Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 58 of 125
- 9.0 /10 CriticalCVE-2026-72510 Auth required
Product - SQL Injection
The product contains a time-based blind SQL injection caused by improper sanitization of the "supplier_no" parameter in the business allocation search feature, letting attackers perform unauthorized database queries, exploit requires crafted input.
- 9.0 /10 CriticalCVE-2026-72507 Auth required
Product Summary Report - SQL Injection
The product summary report feature in the balancing reports section contains a time-based blind SQL injection caused by improper sanitization of the "reportType" parameter, letting attackers perform SQL injection remotely, exploit requires crafted requests.
- 10.0 /10 CriticalCVE-2026-71379 No auth
Application - Information Disclosure
The application contains an information disclosure vulnerability caused by an unauthenticated file export endpoint allowing attackers to export arbitrary database tables via crafted POST requests.
- 9.1 /10 CriticalCVE-2026-70356 Auth required
TMS - Unrestricted File Upload
TMS contains an unrestricted file upload vulnerability caused by lack of server-side file type enforcement in the file upload endpoint, letting attackers upload and execute arbitrary PHP files remotely, exploit requires no special privileges.
- 9.0 /10 CriticalCVE-2026-68954 Auth required
TMS - SQL Injection
TMS application contains a time-based blind SQL injection caused by unsanitized 'pattern' parameter in the search function on the home page, letting attackers perform blind SQL injection remotely, exploit requires no special privileges.
- 9.0 /10 CriticalCVE-2026-68068 Auth required
Unknown Vendor Unknown Product - SQL Injection
An unspecified vendor's product contains a time-based blind SQL injection caused by improper sanitization of the "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section, letting attackers perform unauthorized database queries, exploit requires crafted requests.
- 9.0 /10 CriticalCVE-2026-63713 Auth required
Unknown Product - SQL Injection
The product contains a time-based blind SQL injection caused by unsanitized 'search' parameter in the view audit logs feature within the utilities section, letting attackers perform unauthorized database queries, exploit requires crafted input.
- 10.0 /10 CriticalCVE-2026-53988 No auth
Dockhand - Authentication Bypass
Dockhand before 1.0.40 contains an authentication bypass caused by a null webhook secret guard condition in git webhook endpoints, letting unauthenticated remote attackers trigger arbitrary stack redeployments, exploit requires no authentication.
- 9.6 /10 CriticalCVE-2026-49243 No auth
Webmin - Stored XSS
Webmin < 2.650 contains a stored XSS vulnerability caused by improper input sanitization, letting remote attackers execute attacker-controlled commands via malicious links, exploit requires user interaction.
- 9.8 /10 CriticalCVE-2026-39117 No auth
AltumCode 66Uptime - Remote Code Execution
AltumCode 66Uptime < 54.0.0 and 66Uptime ping-servers plugin < 2.0.0 contain a remote code execution caused by improper input handling in index.php, letting remote attackers execute arbitrary code, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-103044 No auth
The Wikimedia Foundation Mediawiki - XPath Injection
The Wikimedia Foundation Mediawiki - EasyTimeline extension < 1.46.1, 1.45.5, 1.43.10 contains an xpath injection caused by improper input sanitization, letting attackers perform blind XPath injection, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-103041
LightLLM - Insecure Deserialization
LightLLM through 1.2.0 multimodal deployments contain an insecure deserialization caused by unauthenticated RPyC cache service with pickle deserialization enabled, letting attackers execute arbitrary code with service privileges, exploit requires exposed cache service.
- 9.8 /10 CriticalCVE-2026-103040 No auth
LightLLM - Remote Code Execution
LightLLM through 1.2.0 contains a remote code execution caused by unauthenticated RPyC server with pickle deserialization in the router profiler service, letting attackers execute arbitrary code remotely, exploit requires --enable_profiling flag enabled.
- 9.2 /10 CriticalCVE-2026-102829 No auth
argv-parser - Command Injection
argv-parser < 2.0.1 contains an unsafe editor invocation vulnerability caused by omission of VISUAL from GitEnvKeys in parseEnv, letting attackers influence Git editor execution during operations, exploit requires attacker-controlled environment variables.
- 9.8 /10 CriticalCVE-2026-102828 No auth
simple-git - Command Injection
simple-git 3.15.0 to 4.0.1 contains a command injection caused by unsafe classification of trailer.<token>.cmd in configuration, letting attackers execute arbitrary shell commands with Node.js process permissions, exploit requires attacker-controlled config values.