Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 5 of 125

  • 9.1 /10 Critical
    CVE-2026-85714 Auth required

    Stirling-PDF - Command Injection

    Stirling-PDF < 2.13.2 contains a command injection caused by insufficient SQL whitelist validation in DatabaseService.validateSqlContent(), letting authenticated administrators execute arbitrary OS commands via crafted SQL files, exploit requires admin authentication and default H2 database with security mode.

  • 9.9 /10 Critical
    CVE-2026-77524 Auth required

    KEDA - Broken Access Control

    KEDA <= 2.20.2 contains a broken access control vulnerability caused by improper validation of hashiCorpVault.address in TriggerAuthentication and ScaledObject resources, letting namespace administrators escalate privileges to operator cluster-wide permissions, exploit requires namespace admin privileges.

  • 9.3 /10 Critical
    CVE-2026-77371 Auth required

    Redash - Authentication Bypass

    Redash 26.0.0 to 26.9.0 contains a broken authentication caused by DuckDB query runner enabling external access by default, letting users with query access read or write files and bypass authentication, exploit requires query access to DuckDB data source.

  • 9.8 /10 Critical
    CVE-2026-76519 CISA KEVPoC publicNo auth

    Cisco Secure Email Gateway - Unrestricted File Upload

    Cisco Secure Email Gateway contains an unrestricted file upload vulnerability caused by improper handling of email attachments in the Advanced Malware Protection feature, letting unauthenticated remote attackers write arbitrary files and execute commands with root privileges, exploit requires sending crafted email attachments.

  • 9.8 /10 Critical
    CVE-2026-59774 CISA KEVPoC publicNo auth

    go-gitea Gitea - Unauthenticated Arbitrary File Read

    go-gitea Gitea versions 1.22.1 through 1.27.0 contain a path traversal vulnerability due to improper initialization of the go-org markup renderer's ReadFile callback, allowing unauthenticated attackers to read arbitrary files accessible to the service user.

  • 9.8 /10 Critical
    CVE-2026-55684 No auth

    WeGIA - SQL Injection

    WeGIA < 3.8.6 contains a SQL injection caused by unsanitized interpolation of POST parameters in cadastro_cobrancas_geracao.php, letting remote attackers execute arbitrary SQL to read or modify sensitive data, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-55683 No auth

    WeGIA - SQL Injection

    WeGIA < 3.8.6 contains a SQL injection caused by unsanitized POST parameters in web/html/socio/sistema/cadastro_cobranca.php, letting remote attackers read, modify, or delete database content, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-55680 No auth

    WeGIA - SQL Injection

    WeGIA < 3.8.6 contains a SQL injection caused by unsanitized 'codigo' parameter in web/html/socio/sistema/cadastro_cobranca.php, letting unauthenticated attackers read or modify database content, exploit requires crafted POST request.

  • 9.8 /10 Critical
    CVE-2026-55573 No auth

    e107 - Remote Code Execution

    e107 < 2.3.7 contains an insecure deserialization caused by unserialize() of attacker-controlled previous_steps POST parameter in install.php, letting unauthenticated attackers execute arbitrary PHP functions with web server privileges, exploit requires access to install.php.

  • 10.0 /10 Critical
    CVE-2026-55572 No auth

    e107 - SQL Injection

    e107 < 2.3.7 contains a SQL injection caused by unsanitized username interpolation in alt_auth plugin's otherdb and e107db authentication backends, letting unauthenticated attackers expose or modify database data, exploit requires alt_auth with live external DB connection.

  • 9.8 /10 Critical
    CVE-2026-33796 No auth

    Juniper Networks Junos OS - Remote Code Execution & Privilege Escalation

    Juniper Networks Junos OS and Junos OS Evolved contain a stack-based buffer overflow caused by improper handling in the routing protocol daemon (rpd) during BMP route monitoring, letting configured external BGP neighbors execute arbitrary commands with root privileges, exploit requires configured external BGP neighbor.

  • 9.8 /10 Critical
    CVE-2026-33792 No auth

    Juniper Networks Junos OS - Buffer Overflow

    Juniper Networks Junos OS on SRX Series contains a stack-based buffer overflow caused by improper handling of crafted packets in the srxpfe process on GRE tunnels, letting unauthenticated network attackers execute code as root or cause denial of service.

  • 9.8 /10 Critical
    CVE-2026-33789 No auth

    Juniper Networks Junos OS - Buffer Overflow

    Juniper Networks Junos OS and Junos OS Evolved contain a stack-based buffer overflow caused by crafted BGP route updates in the routing protocol daemon (rpd) when BGP Monitoring Protocol (BMP) is enabled, letting unauthenticated BGP peers cause denial of service and potential root-level command execution, exploit requires BMP enabled.

  • 9.8 /10 Critical
    CVE-2026-16741 No auth

    TR7 Cyber Defense Inc. TR7 ASP - OS Command Injection

    TR7 Cyber Defense Inc. TR7 ASP on virtual and physical appliances from 1.0.40.236 < 1.0.1554.2331 and 1.6.42.239 < 1.6.1554.2331 contains an OS command injection caused by improper neutralization of special elements in OS commands, letting attackers execute arbitrary commands remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-16740 No auth

    TR7 Cyber Defense Inc. TR7 ASP - OS Command Injection

    TR7 Cyber Defense Inc. TR7 ASP on virtual and physical appliances from 1.0.40.236 < 1.0.1554.2331 and 1.6.42.239 < 1.6.1554.2331 contains an OS command injection caused by missing authentication for critical functions, letting attackers execute arbitrary OS commands remotely, exploit requires no authentication.