Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 7 of 166

  • 9.5 /10 Critical
    CVE-2026-116366 PoC publicNo auth

    ClickHouse Server - Remote Code Execution

    ClickHouse Server contains a remote code execution vulnerability caused by improper access control, letting unauthenticated users with network access execute arbitrary code remotely, exploit requires network access.

  • 9.9 /10 Critical
    CVE-2026-116241 Auth required

    pgAdmin 4 - Command Injection

    pgAdmin 4 < 9.19 contains a command injection caused by improper handling of backslashes inside double-quoted identifiers in the Import/Export Data tool, letting ordinary database roles execute OS commands, exploit requires the ability to turn off standard_conforming_strings.

  • 9.0 /10 Critical
    CVE-2026-112905 Auth required

    Vvveb - Broken Access Control

    Vvveb < 1.0.8.7 contains an IDOR vulnerability caused by improper authorization on admin/auth-token endpoint, letting authenticated administrators read and overwrite other administrators' API tokens, exploit requires administrator authentication.

  • 10.0 /10 Critical
    CVE-2026-112816 PoC public

    Canonical LXD - Authentication Bypass

    Canonical LXD < 4.0.15, < 5.0.11, < 5.21.9, < 6.10.1 contains an authentication bypass caused by improper certificate validation in the HTTPS listener, letting unauthenticated attackers authenticate as any trusted client and gain full cluster access, exploit requires crafted certificate chain.

  • 9.8 /10 Critical
    CVE-2026-110799 No auth

    Vvveb - Authentication Bypass

    Vvveb < 1.0.8.7 contains an authentication bypass caused by insufficient validation of user and token GET parameters in password reset functionality, letting attackers bypass authentication, exploit requires crafted password reset request.

  • 9.8 /10 Critical
    CVE-2026-107249 No auth

    Drupal Block AJAX - Insecure Deserialization

    Drupal Block AJAX <= 3.0.2 contains an object injection vulnerability caused by improperly controlled modification of dynamically-determined object attributes, letting attackers inject malicious objects remotely, exploit requires crafted request.

  • 9.8 /10 Critical
    CVE-2026-103039 CISA KEVPoC publicNo auth

    Gravity Forms - Insecure Deserialization

    Gravity Forms plugin for WordPress <= 3.1.2 contains a PHP Object Injection caused by unsafe unserialization in GFFormsModel::create_post(), letting unauthenticated attackers inject PHP objects into post meta, exploit requires presence of vulnerable gadget chains in plugins/themes or WordPress environment.

  • 9.8 /10 Critical
    CVE-2025-31704 CISA KEVNo auth

    Dahua Intelligent Connection Center - Command Injection

    Dahua Intelligent Connection Center contains a command injection caused by processing of specially crafted requests, letting remote attackers execute arbitrary commands, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-97854 No auth

    Yamaha NWR100 - Command Injection

    Yamaha wireless LAN router NWR100 contains a command injection caused by improper input validation, letting attackers execute arbitrary OS commands remotely, exploit requires sending a specially crafted request.

  • 9.8 /10 Critical
    CVE-2026-93680 PoC publicNo auth

    IBM Langflow OSS - Authentication Bypass

    IBM Langflow OSS 1.0.0 through 1.12.8 contains a broken authentication caused by improper authentication, letting remote attackers bypass security restrictions, exploit requires no special conditions.

  • 9.9 /10 Critical
    CVE-2026-90868

    Progress Software WS_FTP Server - Command Injection

    Progress Software WS_FTP Server < 2024.0.7 and < 2025.0.4 on Windows contains an OS command injection caused by improper input handling, letting attackers execute arbitrary commands remotely, exploit requires specific server configurations.

  • 9.1 /10 Critical
    CVE-2026-90866 Auth required

    Progress Software WS_FTP Server - Path Traversal

    Progress Software WS_FTP Server < 2024.0.7 and < 2025.0.4 on Windows contains a path traversal caused by improper access control, letting delegated Host Administrators access unauthorized locations, exploit requires delegated Host Administrator privileges.

  • 9.0 /10 Critical
    CVE-2026-90865

    Progress Software WS_FTP Server - Command Injection

    Progress Software WS_FTP Server < 2024.0.7 and < 2025.0.4 on Windows contains an OS command injection caused by improper input handling, letting attackers execute arbitrary commands with elevated privileges under certain configurations.

  • 9.1 /10 Critical
    CVE-2026-90864 Auth required

    Progress Software WS_FTP Server - Path Traversal

    Progress Software WS_FTP Server < 2024.0.7 and < 2025.0.4 on Windows contains a path traversal caused by improper access control, letting delegated Host Administrators access or modify files outside their authorized scope, exploit requires delegated Host Administrator privileges.

  • 9.1 /10 Critical
    CVE-2026-90863 Auth required

    Progress Software WS_FTP Server - Broken Access Control

    Progress Software WS_FTP Server < 2024.0.7 and < 2025.0.4 on Windows contains a broken access control caused by missing authorization in the administrative interface, letting delegated Host Administrators execute arbitrary commands with elevated privileges, exploit requires delegated Host Administrator access.