Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 68 of 125
- 9.1 /10 CriticalCVE-2026-78312 No auth
DIAEnergie - Path Traversal
DIAEnergie < 1.11.00.022 contains a path traversal vulnerability, letting attackers access arbitrary files, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-78308 No auth
DIAEnergie - Authentication Bypass
DIAEnergie < 1.11.00.022 contains an authentication bypass caused by improper authentication, letting attackers bypass authentication, exploit requires no special conditions.
- 9.3 /10 CriticalCVE-2026-61741 No auth
http4s-scala-xml - XML External Entity Injection
http4s-scala-xml < 0.24.1 and < 1.0.0-M39 contains an XML External Entity (XXE) injection caused by insecure SAXParserFactory configuration in EntityDecoder, letting attackers disclose local files, perform SSRF, or cause DoS, exploit requires parsing untrusted XML.
- 10.0 /10 CriticalCVE-2026-61732 PoC publicNo auth
Decepticon - Command Injection
Decepticon < 1.1.17 contains a command injection caused by unneutralized ChatML special-token literals in web crawl results under BYOK deployment, letting attackers bypass agent guardrails and execute arbitrary commands in Kali Linux sandbox, exploit requires attacker to plant malicious strings in target web pages.
- 9.8 /10 CriticalCVE-2026-51996 No auth
Geelen MCP-Remote - Remote Code Execution
Geelen MCP-Remote 0.1.16 through 0.1.38 contains a remote code execution caused by improper handling in src/lib/utils.ts getServerUrlHash function, letting remote attackers execute arbitrary code, exploit requires no special privileges.
- 9.1 /10 CriticalCVE-2026-51994 PoC public
mcp-remote - Server-Side Request Forgery
mcp-remote 0.1.32 through 0.1.38 contains a server-side request forgery caused by processing the resource_metadata URL from a remote MCP server's WWW-Authenticate header, letting attackers make arbitrary server requests, exploit requires crafted header from remote server.
- 9.9 /10 CriticalCVE-2026-19072 Auth required
Velociraptor - Broken Access Control
Velociraptor contains a broken access control vulnerability caused by allowing the internal field "compiled_collector_args" to be set via user API calls, letting investigator role users escalate privileges to run arbitrary VQL statements as administrators, exploit requires investigator role.
- 9.8 /10 CriticalCVE-2026-18467 No auth
Paytium - Privilege Escalation
Paytium: Mollie payment forms & donations plugin for WordPress <= 5.0.3 contains a privilege escalation caused by lack of signature verification on pt_cf_checkout_meta filter, letting unauthenticated attackers create admin accounts via payment form submission and payment completion.
- 9.8 /10 CriticalCVE-2026-13249 PoC publicNo auth
Honeywell PD45 Industrial Printer - Remote Code Execution
Honeywell PD45 Industrial Printer F10.19.010040 contains an unrestricted file upload vulnerability in the web management interface, letting unauthenticated attackers upload and execute malicious files remotely, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-12227 CISA KEVPoC publicNo auth
Visual Composer Website Builder - Local File Inclusion
Visual Composer Website Builder for WordPress <= 45.16.0 contains a local file inclusion vulnerability caused by improper validation of the vcv-template parameter, letting unauthenticated attackers include and execute arbitrary files, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-96759 No auth
Orval - Stored XSS
Orval < 8.29.0 contains a stored XSS caused by failure to escape the operationId parameter in generated TanStack Query mutator options metadata, letting attackers inject and execute arbitrary JavaScript code when hooks are called, exploit requires crafted OpenAPI specification.
- 9.8 /10 CriticalCVE-2026-96758 No auth
orval @orval/core - Code Injection
orval @orval/core < 8.28.0 contains a code injection caused by failure to escape multipart property names in form-data serializer template literals, letting attackers inject expressions that execute during FormData body construction with consumer process privileges.
- 9.8 /10 CriticalCVE-2026-96757
Orval - Stored XSS
Orval < 8.29.0 contains a stored XSS caused by failure to escape OpenAPI media-type keys in single-quoted Content-Type string literals, letting attackers inject JavaScript executed in generated fetch operations or mock resolvers, exploit requires crafted OpenAPI specifications.
- 9.8 /10 CriticalCVE-2026-96755 No auth
Orval - Code Injection
Orval 8.14.0 through 8.28.1 contains a code injection vulnerability caused by improper handling of OpenAPI schema defaults in the @orval/effect generator, letting attackers inject and execute arbitrary JavaScript expressions at module scope, exploit requires crafted schema defaults with ${...} syntax.
- 9.8 /10 CriticalCVE-2026-96754 No auth
Orval - Code Injection
Orval < 8.29.0 contains a code injection caused by failure to escape OpenAPI path values in single-quoted route literals in @orval/hono generator, letting attackers execute arbitrary JavaScript code on module import, exploit requires crafted OpenAPI document.