Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 61 of 166
- 9.4 /10 CriticalCVE-2026-93582
OTRS Community Edition - Authentication Bypass
OTRS Community Edition <= 6 contains an authentication bypass caused by trusting HTTP_REMOTE_USER environment variable from attacker-controlled HTTP headers, letting unauthenticated remote attackers impersonate users, exploit requires HTTP Basic Authentication backend and vulnerable web server environment.
- 9.3 /10 CriticalCVE-2026-92681 No auth
neo4j/graphql - Authentication Bypass
@neo4j/graphql <= 7.6.3 contains an authentication bypass caused by ignoring @authentication directives at schema or type level on top-level @cypher fields, letting unauthenticated callers read and modify data, exploit requires exposed top-level @cypher fields.
- 9.6 /10 CriticalCVE-2026-9191
Progress MarkLogic Server - Broken Access Control
Progress MarkLogic Server 12.x < 12.1.0 and 11.x < 11.3.7 contain a broken access control vulnerability caused by insufficient isolation of user-supplied code in REST and XDBC evaluation paths, letting attackers perform unauthorized actions or compromise authenticated sessions, exploit requires code execution through affected paths.
- 9.8 /10 CriticalCVE-2026-90920 No auth
IBM Maximo AI Service - Remote Code Execution
IBM Maximo AI Service 9.1.0 and 9.2.0 contain a remote code execution caused by improper control of code generation, letting remote attackers execute arbitrary code, exploit requires network access.
- 9.1 /10 CriticalCVE-2026-87744 No auth
Quarkus REST Data Panache - Broken Access Control
Quarkus REST Data Panache contains a broken access control vulnerability caused by @MethodProperties customization dropping class-level security roles, letting unauthenticated attackers bypass security and access endpoints, exploit requires use of @MethodProperties without re-declaring roles.
- 9.6 /10 CriticalCVE-2026-85956 Auth required
Progress MarkLogic Server - Broken Access Control
Progress MarkLogic Server 12.x < 12.1.0 and 11.x < 11.3.7 contain a broken access control vulnerability caused by improper authorization checks in backup and restore operations, letting remote attackers with delegated database-administrator privileges access or modify security-critical data outside authorized scope.
- 9.9 /10 CriticalCVE-2026-85955 Auth required
Progress MarkLogic Server - Server-Side Code Execution
Progress MarkLogic Server 12.x < 12.1.0 and 11.x < 11.3.7 contain a server-side code execution vulnerability caused by missing evaluation privilege checks in XQuery evaluation function, letting remote attackers with query-execution access execute code with elevated permissions.
- 9.9 /10 CriticalCVE-2026-85948 Auth required
Progress MarkLogic Server - Authentication Bypass
Progress MarkLogic Server 12.x < 12.1.0 and 11.x < 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path, letting remote attackers with manage-user-level privileges gain persistent unauthorized administrative control.
- 9.9 /10 CriticalCVE-2026-85947 Auth required
Progress MarkLogic Server - Broken Access Control
Progress MarkLogic Server 12.x < 12.1.0 and 11.x < 11.3.7 contain an authorization flaw in forest-management operations, letting remote attackers with forest-management privileges create persistent unauthorized admin accounts, exploit requires forest-management privileges.
- 9.6 /10 CriticalCVE-2026-82110 Auth required
IBM DataStage on Cloud Pak for Data - Path Traversal
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal caused by improper validation of pathname, letting remote authenticated attackers execute arbitrary code.
- 9.6 /10 CriticalCVE-2026-82103 Auth required
IBM DataStage - Information Disclosure
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an information disclosure vulnerability caused by exposure of sensitive information, letting remote authenticated attackers obtain sensitive data, exploit requires authentication.
- 9.6 /10 CriticalCVE-2026-82101 Auth required
IBM DataStage on Cloud Pak for Data - Denial of Service
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability caused by improper input validation, letting remote authenticated attackers cause denial of service, exploit requires authentication.
- 9.1 /10 CriticalCVE-2026-78357 No auth
OTRS - Authentication Bypass
OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and < 2026.7.X contain an authentication token invalidation flaw caused by delayed JWT revocation after user deactivation or password change, letting attackers with previously obtained tokens maintain access until token expiration, exploit requires possession of a valid token.
- 9.9 /10 CriticalCVE-2026-77366 Auth required
obsidian-tc - Broken Access Control
obsidian-tc < 1.3.1 contains a broken access control vulnerability caused by lack of vault claim in JWT and global folder access-control list, letting attackers with valid tokens read, write, or delete contents of other vaults, exploit requires valid token.
- 9.8 /10 CriticalCVE-2026-66086 No auth
Modem OTA stack - Buffer Overflow
Modem OTA stack contains a stack-based buffer overflow caused by improper validation of scheduling information in SIB1 messages, letting remote attackers execute code or cause denial of service, exploit requires no special privileges.