Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 69 of 125
- 9.8 /10 CriticalCVE-2026-96560 No auth
LightLLM - Remote Code Execution
LightLLM through 1.2.0 contains a remote code execution caused by unauthenticated RPyC control channel deserializing attacker-supplied data in KV-transfer worker with --pd_trans_mode nccl, letting attackers execute arbitrary code remotely, exploit requires starting with --pd_trans_mode nccl.
- 10.0 /10 CriticalCVE-2026-96257 No auth
Fast FAC1203R Gigabit Edition - Buffer Overflow
Fast FAC1203R Gigabit Edition 2.0.4 contains a stack-based buffer overflow caused by improper handling in copy_msg_element function of Device Discovery Service, letting remote attackers execute code, exploit requires network access.
- 9.1 /10 CriticalCVE-2026-95848 PoC publicNo auth
Moquette - Authentication Bypass
Moquette < 0.18.1 contains a broken authentication caused by failure to load configured authenticator or authorizator classes, letting attackers bypass authentication and authorization, exploit requires misconfiguration or class loading failure.
- 9.3 /10 CriticalCVE-2026-95601 No auth
WBW Product Filter - SQL Injection
WBW Product Filter <= 3.1.7 contains an SQL injection caused by unsanitized input, letting unauthenticated attackers execute arbitrary SQL queries, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-93352 No auth
Laravel-Mediable - Remote Code Execution
Laravel-Mediable 7.0.0 before 7.0.2 contains a remote code execution vulnerability caused by incomplete extension blocklist missing .pht in config/mediable.php, letting attackers upload and execute PHP files remotely, exploit requires file upload capability.
- 9.1 /10 CriticalCVE-2026-86934 No auth
FileMaker Server - Authorization Bypass
FileMaker Server before 26.0.3 contains an authorization bypass caused by improper handling of extended privilege headers in the Web Publishing Engine, letting attackers access the XML Web Publishing interface despite disabled settings, exploit requires crafted requests with extended privilege headers.
- 9.1 /10 CriticalCVE-2026-86930 No auth
FileMaker Server - Out of Bounds Read
FileMaker Server for Linux contains an out-of-bounds read vulnerability caused by processing specially crafted image files in container fields during thumbnail generation in FileMaker WebDirect, letting attackers disclose process memory, exploit requires uploading a crafted image file.
- 10.0 /10 CriticalCVE-2026-86708 No auth
ZohoCorp ManageEngine Applications Manager - Authentication Bypass
ZohoCorp ManageEngine Applications Manager <= 182200 contains an exposure of Google Cloud service-account private key in the installer, letting unauthenticated attackers impersonate the service account and access or modify cloud resources, exploit requires no authentication.
- 9.1 /10 CriticalCVE-2026-86350 PoC publicNo auth
Apache Tomcat - HTTP Request Smuggling
Apache Tomcat 11.0.22 through 11.0.25, 10.1.55 through 10.1.59, and 9.0.118 through 9.0.121 contain an HTTP request smuggling caused by regression in fix for CVE-2026-41293, letting attackers trigger request header mix-up, exploit requires crafted HTTP/2 requests.
- 9.8 /10 CriticalCVE-2026-86248
Apache Tomcat - Authentication Bypass
Apache Tomcat 11.0.0-M14 through 11.0.25, 10.1.22 through 10.1.59, and 9.0.92 through 9.0.121 contain an authentication bypass caused by CLIENT_CERT authentication not failing as expected when soft fail is disabled, letting attackers bypass authentication, exploit requires specific CLIENT_CERT soft fail configuration.
- 9.1 /10 CriticalCVE-2026-86246 No auth
Apache Tomcat Native - Insecure Default Configuration
Apache Tomcat Native 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8 contain an insecure default configuration caused by enabled insecure options including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF, and ALLOW_NO_DHE_KEX, letting attackers exploit weakened security, exploit requires no special conditions.
- 9.6 /10 CriticalCVE-2026-85724 PoC publicAuth required
Moquette - Broken Access Control
Moquette < 0.18.1 contains an authorization bypass caused by improper substitution of client ID and username in pattern-based ACL rules, letting attackers with crafted identities gain cross-tenant read/write access or cause DoS, exploit requires crafted client ID or username.
- 9.9 /10 CriticalCVE-2026-84719 Auth required
Ansible Automation Platform automation-controller - Broken Access Control
Ansible Automation Platform automation-controller contains a broken access control caused by incomplete permission checks when copying WorkflowJobTemplate, letting users with organization workflow-admin permission bypass instance group restrictions and run jobs in unauthorized control-plane context, exploit requires organization workflow-admin permission.
- 9.9 /10 CriticalCVE-2026-84502 Auth required
Red Hat Ansible Automation Platform - Command Injection
Red Hat Ansible Automation Platform automation-controller contains a command injection caused by improper validation of the Project scm_url field, letting users with project modification permissions execute arbitrary commands on the control-plane task pod, exploit requires user with project create or modify permissions.
- 9.9 /10 CriticalCVE-2026-84474 Auth required
Red Hat Ansible Automation Platform - Privilege Escalation & Remote Code Execution
Red Hat Ansible Automation Platform automation-controller contains a privilege escalation and remote code execution vulnerability caused by exposure of provisioning-callback secret and trusting client-supplied X-Forwarded-For header, letting minimally privileged or unauthenticated attackers execute jobs on arbitrary managed hosts, exploit requires empty proxy allow-list and read-level view_jobtemplate permission.