Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 66 of 125
- 9.3 /10 CriticalCVE-2026-93642 No auth
Zimbra Modern - Stored XSS
Zimbra Modern contains a stored XSS caused by forged share notifications, letting unauthenticated attackers execute scripts when signed-in users click Accept Share, exploit requires victim interaction.
- 9.3 /10 CriticalCVE-2026-93641 No auth
Zimbra Classic - Stored XSS
Zimbra Classic contains a stored XSS caused by unauthenticated sender forging share notification, letting attackers access mailbox data and act as victim when signed-in user clicks Accept Share.
- 9.1 /10 CriticalCVE-2026-93399 CISA KEVPoC publicNo auth
Bookly WordPress Plugin - Broken Access Control
Bookly WordPress plugin <= 28.2 contains an insecure direct object reference caused by improper session validation in AJAX handlers, letting unauthenticated attackers disclose order tokens, retrieve calendar data, and delete bookings.
- 9.8 /10 CriticalCVE-2026-92609 No auth
Apache Qpid Broker-J - Authentication Bypass
Apache Qpid Broker-J <= 10.1.0 contains a session fixation vulnerability in HTTP management authentication, letting remote attackers gain unauthorized access to authenticated sessions via reuse of session identifiers, exploit requires no special conditions.
- 9.1 /10 CriticalCVE-2026-92289
Lemonldap::NG::Portal - Authentication Bypass
Lemonldap::NG::Portal 2.23.0 to before 2.23.4 for Perl contains a PKCE bypass caused by checkEndPointAuthenticationCredentials not verifying client secret for public Relying Parties, letting attackers exchange intercepted authorization codes for tokens, exploit requires intercepted authorization code.
- 9.1 /10 CriticalCVE-2026-92288 No auth
Lemonldap::NG::Portal - Authentication Bypass
Lemonldap::NG::Portal 2.20.0 < 2.21.6 and 2.22.0 < 2.23.4 contains an information disclosure caused by missing client secret verification for public Relying Parties in OAuth2 token introspection, letting unauthenticated attackers confirm token activity and read metadata, exploit requires attacker to know a public client_id and hold an access token.
- 9.8 /10 CriticalCVE-2026-92161 No auth
FriendsOfFlarum OAuth - Authentication Bypass
FriendsOfFlarum OAuth < 1.7.4 and < 2.0.0-beta.4 contains an authentication bypass caused by improper verification of Discord OAuth email addresses, letting unauthenticated attackers link attacker-controlled Discord accounts to existing users and authenticate as them without passwords, exploit requires victim's email not linked to Discord.
- 9.1 /10 CriticalCVE-2026-89055 PoC publicNo auth
WooCommerce Customer Reviews - Authorization Bypass
WooCommerce Customer Reviews plugin for WordPress <= 5.120.0 contains an authorization bypass caused by improper user authorization verification, letting unauthenticated attackers delete arbitrary media attachments, exploit requires public review-form link with nonce.
- 9.1 /10 CriticalCVE-2026-62262 No auth
Piwigo - SQL Injection
Piwigo <= 17.0.0beta1 contains a SQL injection caused by improper validation and casting of crafted ratings[] values in pwg.images.filteredSearch.create, letting unauthenticated guests extract database information and cause time delays, exploit requires no authentication.
- 9.1 /10 CriticalCVE-2026-42322 PoC publicAuth required
Piwigo - Command Injection
Piwigo < 16.4.0 contains a command injection caused by reuse of attacker-controlled file extension in admin/themes_standard_pages.php, letting authenticated administrators execute arbitrary commands via uploaded logos.
- 9.1 /10 CriticalCVE-2026-39353 Auth required
InvoicePlane - Remote Code Execution
InvoicePlane < 1.7.2-rc-1 contains a remote code execution caused by inclusion of administrator-writable PHP templates, letting attackers execute arbitrary code with web-server privileges, exploit requires administrator file-write capability.
- 9.8 /10 CriticalCVE-2026-14281 PoC publicNo auth
Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code - Privilege Escalation
Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress <= 4.8.6 contains a privilege escalation caused by missing permission enforcement and insecure handling of user meta in REST route and OTP verification, letting unauthenticated attackers gain administrator access, exploit requires unauthenticated access to REST API.
- 9.8 /10 CriticalCVE-2026-100075 No auth
Linux Kernel - Denial of Service
Linux kernel contains a logic error in RDMA srpt_alloc_rw_ctxs() causing stale counters and dangling pointers, letting attackers cause incorrect send queue credit accounting, exploit requires triggering multi-buffer indirect descriptor failure.
- 9.8 /10 CriticalCVE-2026-97413 No auth
Linux Kernel - Integer Overflow
Linux kernel contains an integer underflow vulnerability in RDMA/rtrs-srv caused by improper validation of usr_len in process_read and process_write, letting malicious RDMA clients cause out-of-bounds memory access, exploit requires sending crafted network messages.
- 10.0 /10 CriticalCVE-2026-97360 No auth
HFS2 - Path Traversal
HFS2 <= 2.4.0 contains an unauthenticated arbitrary file access vulnerability caused by lack of authorization in macro dispatcher and path resolver failing to confine absolute paths, letting unauthenticated attackers read, write, append, and delete files outside the shared folder.