_coding/_shell.py, letting attackers execute arbitrary code or commands remotely, exploit requires attacker control of input.

  • 9.8 /10 Critical
    CVE-2026-51918 No auth

    FinRobot - Command Injection

    FinRobot 1.0.0 contains a command injection caused by unsafe code execution in CodingUtils.create_file_with_code(), letting attackers execute arbitrary commands remotely, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-51915 No auth

    TransformerOptimus SuperAGI - Broken Access Control

    TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability caused by lack of organization ownership verification in tool controller endpoints, letting remote authenticated attackers read or modify other organizations' tool metadata.

  • 9.8 /10 Critical
    CVE-2026-51911

    Vanna - Code Injection

    Vanna v2.0.2 contains a code injection vulnerability caused by unsafe handling in VannaBase.get_plotly_figure, letting attackers execute arbitrary code or commands remotely, exploit requires accessible vulnerable entry point.

  • 9.1 /10 Critical
    CVE-2026-51906 No auth

    TaskingAI - Path Traversal

    TaskingAI v0.3.0 contains a path traversal caused by manipulation of the project_id parameter in the DALL-E 3 image generation tool save_url_image function, letting attackers write files to arbitrary locations on the server filesystem, exploit requires crafted request.

  • 9.8 /10 Critical
    CVE-2026-51904 No auth

    SuperAGI - Broken Access Control

    SuperAGI <= v0.0.14 contains an improper access control vulnerability in agent execution controller caused by lack of verification of agent ownership in create_agent_execution and create_agent_run, letting remote authenticated attackers create or start execution records for agents of other organizations, exploit requires authentication.

  • 9.8 /10 Critical
    CVE-2026-51898 No auth

    sinaptik-ai pandas-ai - Code Injection

    sinaptik-ai pandas-ai 3.0.0 contains a code injection caused by improper handling in CodeExecutor.execute, letting attackers execute arbitrary code remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-19660 PoC publicNo auth

    Divi Membership WordPress plugin - Authentication Bypass

    Divi Membership WordPress plugin <= 2.3.0 contains an authentication bypass caused by lack of validation in process_paypal_callback function, letting unauthenticated attackers log in as any user including admins, exploit requires crafted paypal_param GET parameter.

  • 9.8 /10 Critical
    CVE-2026-19652 No auth

    Divi Membership - Privilege Escalation

    Divi Membership WordPress plugin <= 2.2.0 contains a privilege escalation caused by improper role validation in dmem_form_submit_handler(), letting unauthenticated attackers register as administrators and gain full site control, exploit requires publicly accessible WordPress nonce.

  • 9.1 /10 Critical
    CVE-2026-15896 No auth

    Super Forms – Drag & Drop Form Builder - Path Traversal

    Super Forms – Drag & Drop Form Builder WordPress plugin <= 6.3.316 contains a path traversal caused by insufficient validation in parse_request function, letting unauthenticated attackers read arbitrary files, exploit requires file upload enabled.

  • 9.8 /10 Critical
    CVE-2026-14378 PoC publicNo auth

    DevKit Pro WordPress plugin - Authentication Bypass

    DevKit Pro WordPress plugin <= 2.3.0 contains an authentication bypass caused by improper verification of the original_user_id cookie in revert_switch handler, letting unauthenticated attackers take over administrator accounts by forging cookies and nonces.

  • 9.5 /10 Critical
    CVE-2026-104849

    Tinypool - Prototype Pollution

    Tinypool < 2.1.2 contains a prototype pollution vulnerability caused by reading filename from a caller-supplied options object without own property check in pool.run, letting attackers load arbitrary JavaScript and read or modify task data, exploit requires prototype pollution.

  • 9.8 /10 Critical
    CVE-2026-104846 No auth

    Seroval - Remote Code Execution

    Seroval 0.12.0 to 1.6.2 contains a remote code execution caused by deserialization of attacker-controlled thenables in fromJSON, letting attackers trigger code execution via native Promise resolution, exploit requires crafted JSON input.

  • 9.1 /10 Critical
    CVE-2026-104611 Auth required

    Tenda AC9 - Buffer Overflow

    Tenda AC9 15.03.02.13 contains a stack-based buffer overflow caused by manipulation of the "netWanType" argument in /goform/fast_setting_internet_set POST request handler, letting remote attackers cause denial of service or execute code, exploit requires crafted request.