Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 51 of 125

  • 9.8 /10 Critical
    CVE-2026-104056 No auth

    Authlib - Open Redirect

    Authlib <= 1.7.2 contains an open redirect vulnerability caused by caching discovery JSON metadata without validation or issuer-origin binding, letting attackers replace endpoint URLs with attacker-controlled values, exploit requires no special conditions.

  • 9.3 /10 Critical
    CVE-2026-103922 PoC publicNo auth

    Capacitor - Stored XSS

    Capacitor 6.0.0 to 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1 contain a stored XSS caused by insufficient validation of WebView navigation guard path, letting attackers execute scripts with same-origin access, exploit requires victim to activate an untrusted link.

  • 9.8 /10 Critical
    CVE-2026-103752 PoC publicNo auth

    Authorizer - Privilege Escalation

    Authorizer <= 3.15.3 contains a privilege escalation vulnerability caused by improper access control, letting unauthenticated attackers escalate privileges, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-103264 No auth

    Fleet - Authentication Bypass

    Fleet < 4.87.0 contains an authentication bypass caused by acceptance of hostnames and hardware serials as authentication tokens in device API, letting unauthenticated attackers access device data and trigger device actions, exploit requires knowledge of non-secret identifiers.

  • 9.0 /10 Critical
    CVE-2026-103255 No auth

    n8n - Path Traversal

    n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain a path traversal caused by unvalidated insertion of tableId parameter in Supabase node request paths, letting attackers bypass Row Level Security to access and modify data, exploit requires workflows binding tableId to untrusted input.

  • 9.0 /10 Critical
    CVE-2026-103248 No auth

    n8n - NoSQL Injection

    n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain a filter injection vulnerability in Supabase node's Filters (String) mode caused by failure to escape field values, letting attackers read, update, or delete all table data remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-103244 No auth

    ground-station - Authentication Bypass

    ground-station < 0.8.0 contains an authentication bypass caused by improper validation in setup.restore command during first-run setup mode, letting unauthenticated attackers execute arbitrary SQL and gain admin access, exploit requires first-run setup mode.

  • 9.3 /10 Critical
    CVE-2026-102628 No auth

    Cadmos LTI - Information Disclosure

    Cadmos LTI application contains an information disclosure vulnerability caused by enabled Laravel debug mode in a public environment, letting unauthenticated attackers access sensitive server environment variables via unhandled exceptions, exploit requires no authentication.

  • 10.0 /10 Critical
    CVE-2026-101148 No auth

    BackupSheep WordPress Backup Plugin - Broken Access Control

    BackupSheep WordPress Backup Plugin <= 1.8 contains a broken access control vulnerability caused by improper validation of integration key, letting unauthenticated attackers create/download full backups and delete files, leading to sensitive data disclosure and site takeover, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2025-41753 No auth

    BACnet File Object - Path Traversal

    BACnet File Object contains a path traversal caused by insufficient validation of dynamically created object names, letting unauthenticated remote attackers read or overwrite arbitrary files, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-97274 No auth

    OAuth Single Sign On – SSO (OAuth Client) - Authentication Bypass

    OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 contains an authentication bypass vulnerability caused by improper validation, letting unauthenticated attackers bypass authentication, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-97248 No auth

    Booking Activities - Remote Code Execution

    Booking Activities <= 1.18.7.1 contains an unauthenticated PHP object injection caused by improper handling of user input, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-97196 No auth

    Liquid Web / StellarWP GiveWP - Authentication Bypass

    Liquid Web / StellarWP GiveWP <= 4.16.9 contains an authentication bypass caused by improper validation of unsafe equivalence in input, letting attackers bypass authentication, exploit requires crafted input.

  • 9.3 /10 Critical
    CVE-2026-96822 No auth

    Books Gallery - SQL Injection

    Books Gallery <= 4.8.3 contains an SQL injection caused by unsanitized input in database queries, letting unauthenticated attackers execute arbitrary SQL commands remotely, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-96350 No auth

    Estatik - Privilege Escalation

    Estatik <= 4.3.5 contains a privilege escalation vulnerability caused by improper subscriber privilege handling, letting attackers escalate their privileges, exploit requires subscriber access.