Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 62 of 166
- 9.8 /10 CriticalCVE-2026-57118 No auth
PraisonAI praisonaiagents - Broken Access Control
PraisonAI praisonaiagents < 1.6.59 contains a broken access control vulnerability caused by missing access-control checks in AgentTeam.launch and Agents alias endpoints, letting unauthenticated remote attackers enumerate agents, consume resources, access private context, and trigger side effects, exploit requires no authentication.
- 9.3 /10 CriticalCVE-2026-44828 No auth
Qexo - Broken Access Control
Qexo 4.0.0 to 4.2.0 contains a broken access control vulnerability caused by unauthenticated access to /api/init_step/ allowing reset of INIT setting and exposure of provider configuration, letting unauthenticated attackers with a valid CSRF token reset setup and access sensitive configuration, exploit requires valid CSRF token from a public page.
- 9.8 /10 CriticalCVE-2026-109575 No auth
HAProxy Data Plane API - Authentication Bypass
HAProxy Data Plane API 2.2.0 through 3.4.3 contains a broken authentication caused by process-global authentication logic improperly dropping security controls across multiple transport types, letting unauthenticated attackers bypass credentials and gain full API administrative access, exploit requires attacker to reach HTTP or UNIX management endpoints.
- 9.8 /10 CriticalCVE-2026-109566 No auth
Rapyd Admin - Authentication Bypass
Rapyd Admin 9.0.0 before 9.20.0 contains a hardcoded credentials vulnerability caused by an AuthSeeder-created admin@laravel account with password admin, letting remote unauthenticated attackers gain super-admin access, exploit requires no special conditions.
- 9.8 /10 CriticalCVE-2026-109390 No auth
AnyDesk - Remote Code Execution
AnyDesk < 8.0.3 contains a heap-based buffer overflow caused by unvalidated payload length in the stream packet handler for mode 5 in the session protocol, letting unauthenticated remote attackers execute arbitrary code as root without victim approval.
- 9.1 /10 CriticalCVE-2026-109321 No auth
Grav Login OAuth plugin - Authentication Bypass
Grav Login OAuth plugin before 1.4.3 contains a broken authentication caused by predictable username and unsalted MD5 hashed password generation, letting unauthenticated remote attackers gain administrative access by guessing provider identifiers.
- 9.9 /10 CriticalCVE-2026-108929 Auth required
Netcore NR268 - Command Injection
Netcore NR268 1.7.121109 contains a command injection caused by manipulation of the "Hostname" argument in /router/DDNSset.cgi in the DDNS component, letting remote attackers execute arbitrary commands.
- 10.0 /10 CriticalCVE-2026-108918 No auth
Edimax BR-6208AC - Command Injection
Edimax BR-6208AC 1.32 contains a command injection caused by manipulation of the "readE2P" argument in /goform/formWlanMP, letting remote attackers execute arbitrary commands, exploit requires no special privileges.
- 10.0 /10 CriticalCVE-2026-108917 No auth
Edimax BR-6208AC - Command Injection
Edimax BR-6208AC 1.32 contains a command injection caused by manipulation of the "tftpsIP" argument in /goform/formAutoFWupgrade, letting remote attackers execute arbitrary commands, exploit requires crafted request.
- 9.9 /10 CriticalCVE-2026-108915 Auth required
Edimax BR-6208AC - Buffer Overflow
Edimax BR-6208AC 1.32 contains a buffer overflow caused by manipulation of the "ateBW" argument in /goform/formWlanMP, letting remote attackers cause memory corruption, exploit requires no special privileges.
- 9.9 /10 CriticalCVE-2026-108914 Auth required
Edimax BR-6208AC - Buffer Overflow
Edimax BR-6208AC 1.32 contains a buffer overflow caused by manipulation of the "ifname" argument in /goform/formWlSiteSurvey, letting remote attackers cause memory corruption, exploit requires crafted request.
- 10.0 /10 CriticalCVE-2026-108907 No auth
Netcore NR268 - Authentication Bypass
Netcore NR268 1.7.121109 contains an authentication bypass caused by improper authentication in user_ok function of CGI Execution, letting remote attackers bypass authentication, exploit requires no special conditions.
- 9.9 /10 CriticalCVE-2026-108896 Auth required
Linksys E1700 - Command Injection
Linksys E1700 1.0.0.4.003 contains a command injection caused by manipulation of _6rd_prefix/_6rd_prefix_len arguments in /goform/setLinksysIpv6, letting remote attackers execute OS commands, exploit requires no special privileges.
- 9.9 /10 CriticalCVE-2026-108895 Auth required
Linksys E1700 - Command Injection
Linksys E1700 1.0.0.4.003 contains a command injection caused by manipulation of the MAC_addr argument in /goform/setDMZ, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.
- 9.9 /10 CriticalCVE-2026-108894 Auth required
Linksys E1700 - Command Injection
Linksys E1700 1.0.0.4.003 contains a command injection caused by manipulation of staticRoute_IP_setting, staticRoute_Netmask_setting, staticRoute_Gateway_setting, or staticRoute_Metric_setting arguments in /goform/addStaticRoute, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.