Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 65 of 125

  • 9.4 /10 Critical
    CVE-2026-97160 PoC publicAuth required

    Joomla Extension lomart.fr - Command Injection

    Joomla Extension lomart.fr 5.0.0-5.2.0, 6.0.0-6.0.29 contains a command injection caused by insufficient input sanitization in UP plugin extension, letting authenticated privileged attackers execute arbitrary PHP commands.

  • 9.5 /10 Critical
    CVE-2026-94132 PoC publicNo auth

    Joomla Extension acymailing.com - Remote Code Execution

    Joomla Extension acymailing.com < 11.1.0 contains a remote code execution caused by lack of extension check on MIME parts saved in mailbox action feature, letting attackers upload PHP files remotely via email, exploit requires ability to send email to monitored mailbox.

  • 9.8 /10 Critical
    CVE-2026-94130 PoC publicNo auth

    Joomla Extension joomlaboat.com - SQL Injection

    Joomla Extension joomlaboat.com < 5.7.3 contains an SQL injection caused by improper sanitization in video search and sorting functionality, letting unauthenticated attackers inject SQL commands in read queries.

  • 9.8 /10 Critical
    CVE-2026-85984 PoC publicNo auth

    miniOrange OTP Login, Verification and SMS Notifications - Authentication Bypass

    miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress <= 5.5.5 contains an authentication bypass caused by missing password-intent guard in mo_by_pass_login() function, letting unauthenticated attackers log in as any administrator with only a username and mo_wp_login_intent=otp, exploit requires specific plugin options enabled by site administrator.

  • 9.8 /10 Critical
    CVE-2026-82901 PoC public

    Ultra Addons for Contact Form 7 - Arbitrary File Upload

    Ultra Addons for Contact Form 7 WordPress plugin <= 3.5.50 contains an arbitrary file upload vulnerability caused by insufficient file type validation in 'uacf7_wpcf7_mail_components', letting unauthenticated attackers upload arbitrary files, exploit requires PDF Generator module enabled.

  • 9.8 /10 Critical
    CVE-2026-18143 CISA KEVPoC publicNo auth

    Request a Quote for WooCommerce - Unrestricted File Upload

    Request a Quote for WooCommerce plugin for WordPress <= 2.9.2 contains an unrestricted file upload vulnerability caused by missing file extension and MIME type validation in afrfq_submit_quote_via_popup(), letting unauthenticated attackers upload executable files, exploit requires enabled public quote rule with multi-page popup flow.

  • 9.9 /10 Critical
    CVE-2026-100717 Auth required

    Froxlor - Server-Side Request Forgery

    Froxlor <= 2.3.10 contains a server-side request forgery caused by improper validation of CR/LF characters in userinfo of URLs, letting authenticated low-privilege customers with subdomain-create rights inject arbitrary web-server configuration, exploit requires authenticated low-privilege user.

  • 9.9 /10 Critical
    CVE-2026-100716 Auth required

    Froxlor - Broken Access Control

    Froxlor <= 2.3.10 contains a broken access control vulnerability caused by improper validation of intermediate path components in DataDump export destination, letting authenticated customers with export feature enabled escalate privileges to root via symlink attack, exploit requires authenticated customer with export feature.

  • 9.6 /10 Critical
    CVE-2026-100715 Auth required

    Froxlor - Unrestricted File Upload

    Froxlor <= 2.3.10 contains an arbitrary file deletion vulnerability caused by symlink following in the FTP data deletion cron task, letting authenticated customers delete arbitrary directories as root, exploit requires FTP home directory write access.

  • 9.1 /10 Critical
    CVE-2026-100714 Auth required

    Froxlor - Command Injection

    Froxlor < 2.3.12 contains a command injection vulnerability caused by unescaped system.letsencryptchallengepath setting concatenated into acme.sh command line, letting administrators or actors with settings write access execute arbitrary commands as root, exploit requires write access to settings.

  • 9.9 /10 Critical
    CVE-2026-100706 Auth required

    Kyverno - Broken Access Control

    Kyverno < 1.19.1 contains a broken access control caused by improper validation of URL-encoded path segments in Policy apiCall urlPath, letting namespace tenants bypass namespace restrictions and escalate privileges to cluster admin, exploit requires namespace tenant privileges.

  • 9.1 /10 Critical
    CVE-2026-97064 No auth

    X-SpringBoot - Authentication Bypass

    X-SpringBoot through 6.0 contains a broken authentication caused by a hardcoded static master login verification code in the database seed, letting unauthenticated attackers authenticate as any user via the emailOrMobileLogin endpoint.

  • 9.1 /10 Critical
    CVE-2026-97063 No auth

    X-SpringBoot - Authentication Bypass

    X-SpringBoot <= 6.0 contains an authentication bypass caused by login verification codes returned in HTTP responses from unauthenticated endpoints, letting attackers hijack accounts by requesting and reading codes, exploit requires no authentication.

  • 9.3 /10 Critical
    CVE-2026-93647 No auth

    Zimbra Classic - Stored XSS

    Zimbra Classic contains a stored XSS caused by active markup in a COUNTER message's RFC From address, letting unauthenticated calendar senders access mailbox data and act as victims, exploit requires message selection.

  • 9.8 /10 Critical
    CVE-2026-93643 No auth

    OnlyOffice Document Editing - Path Traversal & Command Injection

    OnlyOffice Document Editing contains a path traversal and command injection caused by unsigned save fields in public Briefcase documents, letting unauthenticated remote attackers write files and execute commands as zimbra, exploit requires access to a supported public Briefcase document.