Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 71 of 125
- 9.1 /10 CriticalCVE-2026-94456 No auth
Postiz - Authentication Bypass
Postiz contains a broken authentication caused by use of non-cryptographically secure Math.random() for generating security-sensitive credentials, letting unauthenticated attackers reconstruct PRNG state and compromise OAuth credentials, exploit requires access to OAuth dynamic client registration endpoint.
- 9.8 /10 CriticalCVE-2026-94127 CISA KEVPoC publicNo auth
F5 BIG-IP - Remote Code Execution
F5 BIG-IP APM with OAuth profile configured on a virtual server contains a remote code execution vulnerability caused by specific malicious traffic, letting unauthenticated attackers execute code remotely, exploit requires crafted malicious traffic.
- 10.0 /10 CriticalCVE-2026-93952 CISA KEVNo auth
VeloCloud Orchestrator - Broken Access Control
VeloCloud Orchestrator (VCO) contains a broken access control vulnerability allowing remote attackers to access privileged internal functionality, potentially compromising confidentiality, integrity, and availability, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-93616 CISA KEVPoC publicNo auth
Check Point Management Server - Unrestricted File Upload
Check Point Management Server contains a directory traversal and unrestricted file upload vulnerability allowing unauthenticated attackers to upload and execute arbitrary scripts remotely, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-93088
SGLang multimodal generation runtime - Remote Code Execution
SGLang multimodal generation runtime contains an unauthenticated arbitrary code execution caused by ZeroMQ ROUTER socket in DiffusionServer passing unvalidated data to pickle.loads(), letting unauthenticated attackers execute arbitrary code remotely, exploit requires network access to the socket.
- 9.1 /10 CriticalCVE-2026-89282 No auth
Apache HTTP Server - Broken Access Control
Apache HTTP Server Windows distribution by Apache Lounge contains an insecure installation directory permissions vulnerability caused by default directory permissions on C:\, letting authenticated users write to the directory, exploit requires authenticated user access.
- 9.9 /10 CriticalCVE-2026-89276 Auth required
Adobe Campaign Classic - Code Injection
Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting low-privileged attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.
- 10.0 /10 CriticalCVE-2026-89275 No auth
Adobe Campaign Classic - Code Injection
Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.
- 9.1 /10 CriticalCVE-2026-88624 No auth
openCode - Path Traversal
openCode v1.18.26 contains a path traversal caused by missing path validation in the Worktree.remove component, letting attackers execute arbitrary recursive directory deletion, exploit requires crafted payload.
- 9.8 /10 CriticalCVE-2026-88416 No auth
MCMS - SQL Injection
MCMS 6.1.1 through 6.2.1 contains a sql injection caused by improper sanitization in the custom model/form import feature, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-88414 No auth
MCMS - SQL Injection
MCMS 6.1.1 through 6.2.1 contains a sql injection caused by unsanitized input in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do), letting attackers execute arbitrary SQL commands remotely, exploit requires crafted request.
- 8.1 /10 CriticalCVE-2026-87902 CISA KEVPoC publicNo auth
Unknown Product - Remote Code Execution
An unauthenticated attacker can exploit a file inclusion vulnerability in get_page_template() causing inclusion of arbitrary readable local .php files outside active theme directories, potentially leading to remote code execution if server and theme conditions are met.
- 9.8 /10 CriticalCVE-2026-87121 No auth
lwIP TCP/IP Stack - Remote Code Execution
lwIP TCP/IP Stack MQTT contains an out-of-bounds write vulnerability in the MQTT component, letting attackers gain full code execution on the device, exploit requires network access.
- 9.1 /10 CriticalCVE-2026-87080 No auth
Net::IDN::Punycode - Logic Error
Net::IDN::Punycode::PP before 2.590 for Perl contains a logic error in decode_punycode caused by improper handling of truncated labels in the pure-Perl decoder, letting attackers cause inconsistent name resolution, exploit requires crafted punycode labels.
- 9.1 /10 CriticalCVE-2026-87078 No auth
Net::IDN::Punycode - Denial of Service
Net::IDN::Punycode versions >= 2.302 and < 2.590 for Perl contain a memory leak caused by improper buffer release in decode_punycode XS backend, letting attackers cause memory exhaustion by sending invalid labels, exploit requires attacker to supply invalid labels.