Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 6 of 125

  • 9.2 /10 Critical
    CVE-2026-14851 No auth

    Customer Invoicing Web Application - Broken Access Control

    A customer invoicing web application contains a broken access control vulnerability caused by lack of authorization checks on PDF invoice endpoints and publicly accessible URLs, letting attackers access confidential PII and financial data without authorization.

  • 9.1 /10 Critical
    CVE-2026-110862 No auth

    Better Auth - Authentication Bypass

    Better Auth > 1.4.0-beta.18 < 1.7.7 contains an authentication bypass caused by reuse of OAuth state values as Magic Link tokens, letting unauthenticated attackers sign in as other users, exploit requires crafted OAuth sign-in.

  • 9.8 /10 Critical
    CVE-2026-110650 No auth

    thumbnail Python package - Command Injection

    thumbnail Python package through 1.5 contains a command injection caused by unsanitized file paths in generate_thumbnail(), letting attackers execute OS commands with Python process privileges, exploit requires attacker control of file names.

  • 9.8 /10 Critical
    CVE-2026-110649 No auth

    Stills - Command Injection

    Stills before 25.24.2 contains a command injection caused by crafted media file paths with shell metacharacters, letting attackers execute OS commands with Node.js process privileges, exploit requires crafted media file names.

  • 9.8 /10 Critical
    CVE-2026-110645 No auth

    Video-stitch - Command Injection

    Video-stitch < 2.0.0-beta.1 contains a command injection caused by unquoted file names interpolated into shell-executed ffmpeg commands, letting attackers execute OS commands with Node.js process privileges, exploit requires attacker to influence file names.

  • 9.8 /10 Critical
    CVE-2026-110644 No auth

    nodejs-whisper - Command Injection

    nodejs-whisper through 0.3.1 contains a command injection caused by improper sanitization of audio file paths in convertToWavType(), letting attackers execute OS commands with Node.js process privileges by supplying crafted file names.

  • 9.8 /10 Critical
    CVE-2026-110643 No auth

    transcribe2texts - Command Injection

    transcribe2texts through 1.0.6 contains a command injection caused by unescaped audioPath values in transcribeAudio(), letting attackers execute OS commands with Node.js process privileges, exploit requires crafted audioPath input.

  • 9.8 /10 Critical
    CVE-2026-110640 No auth

    Whisper-node - Command Injection

    Whisper-node <= 1.1.1 contains a command injection caused by improper sanitization of filePath or whisperOptions.language in whisper(), letting attackers execute OS commands with Node.js process privileges, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-110639 No auth

    @mborne/extract - Command Injection

    @mborne/extract < 0.2.1 contains a command injection caused by unquoted shelljs exec() usage in archivePath or targetDir options, letting attackers execute OS commands with Node.js process privileges, exploit requires attacker control of these options.

  • 9.8 /10 Critical
    CVE-2026-110638 No auth

    doc-recog - Command Injection

    doc-recog through 1.1.6 contains a command injection caused by improper sanitization of document paths in recog() or tag(), letting attackers execute OS commands with Node.js process privileges, exploit requires crafted document paths.

  • 9.8 /10 Critical
    CVE-2026-110636 No auth

    pypdftk - Command Injection

    pypdftk <= 0.5 contains a command injection caused by unsafe shell command construction from user-supplied paths in fill_form(), dump_data_fields(), and pdftk_cmd_util(), letting attackers execute OS commands as the Python process, exploit requires attacker control over pdf_path or out_file.

  • 9.8 /10 Critical
    CVE-2026-110635 No auth

    webp-converter - Command Injection

    webp-converter before 3.0.0 contains a command injection caused by shell-enabled execFile usage in src/webpconverter.js helpers, letting attackers execute OS commands via crafted file names or options, exploit requires attacker control over input parameters.

  • 9.8 /10 Critical
    CVE-2026-110634 No auth

    git-diff - Command Injection

    git-diff < 2.0.7 contains a command injection caused by improper handling of crafted strings in the gitDiff API, letting attackers execute arbitrary shell commands with Node.js process privileges, exploit requires control over diffed document string.

  • 9.8 /10 Critical
    CVE-2026-110631 No auth

    Komodo - Authentication Bypass

    Komodo through 2.3.3 contains an authentication bypass caused by empty core_public_keys and passkeys lists failing open in the Periphery agent, letting unauthenticated attackers connect as trusted Core and execute commands, exploit requires access to port 8120.

  • 9.8 /10 Critical
    CVE-2026-110612 No auth

    vlife - Authentication Bypass

    vlife through 2.0.1 contains an authentication bypass caused by a hardcoded HS256 signing key in TokenUtil, letting unauthenticated attackers forge JWTs to gain super administrator access, exploit requires no authentication.