Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 49 of 125

  • 9.8 /10 Critical
    CVE-2026-82829 No auth

    Hitachi Coding Software Suite - Authentication Bypass

    Hitachi Coding Software Suite through 3.3.0 contains a broken authentication caused by hidden functionality such as hidden accounts or hardcoded credentials, letting attackers gain unauthorized access, exploit requires no special conditions.

  • 9.8 /10 Critical
    CVE-2026-82827 No auth

    Hitachi Coding Software Suite - Authentication Bypass

    Hitachi Coding Software Suite <= 3.3.0 contains a hardcoded cryptographic key vulnerability caused by hardcoding the JWT signing secret key, letting attackers generate unauthorized Bearer tokens to exploit administrative functions, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-82825 No auth

    Hitachi Coding Software Suite - Authentication Bypass

    Hitachi Coding Software Suite through 3.3.0 contains a broken authentication caused by missing authentication for a critical API, letting unauthenticated attackers retrieve or alter sensitive information or manipulate data.

  • 9.8 /10 Critical
    CVE-2026-82824 No auth

    Hitachi Coding Software Suite - Path Traversal

    Hitachi Coding Software Suite through 3.3.0 contains a path traversal vulnerability caused by improper validation of file paths, letting attackers access, create, modify, or delete files, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-79901

    boks_keytabmd - Authentication Bypass

    boks_keytabmd contains a predictable password generation vulnerability caused by seeding with the current Unix timestamp, letting attackers reproduce and verify Active Directory service-account passwords offline, exploit requires knowledge of service principal and password-change time estimation.

  • 9.1 /10 Critical
    CVE-2026-79898 Auth required

    Fortra BoKS Manager - Command Injection

    Fortra BoKS Manager contains a command injection caused by shell command substitution in crlserver, letting authenticated users with CRL URL addition privileges execute commands as root, exploit requires user authentication with specific privileges.

  • 9.8 /10 Critical
    CVE-2026-75957 No auth

    Ultimate Multisite WordPress - Authentication Bypass

    Ultimate Multisite WordPress plugin <= 2.15.0 contains an authentication bypass caused by improper validation in the checkout_form parameter in login_customer_after_checkout, letting unauthenticated attackers log in as any user by knowing their email, exploit requires targeted user to have no pre-existing Ultimate Multisite customer record.

  • 9.3 /10 Critical
    CVE-2026-62071 No auth

    WordPress File Upload - SQL Injection

    WordPress File Upload <= 5.1.10 contains an SQL injection caused by unsanitized input in SQL queries, letting unauthenticated attackers execute arbitrary SQL commands remotely, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-59797 No auth

    Apache HTTP Server - Broken Access Control

    Apache HTTP Server 2.4.0 through 2.4.68 contains an improper privilege management vulnerability caused by mod_ssl's SSLRequire and file-related expressions, letting attackers bypass intended access controls, exploit requires crafted expressions.

  • 9.8 /10 Critical
    CVE-2026-57941 No auth

    Apache HTTP Server - Use After Free

    Apache HTTP Server 2.4.0 through 2.4.68 contains a use after free vulnerability caused by shared session->bbtmp re-entrancy in mod_http2, letting attackers cause memory corruption or denial of service, exploit requires crafted HTTP/2 requests.

  • 9.6 /10 Critical
    CVE-2026-56662 No auth

    GetSimple CMS CE - Cross-Site Request Forgery & Remote Code Execution

    GetSimple CMS CE < 1.5 contains a cross-site request forgery caused by missing anti-CSRF token and request-origin verification in the UpdateCE update form, letting remote attackers execute arbitrary code via administrator session, exploit requires administrator authentication.

  • 9.1 /10 Critical
    CVE-2026-56660 Auth required

    GetSimple CMS CE - Remote Code Execution

    GetSimple CMS CE < 1.5 contains a remote code execution caused by unsafe ZIP archive extraction and directory traversal in UpdateCE.php, letting attackers execute arbitrary PHP code as the web-server user, exploit requires processing a malicious archive.

  • 9.8 /10 Critical
    CVE-2026-56154 No auth

    Apache HTTP Server - Use After Free

    Apache HTTP Server 2.4.0 through 2.4.68 contains a use after free vulnerability caused by improper handling of lookahead (%{LA-U:HTTP:...}) in mod_rewrite, letting attackers cause denial of service or potentially execute code, exploit requires crafted requests.

  • 9.1 /10 Critical
    CVE-2026-55083 Auth required

    DHIS2 - Remote Code Execution

    DHIS2 2.42.0 < 2.42.5.1, 2.43.0 < 2.43.0.1 contains a remote code execution caused by unsafe Java deserialization, letting remote attackers execute arbitrary code, exploit requires crafted input to the deserialization component.

  • 9.1 /10 Critical
    CVE-2026-53953 No auth

    GetSimple CMS - Authentication Bypass

    GetSimple CMS CE 3.3.22 contains a broken authentication caused by predictable temporary password generation using PHP rand() seeded with microtime() in the password reset endpoint, letting attackers perform administrator account takeover, exploit requires no authentication but relies on timing attack.