Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 57 of 125
- 9.8 /10 CriticalCVE-2026-91012 No auth
Apache Karaf - Path Traversal & Privilege Escalation
Apache Karaf config.core.impl.ConfigRepositoryImpl contains a path traversal vulnerability caused by insufficient validation of file paths derived from user-supplied input in configuration update methods, letting manager-role users write arbitrary files within the Karaf process writable directories, exploit requires manager role privileges.
- 9.1 /10 CriticalCVE-2026-84436 Auth required
IBM Guardium Data Protection - Command Injection
IBM Guardium Data Protection 12.2 contains a command injection caused by improper input handling in the certificate export CLI functionality, letting privileged authenticated CLI users execute arbitrary commands with root privileges.
- 9.9 /10 CriticalCVE-2026-84154 Auth required
GEOVIA Geospatial Data Manager - Command Injection
GEOVIA Geospatial Data Manager Release 3DEXPERIENCE R2024x through R2026x contains a code injection vulnerability caused by improper input handling, letting attackers execute arbitrary code on the server, exploit requires no special conditions.
- 9.4 /10 CriticalCVE-2026-82973 No auth
psyb0t/docker-mailbox - CRLF Injection
psyb0t/docker-mailbox < 0.4.13 contains a CRLF injection caused by improper neutralization of CRLF sequences in IMAP command construction, letting remote unauthenticated attackers inject additional IMAP commands via crafted folder, UID, or search values when bearer-token authentication is not configured.
- 9.1 /10 CriticalCVE-2026-8066 No auth
Hitachi Energy RTU500 - Directory Traversal
Hitachi Energy RTU500 contains a directory traversal vulnerability in the file upload functionality, letting unauthenticated attackers write or overwrite arbitrary files on the device file system, exploit requires no authentication.
- 9.1 /10 CriticalCVE-2026-8065 PoC publicNo auth
Hitachi Energy RTU500 - Authentication Bypass
Hitachi Energy RTU500 contains an authentication bypass caused by improper validation in the firmware update endpoint, letting unauthenticated attackers upload arbitrary firmware, exploit requires crafted POST request.
- 9.8 /10 CriticalCVE-2026-79538 No auth
metatool-ai MetaMCP - Remote Code Execution
metatool-ai MetaMCP <= 2.4.22 contains a remote code execution caused by unsafe handling in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio, letting remote attackers execute arbitrary code, exploit requires network access to the endpoint.
- 9.1 /10 CriticalCVE-2026-79537 No auth
metatool-ai MetaMCP - Broken Access Control
metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference caused by improper session ID validation in MCP transport session dispatch, letting attackers access and execute other tenants' private MCP tools, exploit requires attacker to obtain another tenant's session ID.
- 9.1 /10 CriticalCVE-2026-79536 No auth
bytebase dbhub - SQL Injection
bytebase dbhub v1.2.0 contains a sql injection caused by improper sanitization in /utils/sql-parser.ts, letting attackers access sensitive database information via crafted SQL statements, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-77177 No auth
Open GenAI Stack - Server-Side Template Injection
Open GenAI Stack (aka ogx-ai) contains a template injection caused by unsanitized Jinja2 template syntax in prompt injection, letting attackers achieve server-side code execution, exploit requires crafted prompt input.
- 9.6 /10 CriticalCVE-2026-76725 No auth
HPE Networking Instant ON APs - Authentication Bypass
HPE Networking Instant ON APs contain an authentication bypass caused by a flaw in the management protocol, letting unauthenticated adjacent attackers bypass security controls and execute code remotely with elevated privileges.
- 9.6 /10 CriticalCVE-2026-76724
HPE Networking Instant ON APs - Command Injection
HPE Networking Instant ON APs contain a command injection caused by improper input handling in the CLI, letting unauthenticated adjacent attackers execute arbitrary commands as privileged users, exploit requires network adjacency.
- 9.6 /10 CriticalCVE-2026-76723
HPE Networking Instant ON APS - Buffer Overflow
HPE Networking Instant ON APS contains a buffer overflow caused by vulnerabilities in the affected interface, letting unauthenticated adjacent attackers execute arbitrary commands on the underlying OS, exploit requires network adjacency.
- 9.8 /10 CriticalCVE-2026-76722 No auth
HPE Networking Instant ON APs - Remote Code Execution & Denial of Service
HPE Networking Instant ON APs contain an uncontrolled format string vulnerability in an affected interface, letting unauthenticated remote attackers execute arbitrary commands or cause denial of service, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-76721 No auth
HPE Networking Instant ON - Buffer Overflow
HPE Networking Instant ON contains a buffer overflow vulnerability in an affected interface, letting unauthenticated remote attackers execute arbitrary code as privileged users on the underlying operating system.