Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 49 of 166

  • 9.8 /10 Critical
    CVE-2026-108291 No auth

    itthinx Affiliates - Insecure Deserialization

    itthinx Affiliates <= 7.0.1 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-108065 No auth

    Channel Software WebAlliance eCommerce - SQL Injection

    Channel Software WebAlliance eCommerce contains a SQL injection caused by improper sanitization of the sUserID parameter in the SOAP GetUser method at /preapproval.asmx, letting unauthenticated remote attackers read, write, and execute commands on the backend Microsoft SQL Server, exploit requires crafted sUserID parameter with SQL injection payload.

  • 10.0 /10 Critical
    CVE-2026-107594 No auth

    File Upload to Order WordPress - Unrestricted File Upload

    File Upload to Order WordPress plugin < 1.1.4 contains an unrestricted file deletion vulnerability caused by lack of validation on file paths from attacker-controlled session data, letting unauthenticated attackers delete arbitrary files, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-107424 No auth

    M A Vinoth Kumar Frontend Dashboard - Broken Access Control

    M A Vinoth Kumar Frontend Dashboard <= 3.0.7 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.

  • 9.8 /10 Critical
    CVE-2026-104800 No auth

    AGE-GATE WordPress plugin - Remote Code Execution

    AGE-GATE WordPress plugin <= 1.0 contains a remote code execution caused by missing authentication and unsanitized POST parameter injection in admin.php, letting unauthenticated attackers execute code on the server.

  • 9.8 /10 Critical
    CVE-2026-104748 PoC publicNo auth

    SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications - Privilege Escalation

    SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications WordPress plugin <= 3.10.0 contains a privilege escalation caused by missing capability checks in wp_ajax_nopriv_simpleform_wp_register and improper meta writing, letting unauthenticated attackers create administrator accounts, exploit requires nonce from front-end JavaScript.

  • 9.3 /10 Critical
    CVE-2026-103904 No auth

    JTL-Shop - Stored XSS

    JTL-Shop contains a stored XSS vulnerability caused by lack of validation and output encoding of arbitrary consent names in the public consent endpoint, letting unauthenticated remote attackers execute script code in administrator sessions, exploit requires administrator to view consent statistics page.

  • 9.3 /10 Critical
    CVE-2026-103415 No auth

    TLS 1.3 Client - Buffer Overflow

    TLS 1.3 clients copy the server's cookie from HelloRetryRequest into the second ClientHello without validating cookie size, causing a buffer overflow before certificate authentication, letting malicious servers overwrite memory.

  • 9.1 /10 Critical
    CVE-2026-102893 No auth

    Zulip Server - Authentication Bypass

    Zulip Server <= 12.1 contains an authentication bypass caused by GenericOpenIdConnectBackend not rejecting false email_verified claims, letting attackers log into accounts with unverified emails, exploit requires misconfigured trusted identity provider.

  • 9.2 /10 Critical
    CVE-2026-102748 No auth

    Dgraph - Broken Access Control

    Dgraph Zero < 25.4.0 contains an unauthenticated access vulnerability caused by administrative HTTP routes on port 6080 without authentication, letting remote attackers disrupt the Zero control plane and destabilize Alpha nodes, exploit requires access to Zero HTTP port.

  • 9.1 /10 Critical
    CVE-2026-102476 No auth

    Eclipse Vert.x - Misconfiguration

    Eclipse Vert.x versions 5.0.0 to 5.0.12, 5.1.0 to 5.1.9, and 5.2.0 contain an insecure SSL context caching caused by improper SSL property handling in the Vert.x HTTP client, letting attackers obtain SSL contexts with weaker security properties, exploit requires client to request SSL context.

  • 9.8 /10 Critical
    CVE-2026-102182 No auth

    Juniper Networks Junos OS - Remote Code Execution

    Juniper Networks Junos OS on MX Series < 21.2R3-S11, 21.4 < 21.4R3-S12, 22.2 < 22.2R3-S8, 22.3 < 22.3R3-S5, 22.4 < 22.4R3-S9 contains a stack-based buffer overflow caused by improper handling of IKE certificate-based packets in the kmd component, letting unauthenticated network attackers execute code as root remotely, exploit requires crafted IKE certificate-based packets.

  • 9.8 /10 Critical
    CVE-2026-102178 No auth

    Juniper Networks Junos OS - Buffer Overflow

    Juniper Networks Junos OS and Junos OS Evolved contain a stack-based buffer overflow caused by flowspec route re-advertisement in BGP routing daemon with BGP update-threading enabled, letting configured BGP flowspec peers cause routing-engine compromise or denial of service, exploit requires configured BGP flowspec peer.

  • 9.8 /10 Critical
    CVE-2026-102175 No auth

    Juniper Networks Junos OS - Remote Code Execution & Denial of Service

    Juniper Networks Junos OS and Junos OS Evolved contain a heap-based buffer overflow caused by improper handling of frames in the sdxd service-deployment daemon, letting remote unauthenticated attackers execute code as root or cause denial of service via crafted TCP frames, exploit requires control or interception of the SDX/SRC server connection.

  • 9.8 /10 Critical
    CVE-2026-102031 No auth

    Juniper Networks Junos OS Evolved - OS Command Injection

    Juniper Networks Junos OS Evolved contains an OS command injection caused by improper handling in TACACS, letting low-privileged TACACS+-authenticated users execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled.