Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 5 of 166
- 9.1 /10 CriticalCVE-2026-103882 No auth
Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress - Arbitrary File Deletion
Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress <= 1.1.9 contains an arbitrary file deletion vulnerability caused by insufficient file path validation in post_delete_assessment_file_by_id, letting unauthenticated attackers delete arbitrary files, exploit requires access to a public nonce in frontend JavaScript.
- 9.4 /10 CriticalCVE-2026-93327 Auth required
Google Cloud Application Integration - Insecure Deserialization
Google Cloud Application Integration < 2026-09-11 contains an insecure deserialization vulnerability in SubWorkflow task, letting authenticated attackers execute arbitrary code using malicious serialized objects.
- 9.8 /10 CriticalCVE-2026-90888 No auth
LeadSnap - Insecure Deserialization
LeadSnap <= 1.25 contains an unauthenticated PHP Object Injection caused by improper handling of serialized objects, letting remote attackers execute arbitrary code, exploit requires no authentication.
- 9.4 /10 CriticalCVE-2026-82104 No auth
Teltonika Networks RUTOS - Command Injection
Teltonika Networks RUTOS 7.22 through 7.24.2 and TSWOS 1.9 through 1.10 contain a command injection caused by unauthenticated direct calls to LUA functions bypassing validation, letting attackers execute OS commands remotely, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-78403 No auth
Thales Sentinel Keys Server - Buffer Overflow & Broken Access Control
Thales Sentinel Keys Server < 1.3.8.0 contains a stack-based buffer overflow and missing authorization vulnerability caused by unchecked length of the first field in HTTP requests, letting remote attackers execute code as NT AUTHORITY\SYSTEM, exploit requires crafted HTTP request.
- 9.8 /10 CriticalCVE-2026-63377 No auth
TAKO AI Agent for Okta - Authentication Bypass
TAKO AI Agent for Okta < 3.0.1-beta contains an authentication bypass caused by lack of authentication and token checks in POST /api/auth/setup, letting unauthenticated network attackers create the first admin account, exploit requires initial setup not completed.
- 9.6 /10 CriticalCVE-2026-62863 No auth
MoLing - Broken Access Control
MoLing < 0.5.0 contains a broken access control vulnerability caused by unauthenticated SSE mode endpoints and permissive CORS, letting attackers steal sessionId via cross-origin EventSource and send unauthorized MCP tool calls, exploit requires victim to visit malicious web page.
- 9.9 /10 CriticalCVE-2026-62853 Auth required
ThingLinks - Remote Code Execution
ThingLinks < 1.4.0 contains a remote code execution caused by unsandboxed Groovy script compilation in /groovyScriptTest/registerScript endpoint, letting authenticated attackers execute arbitrary server-side code.
- 9.1 /10 CriticalCVE-2026-62849 No auth
ThingLinks - SQL Injection
ThingLinks prior to 1.4.0 contains an unauthenticated SQL injection caused by unsafe SQL construction from request-controlled JSON fields in TDengine TDS APIs, letting remote attackers tamper with time-series data, exploit requires no authentication.
- 9.3 /10 CriticalCVE-2026-61850 Auth required
Kargo - Broken Access Control
Kargo 0.6.0 to 1.8.14, 1.9.9, and 1.10.8 contain an authorization bypass caused by insufficient permission checks in project-scoped RBAC API, letting authenticated delegated users escalate privileges within a Project, exploit requires custom admin-created roles.
- 10.0 /10 CriticalCVE-2026-61826 No auth
Bazarr - Broken Access Control
Bazarr prior to 1.5.7-beta.14 contains a broken access control vulnerability caused by missing authentication on api_ns_plex namespace handlers, letting anonymous attackers modify Plex integration settings, persist API keys, and cause denial of service, exploit requires no authentication or preconditions.
- 10.0 /10 CriticalCVE-2026-61738 No auth
SOCFortress CoPilot - Path Traversal
SOCFortress CoPilot < 0.1.77 contains a path traversal caused by unsanitized filename in POST /api/scoutsuite/generate-gcp-report, letting admin and analyst users write files outside intended directories, exploit requires admin or analyst privileges.
- 9.8 /10 CriticalCVE-2026-61737 No auth
ng-antd-admin - Authentication Bypass
ng-antd-admin < 22.0 contains a broken authentication caused by a hardcoded default JWT secret, letting attackers bypass authentication and impersonate any user, exploit requires deployment with default secret.
- 9.3 /10 CriticalCVE-2026-61730 No auth
SOCFortress CoPilot - Information Disclosure
SOCFortress CoPilot contains an information disclosure vulnerability caused by unauthenticated access to the /scoutsuite-report StaticFiles mount exposing sensitive cloud IAM principals and private Google service-account keys, letting anonymous attackers access sensitive cloud credentials and reports, exploit requires network access to the host during scans.
- 9.4 /10 CriticalCVE-2026-61729 No auth
SOCFortress CoPilot - Authentication Bypass
SOCFortress CoPilot < 0.1.76 contains an authentication bypass caused by publicly hardcoded fallback API header values in webhook verification, letting anonymous attackers bypass JWT authentication and execute active-response commands, exploit requires unset or default header secrets.