Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 62 of 125

  • 9.0 /10 Critical
    CVE-2026-82378

    Apache Roller - Broken Access Control

    Apache Roller 6.1.5 contains a broken access control caused by improper authorization in the OAuth 1.0a authorization endpoint, letting unauthenticated remote attackers bind request tokens to arbitrary user accounts, exploit requires knowledge of an outstanding request token.

  • 9.9 /10 Critical
    CVE-2026-82377 Auth required

    Apache Roller - Broken Access Control

    Apache Roller 6.1.5 contains a broken access control vulnerability caused by missing authorization checks in legacy XML-RPC Blogger and MetaWeblog API handlers, letting authenticated users read, modify, or delete other weblogs' content, exploit requires enabled global XML-RPC setting.

  • 9.2 /10 Critical
    CVE-2026-73642 No auth

    Dayforce Payroll - Path Traversal

    Dayforce Payroll R2026.2.0 contains a path traversal caused by improper validation of file path parameter in file download functionality, letting unauthenticated attackers read arbitrary local files, exploit requires crafted GET request.

  • 9.3 /10 Critical
    CVE-2026-73640 No auth

    Dayforce Payroll - SQL Injection

    Dayforce Payroll R2026.2.0 contains a time-based blind SQL injection caused by unsanitized input in password recovery parameters, letting unauthenticated attackers perform delayed SQL queries, exploit requires crafted GET request.

  • 9.1 /10 Critical
    CVE-2026-49994 No auth

    Bluehood - Broken Access Control

    Bluehood < 0.7.1 contains broken access control caused by missing authentication checks on /api/* handlers, letting network attackers read Bluetooth tracking data and modify application state without session cookies.

  • 9.6 /10 Critical
    CVE-2026-12342 No auth

    IdentityIQ - Remote Code Execution

    IdentityIQ contains a remote code execution caused by improper input validation of submitted web service API content, letting unauthenticated attackers execute code remotely, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-102268 PoC publicNo auth

    PyJWT - Authentication Bypass

    PyJWT < 2.14.0 contains an authentication bypass caused by is_pem_format not recognizing all PEM representations, letting attackers forge authenticated HMAC tokens when mixing HMAC and asymmetric algorithms, exploit requires supplying mutated public-key PEM as raw key bytes.

  • 9.1 /10 Critical
    CVE-2026-101894 PoC publicNo auth

    Node.js decompress - Path Traversal & Remote Code Execution

    Node.js decompress package < 10.2.2 and < 11.1.4 contains a path traversal caused by chained symlink entries in archives, letting attackers read/write files outside output directory and potentially execute remote code, exploit requires crafted archive.

  • 9.1 /10 Critical
    CVE-2026-101262 Auth required

    Ziroom ZHOME A0101 - Command Injection

    Ziroom ZHOME A0101 1.0.1.0 contains a command injection caused by manipulation of the "ip" argument in /api/ZRQos/set_online_client, letting remote attackers execute arbitrary commands, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-101261 Auth required

    Ziroom ZHOME A0101 - Command Injection

    Ziroom ZHOME A0101 1.0.1.0 contains a command injection caused by manipulation of the "login_pwd" argument in /api/ZRnetwork/firstSetup_wifi, letting remote attackers execute arbitrary commands, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-101260 Auth required

    Ziroom ZHOME A0101 - Command Injection

    Ziroom ZHOME A0101 1.0.1.0 contains a command injection caused by manipulation of the "firstLogin" argument in /api/ZRnetwork/firstLogin, letting remote attackers execute arbitrary commands, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-101187 Auth required

    Ziroom ZHOME - Command Injection

    Ziroom ZHOME A0101 1.0.1.0 contains a command injection caused by manipulation of the "path" argument in pop_usb_device function of USB Device Management API, letting remote attackers execute arbitrary commands, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-101110 PoC publicNo auth

    Joomla Extension ordasoft.com - SQL Injection

    Joomla Extension ordasoft.com < 6.4.6 contains an unauthenticated SQL injection caused by improper sanitization of 'field' and 'direction' parameters in site/booklibrary.php's books() function, letting remote attackers execute arbitrary SQL commands, exploit requires a two-step request with a decoy comment.

  • 9.3 /10 Critical
    CVE-2026-101108 PoC publicNo auth

    Joomla Extension ordasoft.com Vehicle Manager - SQL Injection

    Joomla Extension ordasoft.com Vehicle Manager (Free) < 6.5.8 contains an unauthenticated SQL injection caused by improper sanitization of order_field and order_direction parameters in unquoted ORDER BY clauses, letting remote attackers execute arbitrary SQL queries, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-101081 Auth required

    D-Link DI-8400 - Buffer Overflow

    D-Link DI-8400 16.07 contains a stack-based buffer overflow caused by manipulation of the "opt" argument in menu_nat_more.asp Web Administration Service, letting remote attackers execute arbitrary code, exploit requires no special privileges.