Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 54 of 125
- 9.8 /10 CriticalCVE-2026-51857 No auth
camel-ai camel - Remote Code Execution
camel-ai camel 0.2.91a1, v0.2.91a2, and v0.2.91a3 contain a remote code execution caused by running model-produced Python code through SubprocessInterpreter without an approval boundary, letting attackers execute arbitrary code remotely, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-51856
agentscope - Remote Code Execution
agentscope 1.0.18, 1.0.19 contains a remote code execution caused by unprotected execute_python_code tool exposure in RealtimeAgent session, letting remote WebSocket users execute arbitrary Python code, exploit requires WebSocket access.
- 9.8 /10 CriticalCVE-2026-18782 PoC publicNo auth
Trex Digital Smart Manufacturing Systems Inc. Trex MES - SQL Injection
Trex Digital Smart Manufacturing Systems Inc. Trex MES through 2026-09-29 contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers execute commands via SQL injection, exploit requires crafted input.
- 9.1 /10 CriticalCVE-2026-103475 No auth
yii2-starter-kit - Broken Access Control
yii2-starter-kit through 4.2.0 contains a broken access control caused by allowedIPs set to ['*'] in debug and Gii modules, letting unauthenticated remote attackers read sensitive data and write PHP files, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-103395
LightLLM - Remote Code Execution
LightLLM through 1.2.0 visual_only deployments contains an insecure deserialization caused by unauthenticated RPyC service with allow_pickle enabled in remote_infer_images method, letting attackers execute arbitrary code with service account privileges, exploit requires access to visual RPyC port.
- 9.8 /10 CriticalCVE-2026-103110 No auth
Pexip Infinity - Remote Code Execution
Pexip Infinity < 38.2, 39.0, 39.1, and 40.0 contain a remote code execution caused by improper input validation on Conferencing Node, letting remote attackers execute code as unprivileged users, exploit requires network access.
- 9.0 /10 CriticalCVE-2026-103056 Auth required
AiSOC - Command Injection
AiSOC < 12.0.0 contains a command injection caused by unescaped action parameters in crowdstrike_rtr.py and endpoint.py, letting authenticated users execute arbitrary commands with SYSTEM or root privileges on managed endpoints.
- 9.9 /10 CriticalCVE-2026-102911 Auth required
zosmaai pi-llm-wiki - Command Injection
zosmaai pi-llm-wiki <= 0.11.7 contains a command injection caused by manipulation of the "url" argument in mcp/index.ts component wiki_capture_source MCP tool, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.
- 9.1 /10 CriticalCVE-2026-102794 Auth required
Ziroom ZHOME A0101 - Command Injection
Ziroom ZHOME A0101 1.0.1.0 contains a command injection caused by manipulation of the "url" argument in /api/ZRnetwork/ping, letting remote attackers execute arbitrary commands, exploit requires no special privileges.
- 9.1 /10 CriticalCVE-2026-102793 Auth required
Ziroom ZHOME - Command Injection
Ziroom ZHOME A0101 1.0.1.0 contains a command injection caused by manipulation of the hostname/zonename argument in /api/ZRFirmware/set_time_zone, letting remote attackers execute arbitrary commands, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-102489 CISA KEVPoC publicNo auth
Zammad - Session Hijacking & Remote Code Execution
Zammad 6.3.0 to 6.5.4 contains a session hijack vulnerability caused by improper session management, letting remote attackers execute code as the zammad user, exploit requires vulnerable version and session hijack.
- 9.8 /10 CriticalCVE-2026-102458 No auth
Digiwin EasyFlow .NET - Authentication Bypass
Digiwin EasyFlow .NET contains a missing authentication vulnerability caused by an unauthenticated API, letting remote attackers obtain other users' plaintext passwords, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-102455 No auth
Digiwin EasyFlow .NET - Remote Code Execution
Digiwin EasyFlow .NET contains an insecure deserialization vulnerability caused by processing maliciously crafted serialized content, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires no special privileges.
- 10.0 /10 CriticalCVE-2026-102427 PoC publicNo auth
OrdaSoft Joomla CCK - Remote Code Execution
OrdaSoft Joomla CCK < 8.3.16 contains an unauthenticated remote code execution caused by lack of authentication and improper file extension validation in site/uploader.php, letting attackers upload and execute PHP code remotely, exploit requires no authentication.
- 9.4 /10 CriticalCVE-2026-102149
Kiteworks Email Protection Gateway - Broken Access Control
Kiteworks Email Protection Gateway contains a broken access control vulnerability caused by insufficient restriction on certificate assignment, letting attackers associate certificates with other users' accounts, affecting encrypted mail confidentiality and integrity, and potentially allowing unauthorized access, exploit requires certificate-based login enabled.