Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 71 of 166

  • 9.1 /10 Critical
    CVE-2026-107909 No auth

    FalkorDB - Denial of Service

    FalkorDB < 4.20.0 contains a heap-based out-of-bounds write caused by improper bounds checking in ws_read_frame and buffer_apply_mask functions, letting remote unauthenticated attackers cause denial of service and heap corruption by sending crafted WebSocket frames, exploit requires Bolt endpoint enabled.

  • 9.8 /10 Critical
    CVE-2026-107908 No auth

    FalkorDB - Out of Bounds Read/Write

    FalkorDB < 4.20.0 contains a heap-based out-of-bounds write caused by improper size validation in BoltReadHandler, letting remote unauthenticated attackers cause denial of service or execute arbitrary code via crafted Bolt RESET messages, exploit requires Bolt endpoint enabled.

  • 9.3 /10 Critical
    CVE-2026-107845 No auth

    Contao - Stored XSS

    Contao 4.0.0 to 5.3.50 and 5.7.12 contains a stored XSS caused by insufficient attribute and URL encoding in listComments() in comments-bundle/contao/dca/tl_comments.php, letting unauthenticated visitors execute scripts in backend user sessions, exploit requires backend user to open Comments module.

  • 9.3 /10 Critical
    CVE-2026-107824

    x64dbg-MCP Server - Remote Code Execution

    x64dbg-MCP Server < 1.1 contains a remote code execution vulnerability caused by unauthenticated exposure of debugger tools over HTTP and SSE, letting unauthenticated network attackers execute arbitrary commands and write files, exploit requires network access to default ports.

  • 9.4 /10 Critical
    CVE-2026-107806 PoC publicAuth required

    Nginx UI - Command Injection

    Nginx UI 2.3.8 to 2.5.0 contains a command injection caused by trusting attacker-controlled backup key material and manifest in /api/restore, letting authenticated administrators execute arbitrary commands, exploit requires active secure session.

  • 9.8 /10 Critical
    CVE-2026-105278

    openPDC - Authentication Bypass

    openPDC Docker image contains a broken authentication caused by fixed administrative credentials with no forced change on first use, letting attackers with network access gain full administrative control, exploit requires network access to management interface.

  • 9.8 /10 Critical
    CVE-2026-100730

    openPDC & openHistorian - Insecure Deserialization

    openPDC and openHistorian contain an insecure deserialization vulnerability caused by deserializing client-supplied data structures in the service console interface, letting attackers execute remote code under service account privileges, exploit requires authentication on Windows Authentication systems or none otherwise.

  • 10.0 /10 Critical
    CVE-2026-96207 No auth

    Microsoft Partner Center - Authentication Bypass

    Microsoft Partner Center contains a broken authentication caused by improper certificate validation, letting unauthorized attackers elevate privileges over a network, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-95210

    GnuTLS - Weak Cryptography

    GnuTLS 3.8.13 contains an insecure certificate validation caused by acceptance of certificates with invalid extensions, letting attackers bypass certificate validation, exploit requires attacker to present crafted certificates.

  • 9.9 /10 Critical
    CVE-2026-94510 No auth

    Microsoft Bookings - Authorization Bypass

    Microsoft Bookings contains an authorization bypass caused by user-controlled key manipulation, letting unauthorized attackers elevate privileges over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-93034

    SGLang - Remote Code Execution

    SGLang contains a remote code execution vulnerability caused by unconditionally deserializing PickleWrapper payloads via pickle.loads() in the ZMQ message decoder, letting remote attackers execute arbitrary code, exploit requires data-parallel attention enabled with non-loopback --dist-init-addr.

  • 9.8 /10 Critical
    CVE-2026-92555 PoC publicNo auth

    AKIN Software AKINSOFT WOLVOX Control Panel - Information Disclosure

    AKIN Software AKINSOFT WOLVOX Control Panel 26.02.25 before 26.02.26 contains an information disclosure vulnerability caused by insertion of sensitive information into sent data, letting attackers pull data from system resources, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-9209 No auth

    mJobTime - SQL Injection & Remote Code Execution

    mJobTime through 15.7.3.32 contains an unauthenticated SQL injection caused by execution of caller-supplied SQL in Login.aspx admin panel handlers, letting attackers achieve pre-authentication remote code execution as LocalSystem via HTTP request.

  • 9.1 /10 Critical
    CVE-2026-88647

    GnuTLS - Authentication Bypass

    GnuTLS 3.8.13 contains a hostname verification bypass caused by improper Common Name fallback mechanism handling, letting attackers eavesdrop on communications via crafted certificates, exploit requires crafted certificate.

  • 9.8 /10 Critical
    CVE-2026-88131 No auth

    Microsoft Dataverse - Insecure Deserialization

    Microsoft Dataverse contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting unauthorized attackers execute code remotely, exploit requires network access.