Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 70 of 166
- 9.8 /10 CriticalCVE-2026-78797 No auth
iStoreOS - Remote Code Execution
iStoreOS istoreos-24.10.7 and before contains a remote code execution caused by improper handling of task_id in tasks-lib.lua, letting remote attackers execute arbitrary code, exploit requires network access.
- 9.1 /10 CriticalCVE-2026-7826 No auth
FalkorDB - Out-of-Bounds Read
FalkorDB < 4.18.4 contains a heap-based out-of-bounds read caused by improper bounds checking in BufferSerializerIOv2_ReadBuffer function, letting remote attackers issuing Redis replication commands cause denial of service or memory disclosure, exploit requires ability to send replication commands.
- 9.8 /10 CriticalCVE-2026-5759 No auth
FalkorDB - Use After Free
FalkorDB < 4.18.1 contains a double free and use-after-free vulnerability caused by improper length check in RdbLoadDeletedNodes function of RDB graph decoders, letting remote attackers issuing Redis replication commands cause denial of service or remote code execution, exploit requires ability to issue replication commands.
- 9.8 /10 CriticalCVE-2026-15340 No auth
lwIP SMTP client - Buffer Overflow
lwIP SMTP client contains a buffer overflow caused by lack of input size validation, letting attackers potentially execute arbitrary code, exploit requires crafted input.
- 9.1 /10 CriticalCVE-2026-108269
Remote Attestation TLS Clients - Authentication Bypass
Remote Attestation TLS Clients < 0.5.0 contain a replay attack vulnerability caused by quote ReportData not being bound to the active TLS session in Rust and Go RA-TLS challenge verifiers, letting attackers relay genuine quotes to impersonate attested enclaves, exploit requires attacker to obtain enclave TLS private key.
- 9.1 /10 CriticalCVE-2026-108268
Enclave OS Virtual - Man-in-the-Middle
Enclave OS Virtual prior to tdx-v0.2.43 and tdx-gpu-v0.6.27 contains a man-in-the-middle vulnerability caused by omission of a value bound to the active TLS session in quote ReportData, letting attackers relay genuine quotes to impersonate attested enclaves, exploit requires attacker to obtain enclave TLS private key.
- 9.1 /10 CriticalCVE-2026-108267
Privasys Go - Authentication Bypass
Privasys Go prior to v0.5.1-go1.26.5 contains a replay attack vulnerability caused by challenge-mode RA-TLS certificates not binding the quote ReportData to the active TLS session, letting attackers relay genuine quotes to impersonate attested enclave connections, exploit requires attacker to obtain enclave TLS private key.
- 9.1 /10 CriticalCVE-2026-108266
Privasys rustls - Man-in-the-Middle
Privasys rustls before v0.8.1 contains a replay attack vulnerability caused by RA-TLS challenge certificates binding quote ReportData to public key and client nonce but not active TLS session, letting attackers relay genuine quotes to impersonate attested enclaves, exploit requires attacker to obtain enclave TLS private key.
- 9.1 /10 CriticalCVE-2026-108265
Enclave OS Mini - Authentication Bypass
Enclave OS Mini prior to wasm-v0.40.0 contains a replay attack vulnerability caused by omission of a value bound to the active TLS session in RA-TLS challenge certificate path, letting attackers relay genuine quotes to impersonate enclaves, exploit requires attacker to obtain enclave TLS private key.
- 9.1 /10 CriticalCVE-2026-108264 Auth required
Wizarr - Remote Code Execution & Stored XSS
Wizarr prior to 2026.9.1 contains a remote code execution caused by unsafe evaluation of Markdown in a non-sandboxed Jinja2 environment, letting authenticated users or admins execute arbitrary Python and OS commands, exploit requires authenticated user or admin importing untrusted bundles.
- 9.9 /10 CriticalCVE-2026-108263 Auth required
Astron Agent - Remote Code Execution
Astron Agent < 1.1.2 contains a remote code execution caused by default use of LocalExecutor without sandbox restrictions in dynamic code execution, letting authenticated low-privilege tenants execute code as root and bypass tenant checks.
- 9.3 /10 CriticalCVE-2026-108261 No auth
TinaCMS - Broken Access Control
TinaCMS < 3.14.0 and @tinacms/app < 2.5.14 contain a broken access control vulnerability caused by improper origin validation in admin preview routing, letting unauthenticated attackers trick signed-in editors into executing GraphQL operations with their credentials.
- 9.1 /10 CriticalCVE-2026-108109 No auth
PHPNuxBill - Authentication Bypass
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability caused by lack of attempt limits on 6-digit otp_code in customer password reset flow in system/controllers/forgot.php, letting unauthenticated attackers hijack accounts by brute-forcing OTP and reading new password from HTTP response, exploit requires knowing a customer username.
- 9.8 /10 CriticalCVE-2026-108107 No auth
PHPNuxBill - SQL Injection
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection caused by interpolation of request parameters in radius.php FreeRADIUS REST endpoint, letting attackers extract customer records and credentials via time-based blind SQL injection, exploit requires no authentication.
- 9.3 /10 CriticalCVE-2026-107935 No auth
gvisor-tap-vsock gvproxy - Path Traversal
gvisor-tap-vsock gvproxy contains a path traversal caused by improper validation of socket path in /services/forwarder/expose endpoint, letting unauthenticated attackers delete arbitrary files on the host system, exploit requires no authentication.