Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 64 of 166
- 9.1 /10 CriticalCVE-2026-81649 No auth
Fundin cho WooCommerce - Broken Access Control & Stored XSS
Fundin cho WooCommerce WordPress plugin through 3.4.0 contains broken access control caused by improper authorization on REST API routes using identical credentials, letting unauthenticated attackers disclose payment credentials, modify payment settings, and perform stored XSS, exploit requires no authentication.
- 9.1 /10 CriticalCVE-2026-108860
BotSharp - Authentication Bypass
BotSharp through 5.2.0 contains an authentication bypass caused by hard-coded Jwt:Key in WebStarter appsettings.json, letting unauthenticated remote attackers forge bearer tokens to impersonate any user including administrators, exploit requires knowledge of the hard-coded key.
- 9.4 /10 CriticalCVE-2026-108753 No auth
Agnaistic agnai - Authentication Bypass
Agnaistic agnai 1.0.555 contains a hardcoded credentials vulnerability caused by fixed admin password and public JWT secret in self-host.docker-compose.yml, letting unauthenticated attackers impersonate admin, reset passwords, and change configuration, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-108707 No auth
Wukong_HRM - Authentication Bypass
Wukong_HRM through commit 186115e contains an authentication bypass caused by omission of the AUTH-TOKEN header in ParamAspect, letting unauthenticated attackers gain HR administrator access to all API endpoints, exploit requires omission of AUTH-TOKEN header.
- 10.0 /10 CriticalCVE-2026-108576 No auth
TOZED X300 - Command Injection
TOZED X300 <= 6.01.3 contains a command injection caused by manipulation of the "Host" argument in IPPingDiagnostics Handler's process_ping function, letting remote attackers execute OS commands remotely, exploit requires network access.
- 9.9 /10 CriticalCVE-2026-108540 Auth required
OpenSpug Spug - Command Injection
OpenSpug Spug <= 3.4.0/4.0.1 contains a command injection caused by manipulation in /exec/transfer file transfer component, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-104028 No auth
Anton Extensions WordPress - Unrestricted File Upload
Anton Extensions WordPress plugin through 1.2.2 contains an unrestricted file upload vulnerability caused by lack of capability check, nonce verification, and file-type validation, letting unauthenticated attackers upload arbitrary PHP files and achieve remote code execution.
- 9.1 /10 CriticalCVE-2026-97670 CISA KEVNo auth
Avada (Fusion) Builder - Authorization Bypass
Avada (Fusion) Builder plugin for WordPress <= 7.16.1 contains an authorization bypass caused by improper verification of attacker-supplied action hook names in form submissions, letting unauthenticated attackers invoke arbitrary WordPress action hooks causing state changes including permanent content deletion, exploit requires a published Avada form with AJAX submission and specific notification email_message template.
- 9.8 /10 CriticalCVE-2026-94589 No auth
Extensions For CF7 WordPress - Arbitrary File Upload
Extensions For CF7 WordPress plugin <= 3.4.5 contains an arbitrary file upload vulnerability caused by missing validation and sanitize_file_name() bypass in extcf7_submit function, letting unauthenticated attackers upload executable files and achieve remote code execution.
- 9.8 /10 CriticalCVE-2026-93945 No auth
Axiomthemes Balance - Insecure Deserialization
Axiomthemes Balance <= 1.12.0 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-93944 No auth
ThemeREX Group Camelia - Insecure Deserialization
ThemeREX Group Camelia <= 1.2.15 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-93943 No auth
ThemeREX Group Convex - Insecure Deserialization
ThemeREX Group Convex <= 1.16.0 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting attackers perform object injection remotely, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-93942 No auth
ThemeREX Group Dwell - Insecure Deserialization
ThemeREX Group Dwell <= 1.16.0 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-93941 No auth
ThemeREX Group Edema - Insecure Deserialization
ThemeREX Group Edema <= 1.2.2.2 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-93940 No auth
ThemeREX Group Greeny - Insecure Deserialization
ThemeREX Group Greeny <= 2.10.0 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.