Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 69 of 166
- 9.8 /10 CriticalCVE-2026-104803 No auth
WPCOM Member - Authentication Bypass
WPCOM Member plugin for WordPress <= 1.7.27 contains an authentication bypass caused by missing nonce validation and OAuth state verification in social-login callback, letting unauthenticated attackers log in as any user with known social provider ID, exploit requires configured social provider and knowledge of victim's openid or unionid.
- 9.1 /10 CriticalCVE-2026-104801 No auth
PPOM Product Addons & Custom Fields for WooCommerce - Arbitrary File Deletion
PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress <= 34.0.10 contains an arbitrary file deletion vulnerability caused by insufficient file path validation in rename_files function, letting unauthenticated attackers delete arbitrary files and read web-accessible files, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-104732 No auth
Advanced IP Blocker WordPress - Authentication Bypass
Advanced IP Blocker WordPress plugin <= 8.13.13 contains an authentication bypass caused by missing server-side verification in 2FA step-2 processing, letting unauthenticated attackers bypass login by brute-forcing TOTP codes, exploit requires known user_id with 2FA enabled.
- 9.8 /10 CriticalCVE-2026-104398 No auth
VillaTheme AFFI – Affiliate Marketing for WooCommerce - Insecure Deserialization
VillaTheme AFFI – Affiliate Marketing for WooCommerce <= 1.0.10 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-103889 PoC publicNo auth
3D Product configurator for WooCommerce - Remote Code Execution
3D Product configurator for WooCommerce plugin for WordPress <= 2.16.2 contains a remote code execution caused by missing authentication and nonce checks and unsanitized 'xpv_image' parameter in a Dompdf-rendered HTML template with PHP execution enabled, letting unauthenticated attackers execute code on the server, exploit requires unauthenticated POST request.
- 9.3 /10 CriticalCVE-2026-96809 No auth
MultiNet Interactive AB EduAdmin Booking - SQL Injection
MultiNet Interactive AB EduAdmin Booking < 6.0.0 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.
- 9.3 /10 CriticalCVE-2026-96331 No auth
wpdreams Ajax Search Pro - SQL Injection
wpdreams Ajax Search Pro <= 4.29.1 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.
- 9.3 /10 CriticalCVE-2026-96330 No auth
tagDiv tagDiv Opt-In Builder - SQL Injection
tagDiv tagDiv Opt-In Builder <= 1.7.6 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection, exploit requires crafted input.
- 9.3 /10 CriticalCVE-2026-96328 No auth
jegtheme JNews - Pay Writer - SQL Injection
jegtheme JNews - Pay Writer <= 12.0.1 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted SQL payload.
- 9.3 /10 CriticalCVE-2026-96327 No auth
VibeThemes WPLMS - SQL Injection
VibeThemes WPLMS wplms_plugin < 1.9.9.8.2 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted requests.
- 10.0 /10 CriticalCVE-2026-94503 CISA KEVPoC publicNo auth
PX-lab Zombify - Unrestricted File Upload
PX-lab Zombify <= 1.7.7 contains an unrestricted file upload vulnerability caused by lack of proper file type validation, letting attackers upload web shells to the server, exploit requires no special privileges.
- 9.3 /10 CriticalCVE-2026-93947 No auth
Shinetheme Traveler - SQL Injection
Shinetheme Traveler <= 3.2.9 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-86405 No auth
Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module - Authentication Bypass
Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module >= 26.8.1 < 26.9.1 contains a signature spoofing vulnerability caused by improper cryptographic signature verification, letting attackers spoof signatures, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-85531 No auth
Sipay OpenCart Virtual POS Module - Authentication Bypass
Sipay OpenCart Virtual POS Module >= 26.8.2 < 26.9.1 contains a signature spoofing vulnerability caused by improper cryptographic signature verification, letting attackers bypass signature validation, exploit requires crafted signature input.
- 9.8 /10 CriticalCVE-2026-78835
Rocket Software Rocket Remote Desktop - Authentication Bypass
Rocket Software Rocket Remote Desktop 18.0.8583.1 contains an insufficiently protected credentials vulnerability caused by inadequate credential protection, letting attackers potentially access sensitive credentials, exploit requires attacker access to stored credentials.