Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 52 of 125
- 10.0 /10 CriticalCVE-2026-96349 PoC publicNo auth
SiteSkite - Remote Code Execution
SiteSkite <= 2.1.8 contains a remote code execution caused by unauthenticated access, letting remote attackers execute arbitrary code, exploit requires no authentication.
- 9.0 /10 CriticalCVE-2026-94389 No auth
AcyMailing SMTP Newsletter - Remote Code Execution
AcyMailing SMTP Newsletter <= 11.0.5 contains a remote code execution caused by unauthenticated access, letting remote attackers execute arbitrary code without authentication.
- 9.1 /10 CriticalCVE-2026-94053 No auth
Apache MINA SSHD - Authentication Bypass
Apache MINA SSHD 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 contain an authentication bypass caused by improper escaping of LDAP filter metacharacters in sshd-ldap component, letting attackers bypass authentication using wildcard credentials, exploit requires sshd-ldap component enabled and configured.
- 9.1 /10 CriticalCVE-2026-94052 No auth
Apache MINA SSHD - Authentication Bypass
Apache MINA SSHD 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 contain an authentication bypass caused by a missing check in LdapPasswordAuthenticator in sshd-ldap component, letting attackers bypass authentication, exploit requires use of sshd-ldap with LdapPasswordAuthenticator configured.
- 9.1 /10 CriticalCVE-2026-92173 No auth
Meta Horizon OS - Privilege Escalation
Meta Horizon OS < 74.0.0.878.1682 contains a privilege escalation caused by MediaSyncJobReceiver sending privileged PendingIntent with com.oculus.vrshell CallerIdentity to arbitrary apps via NotificationListenerService, letting attackers impersonate privileged packages, exploit requires malicious app listening via NotificationListenerService.
- 9.1 /10 CriticalCVE-2026-89238 No auth
WSS4J - Broken Access Control
WSS4J contains an encrypted header child confusion vulnerability caused by attacker-controlled plaintext elements being promoted as decrypted headers, letting attackers bypass confidentiality policies, exploit requires crafted SOAP messages.
- 9.8 /10 CriticalCVE-2026-88920 No auth
Apache WSS4J - Authentication Bypass
Apache WSS4J < 4.0.2, < 3.0.6, and < 2.4.4 contain an authentication bypass caused by crafted unsigned SAML sender-vouches assertion with attacker-controlled key in DOM security processor, letting unauthenticated remote attackers forge authenticated SOAP messages.
- 9.1 /10 CriticalCVE-2026-87830 No auth
StAX WS-SecurityPolicy Validator - Broken Access Control
StAX streaming WS-SecurityPolicy validator contains a broken access control vulnerability caused by incorrect handling of relative or unsupported XPath expressions, letting remote SOAP peers bypass signature or encryption requirements, exploit requires sending crafted SOAP messages.
- 9.8 /10 CriticalCVE-2026-86131
WatchGuard Fireware OS - Command Injection
WatchGuard Fireware OS contains a command injection caused by improper handling of BOVPN Over TLS client configuration, letting attackers controlling the remote VPN server execute arbitrary commands as root, exploit requires attacker to control remote VPN server.
- 9.8 /10 CriticalCVE-2026-82307 No auth
Dolusoft Software Technologies SOPLOG - SQL Injection
Dolusoft Software Technologies SOPLOG < 2026.9.4.1 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries remotely, exploit requires crafted input.
- 9.1 /10 CriticalCVE-2026-77185
Apache MINA SSHD - Authentication Bypass
Apache MINA SSHD 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 contain an authentication bypass caused by flawed asynchronous authentication logic in sshd-core, letting attackers skip signature checks in public-key or hostbased authentication, exploit requires server to use asynchronous authentication with these schemes.
- 9.1 /10 CriticalCVE-2026-76570 PoC publicNo auth
Joomla Extension joomcode.com JCTables - SQL Injection
Joomla Extension joomcode.com JCTables 1.21.1 contains an unauthenticated SQL injection caused by lack of token validation and authentication in front-end CRUD API controller, letting attackers execute arbitrary read and write SQL queries remotely, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-76504 CISA KEVPoC publicNo auth
Cisco Catalyst SD-WAN Manager - Authentication Bypass
Cisco Catalyst SD-WAN Manager contains an authentication bypass caused by improper URI encoding handling in HTTP requests, letting unauthenticated remote attackers gain admin privileges, exploit requires crafted HTTP request.
- 9.8 /10 CriticalCVE-2026-75873 No auth
Zella Theme WordPress - Unrestricted File Upload
Zella Theme WordPress theme < 2.6.3 contains an unrestricted file upload vulnerability caused by lack of capability and nonce checks in font upload action, letting unauthenticated attackers upload arbitrary files including PHP for remote code execution.
- 9.1 /10 CriticalCVE-2026-62308 Auth required
Tugtainer - Server-Side Request Forgery
Tugtainer < 1.30.6 contains a server-side request forgery caused by unrestricted URL input in /settings/test_notification endpoint, letting authenticated users make backend send arbitrary HTTP requests, exploit requires authentication.