Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 70 of 125
- 9.0 /10 CriticalCVE-2026-82843 Auth required
WP OAuth Server (Login with WordPress) - Authentication Bypass
WP OAuth Server (Login with WordPress) < 6.4.0 contains an authentication bypass caused by improper binding of OpenID Connect identity assertions to authorization grants, letting users with Subscriber role or higher authenticate as other users including administrators, exploit requires user to have Subscriber role or above.
- 9.8 /10 CriticalCVE-2026-82331 No auth
Apache BuildStream - Path Traversal
Apache BuildStream < 2.8.1 on Python < 3.12 contains a file write vulnerability caused by improper link resolution in the tar source plugin, letting attackers write files via symlinks during source fetching, exploit requires malicious source tarballs.
- 9.9 /10 CriticalCVE-2026-77602 Auth required
OpenC3 COSMOS - Remote Code Execution
OpenC3 COSMOS 5.1.0 to 7.3.0 contains a remote code execution caused by authenticated non-administrator users writing executable content under targets_modified/, letting attackers execute arbitrary code with elevated privileges, exploit requires authenticated non-admin user access.
- 9.8 /10 CriticalCVE-2026-76183 No auth
Apache Tomcat - Authentication Bypass
Apache Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121 contain an authentication bypass caused by alternate name handling in WebSocket endpoints, letting attackers bypass security constraints, exploit requires no special conditions.
- 9.1 /10 CriticalCVE-2026-75884 Auth required
AWX - Broken Access Control
AWX contains a broken access control caused by incomplete blocklist in container group pod_spec_override field, letting AAP platform administrators escalate privileges to OpenShift namespace-level access and exfiltrate secrets, exploit requires AAP platform administrator privileges.
- 9.0 /10 CriticalCVE-2026-75799 No auth
YAHMAN Add-ons WordPress plugin - Unrestricted File Upload
YAHMAN Add-ons WordPress plugin < 0.9.31 contains an unrestricted file upload vulnerability caused by lack of validation on remote files cached in a public directory, letting unauthenticated attackers upload arbitrary PHP files and achieve remote code execution when the feature is enabled.
- 9.8 /10 CriticalCVE-2026-6928
IBM Concert - Use After Free
IBM Concert 1.0.0 through 3.0.0 contains a use after free vulnerability caused by accessing memory after it has been freed, letting attackers corrupt memory, cause crashes, or execute arbitrary code, exploit requires attacker to influence program execution or input.
- 9.8 /10 CriticalCVE-2026-6730 No auth
IBM Concert - Buffer Overflow
IBM Concert 1.0.0 through 3.0.0 contains a buffer overflow caused by improper bounds checking, letting local users execute arbitrary code on the system, exploit requires local access.
- 9.8 /10 CriticalCVE-2026-6721 No auth
IBM Concert - Command Injection
IBM Concert 1.0.0 through 3.0.0 contains a command injection caused by incorporation of specially crafted input into OS commands, letting unauthenticated remote attackers execute arbitrary commands, exploit requires no authentication.
- 10.0 /10 CriticalCVE-2026-59167 No auth
SunEditor - Stored XSS
SunEditor < 2.47.11 contains a stored XSS caused by inconsistent sanitization of namespaced or custom HTML elements in src/lib/core.js, letting attackers execute scripts in the browser via crafted content, exploit requires user interaction.
- 9.9 /10 CriticalCVE-2026-19599 Auth required
ZohoCorp ManageEngine OpManager MSP - Remote Code Execution
ZohoCorp ManageEngine OpManager MSP <= 12.8.709 contains a remote code execution caused by a flaw in the Notification Profile module, letting remote attackers execute arbitrary code, exploit requires no special privileges.
- 9.3 /10 CriticalCVE-2026-18872 No auth
IBM Financial Transaction Manager (FTM) - Stored XSS
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a stored cross-site scripting caused by script injection in the NetworkAcknowledgement React component, letting authenticated operators have their sessions hijacked and perform unauthorized payment actions, exploit requires operator authentication.
- 9.8 /10 CriticalCVE-2025-63564 No auth
Moodle Socialwall - SQL Injection
Moodle Socialwall plugin v3.0 through v3.3 contains a sql injection caused by improper sanitization of input in HTTP requests, letting attackers execute arbitrary code remotely, exploit requires crafted HTTP requests.
- 9.8 /10 CriticalCVE-2026-95675 CISA KEVPoC publicNo auth
D-Link DAP-1360 - Remote Code Execution
D-Link DAP-1360 <= 6.14 contains an unauthenticated remote code execution caused by crafted requests to the web management interface, letting remote attackers execute arbitrary commands as root, exploit requires no authentication.
- 10.0 /10 CriticalCVE-2026-94493 No auth
Gigatech PDV5701 - Authentication Bypass
Gigatech PDV5701 1.0.31_240305_112640 contains an authentication bypass caused by manipulation in WebSocket Service component /index.html, letting remote attackers bypass authentication, exploit requires no special conditions.