Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 72 of 125
- 9.6 /10 CriticalCVE-2026-86059 Auth required
Dokploy - Broken Access Control
Dokploy < 0.29.13 contains an information disclosure caused by missing access control checks in provider and application routes, letting organization members without Git provider access retrieve plaintext credentials, exploit requires application read access or provider identifier.
- 9.1 /10 CriticalCVE-2026-85734 No auth
LightRAG - Authentication Bypass
LightRAG < 1.5.5 contains a broken authentication caused by lack of rate limiting and account lockout on POST /login endpoint, letting network attackers perform brute force attacks to gain authenticated access, exploit requires network access.
- 10.0 /10 CriticalCVE-2026-84412 No auth
Adobe Campaign Classic - Code Injection
Adobe Campaign Classic contains a code injection vulnerability caused by improper control of code generation, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.
- 9.6 /10 CriticalCVE-2026-84388 PoC publicNo auth
Fortinet FortiPAM Chrome Extension - Information Disclosure
Fortinet FortiPAM Chrome Extension 7.4 and 8.0 contain an improper restriction of rendered UI layers vulnerability, letting remote unauthenticated attackers disclose information, exploit requires no special privileges.
- 9.9 /10 CriticalCVE-2026-83660 No auth
Adobe Campaign Classic - Privilege Escalation
Adobe Campaign Classic contains a server-side request forgery caused by improper validation of URLs, letting attackers escalate privileges, exploit requires no user interaction.
- 9.6 /10 CriticalCVE-2026-82443 Auth required
Adobe Campaign Classic - Privilege Escalation
Adobe Campaign Classic contains a server-side request forgery caused by improper validation of URLs, letting low-privileged attackers escalate privileges by accessing internal resources, exploit requires no user interaction.
- 9.9 /10 CriticalCVE-2026-82013 Auth required
Adobe Campaign Classic - Privilege Escalation
Adobe Campaign Classic contains a server-side request forgery caused by improper validation of URLs, letting low-privileged attackers escalate privileges by accessing internal resources, exploit requires no user interaction.
- 9.1 /10 CriticalCVE-2026-82011 Auth required
Adobe Campaign Classic - SQL Injection
Adobe Campaign Classic contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting low-privileged attackers bypass security to gain unauthorized read and limited write access, exploit requires no user interaction.
- 9.9 /10 CriticalCVE-2026-82010 Auth required
Adobe Campaign Classic - SQL Injection
Adobe Campaign Classic contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting low-privileged attackers execute arbitrary code, exploit requires no user interaction.
- 9.1 /10 CriticalCVE-2026-82009 Auth required
Adobe Campaign Classic - SQL Injection
Adobe Campaign Classic contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers with high privileges execute arbitrary SQL commands, exploit requires high privileges.
- 9.9 /10 CriticalCVE-2026-82008 Auth required
Adobe Campaign Classic - Remote Code Execution
Adobe Campaign Classic contains an improper input validation vulnerability that allows low-privileged attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.
- 9.6 /10 CriticalCVE-2026-82000 Auth required
Adobe Experience Manager Forms JEE - Privilege Escalation
Adobe Experience Manager Forms JEE contains a server-side request forgery caused by improper validation of URLs, letting low-privileged attackers escalate privileges by accessing internal resources, exploit requires no user interaction.
- 9.1 /10 CriticalCVE-2026-81995 Auth required
Adobe Experience Manager Forms JEE - Remote Code Execution
Adobe Experience Manager Forms JEE contains an improper input validation vulnerability that allows attackers with high privileges to execute arbitrary code in the context of the current user, exploit requires high privileges.
- 9.1 /10 CriticalCVE-2026-80156 Auth required
Lantronix SLC8000 - Path Traversal & Remote Code Execution
Lantronix SLC8000 < 9.7.0.5, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint, letting authenticated attackers write arbitrary data outside intended directories, leading to remote code execution.
- 10.0 /10 CriticalCVE-2026-80155 No auth
Lantronix SLC8000 - Authentication Bypass
Lantronix SLC8000 < 9.7.0.5, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass caused by path traversal in the web management portal upload endpoint, letting unauthenticated attackers read sensitive files and upload arbitrary files leading to remote code execution, exploit requires crafted cookie value.