Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 63 of 166

  • 9.9 /10 Critical
    CVE-2026-108893 Auth required

    Linksys E1700 - Buffer Overflow

    Linksys E1700 <= 1.0.0.4.003 contains a stack-based buffer overflow caused by manipulation of the "vlan_set" argument in /goform/setVlan, letting remote attackers execute arbitrary code, exploit requires crafted request.

  • 10.0 /10 Critical
    CVE-2026-108892 No auth

    Linksys E1700 - Buffer Overflow

    Linksys E1700 1.0.0.4.003 contains a stack-based buffer overflow caused by manipulation of the argument newap_text_%d in ssid1MACFilter component, letting remote attackers cause memory corruption, exploit requires crafted request.

  • 10.0 /10 Critical
    CVE-2026-108804 No auth

    TRENDnet TEW-751DR/TEW-752DRU/TEW733GR - Command Injection

    TRENDnet TEW-751DR, TEW-752DRU, and TEW733GR 1.03B01/1.03B03 contain a command injection caused by manipulation of the "service" argument in pigwidgeon.cgi fwrite function of the Web Management Backend, letting remote attackers execute OS commands, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-108362

    Privasys Remote Attestation TLS Clients - Authentication Bypass

    Privasys Remote Attestation TLS Clients < 0.11.0 contains an authentication bypass caused by acceptance of TEE attestation evidence without explicit platform identity authorization, letting network attackers impersonate attested TLS endpoints, exploit requires forged evidence or extracted attestation secrets.

  • 9.8 /10 Critical
    CVE-2025-71429 No auth

    GPT-SoVITS - Command Injection

    GPT-SoVITS through 20250606v2pro contains a command injection caused by improper sanitization of output folder paths in tools/uvr5/vr.py, letting unauthenticated attackers execute OS commands via UVR5 WebUI output folder inputs.

  • 9.1 /10 Critical
    CVE-2026-86717 No auth

    Insurify WordPress plugin - Broken Access Control

    Insurify WordPress plugin through 1.0 contains a broken access control caused by missing authorization and nonce checks on an AJAX action, letting unauthenticated attackers delete arbitrary WordPress options, exploit requires no authentication.

  • 9.1 /10 Critical
    CVE-2026-86706 No auth

    Quick quotes WordPress plugin - Broken Access Control

    Quick quotes WordPress plugin through 1.0.0 contains a broken access control vulnerability caused by lack of capability or nonce checks in an AJAX action, letting unauthenticated attackers alter site settings and cause denial of service.

  • 9.1 /10 Critical
    CVE-2026-85121 No auth

    Insurify WordPress plugin - Broken Access Control

    Insurify WordPress plugin through 1.0 contains a broken access control vulnerability caused by missing authorization and nonce checks in an AJAX action, letting unauthenticated attackers overwrite arbitrary WordPress options, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-85118 No auth

    AI Content Generator Marketing WordPress - Broken Access Control

    AI Content Generator Marketing WordPress plugin through 1.0.0 contains a broken access control caused by missing nonce or capability checks on AJAX actions, letting unauthenticated attackers update and delete arbitrary WordPress options, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-84737 No auth

    Freeton WP WordPress plugin - Authentication Bypass

    Freeton WP WordPress plugin through 1.0.0 contains an authentication bypass caused by improper validation of activation codes, letting unauthenticated attackers log in as any user with a known email address.

  • 9.8 /10 Critical
    CVE-2026-84734 No auth

    Mindstien Quick Login WordPress plugin - Authentication Bypass

    Mindstien Quick Login WordPress plugin through 1.0 contains a broken authentication caused by improper validation of request values against visitor sessions, letting unauthenticated attackers obtain administrator sessions, exploit requires crafted request.

  • 9.8 /10 Critical
    CVE-2026-84254 No auth

    Click5 CRM add-on to Contact Form 7 WordPress plugin - Broken Access Control

    Click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 contains a broken access control and CSRF vulnerability caused by missing authorization and CSRF checks in REST endpoint, letting unauthenticated attackers create new admin accounts and take over the site, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-84253 No auth

    click5 CRM add-on to Gravity Forms - Broken Access Control

    click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 contains a broken access control and CSRF vulnerability caused by lack of authorization and CSRF checks in REST endpoint option updates, letting unauthenticated attackers create admin accounts and take over the site, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-84252 No auth

    click5 CRM add-on to WPForms - Broken Access Control

    click5 CRM add-on to WPForms WordPress plugin through 1.0.3 contains a broken access control and CSRF vulnerability caused by lack of authorization and CSRF checks in REST endpoint for updating options, letting unauthenticated attackers create new admin accounts and take over the site, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-84251 No auth

    click5 CRM add-on to Ninja Forms - Broken Access Control & CSRF

    click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 contains a broken access control and CSRF vulnerability caused by missing authorization and CSRF checks in REST endpoint for updating options, letting unauthenticated attackers create new admin accounts and take over the site, exploit requires no authentication.