Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 7 of 125

  • 10.0 /10 Critical
    CVE-2026-110536 No auth

    D-Link DIR-868L - Command Injection

    D-Link DIR-868L 2.01b05 contains a command injection caused by manipulation of the SOAPACTION argument in /htdocs/cgibin HNAP CGI Handler, letting remote attackers execute OS commands remotely, exploit requires no special privileges.

  • 9.2 /10 Critical
    CVE-2026-110447 CISA KEVPoC publicNo auth

    Collabora Online - Command Injection

    Collabora Online Built-in CODE Server before 26.4.303 contains a command injection caused by improper handling in proxy.php when the CODE server is not running, letting remote attackers execute OS commands, exploit requires CODE server to be stopped.

  • 9.8 /10 Critical
    CVE-2026-110392 No auth

    Samsung Open Source QA-Board - OS Command Injection

    Samsung Open Source QA-Board contains an OS command injection caused by improper neutralization of special elements in OS commands, letting attackers execute arbitrary OS commands remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-110002 No auth

    Snazzy Social Media Feed WordPress Plugin - Unrestricted File Upload

    Snazzy Social Media Feed WordPress plugin <= 2.5 contains an arbitrary file upload vulnerability caused by missing authentication and insufficient sanitization in save-to-cache.php, letting authenticated subscribers upload executable files leading to remote code execution.

  • 9.8 /10 Critical
    CVE-2026-109439 No auth

    Lantronix XPress-DR - Authentication Bypass

    Lantronix XPress-DR and XPress-DR-I firmware through 8.1.0.0 contain a missing authentication vulnerability caused by unauthenticated UDP configuration protocol on port 30718, letting remote attackers read and overwrite device configuration persistently, exploit requires network access to UDP port 30718.

  • 9.9 /10 Critical
    CVE-2026-108390 Auth required

    Hestia Control Panel - Command Injection

    Hestia Control Panel 1.9.7 through 1.10.4 contains a command injection caused by improper escaping of single quotes in update_object_value() when writing custom document-root values, letting low-privileged authenticated users execute code as root via a crafted PATH during the Search feature.

  • 9.1 /10 Critical
    CVE-2026-108336 No auth

    Application - Authentication Bypass

    An application using a default self-signed SSL certificate to sign JWT access tokens contains a broken authentication vulnerability, letting attackers bypass login and gain administrative access, exploit requires use of default certificate.

  • 9.1 /10 Critical
    CVE-2026-108335 No auth

    Application - Authentication Bypass

    An application with password reset functionality and email configured contains a brute force vulnerability due to lack of rate limiting on reset code attempts, letting attackers gain administrative access, exploit requires enabled password reset and email configuration.

  • 9.8 /10 Critical
    CVE-2026-108291 No auth

    itthinx Affiliates - Insecure Deserialization

    itthinx Affiliates <= 7.0.1 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-108065 No auth

    Channel Software WebAlliance eCommerce - SQL Injection

    Channel Software WebAlliance eCommerce contains a SQL injection caused by improper sanitization of the sUserID parameter in the SOAP GetUser method at /preapproval.asmx, letting unauthenticated remote attackers read, write, and execute commands on the backend Microsoft SQL Server, exploit requires crafted sUserID parameter with SQL injection payload.

  • 10.0 /10 Critical
    CVE-2026-107594 No auth

    File Upload to Order WordPress - Unrestricted File Upload

    File Upload to Order WordPress plugin < 1.1.4 contains an unrestricted file deletion vulnerability caused by lack of validation on file paths from attacker-controlled session data, letting unauthenticated attackers delete arbitrary files, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-107424 No auth

    M A Vinoth Kumar Frontend Dashboard - Broken Access Control

    M A Vinoth Kumar Frontend Dashboard <= 3.0.7 contains a broken access control vulnerability caused by incorrect privilege assignment, letting attackers escalate their privileges, exploit requires no special conditions.

  • 9.8 /10 Critical
    CVE-2026-104800 No auth

    AGE-GATE WordPress plugin - Remote Code Execution

    AGE-GATE WordPress plugin <= 1.0 contains a remote code execution caused by missing authentication and unsanitized POST parameter injection in admin.php, letting unauthenticated attackers execute code on the server.

  • 9.8 /10 Critical
    CVE-2026-104748 PoC publicNo auth

    SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications - Privilege Escalation

    SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications WordPress plugin <= 3.10.0 contains a privilege escalation caused by missing capability checks in wp_ajax_nopriv_simpleform_wp_register and improper meta writing, letting unauthenticated attackers create administrator accounts, exploit requires nonce from front-end JavaScript.

  • 9.3 /10 Critical
    CVE-2026-103904 No auth

    JTL-Shop - Stored XSS

    JTL-Shop contains a stored XSS vulnerability caused by lack of validation and output encoding of arbitrary consent names in the public consent endpoint, letting unauthenticated remote attackers execute script code in administrator sessions, exploit requires administrator to view consent statistics page.