Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 73 of 166

  • 9.1 /10 Critical
    CVE-2026-19491 No auth

    IBM Security Verify Access & IBM Verify Identity Access - Authentication Bypass

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain an authentication bypass caused by improper authentication, letting remote attackers bypass authentication, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-19218 No auth

    AKIN Software MyRezzta - Broken Authentication

    AKIN Software MyRezzta 2.06.03 before 2.07.01 contains a weak password recovery mechanism caused by insecure password reset process, letting attackers exploit password recovery to gain unauthorized access, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-17609 No auth

    WordPress Super Forms – Drag & Drop Form Builder - Arbitrary Directory Deletion

    Super Forms – Drag & Drop Form Builder plugin for WordPress <= 6.3.316 contains an arbitrary directory deletion vulnerability caused by insufficient validation of JSON field declarations and a bypassable ABSPATH guard in submit_form, letting unauthenticated attackers recursively delete arbitrary directories, exploit requires 'Delete files from server after form submissions' setting enabled by admin.

  • 9.1 /10 Critical
    CVE-2026-16916 Auth required

    IBM Security Verify Access - Remote Code Execution

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain a remote code execution caused by a protection mechanism failure, letting remote authenticated attackers execute arbitrary code.

  • 9.1 /10 Critical
    CVE-2026-16823 No auth

    IBM Security Verify Access & IBM Verify Identity Access - Authentication Bypass

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain a broken authentication caused by improper authentication, letting remote attackers bypass security restrictions, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-16340 No auth

    IBM DataPower Gateway - Remote Code Execution

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contain a remote code execution caused by an out-of-bounds write in the RFC2047 encoded-word parser, letting remote attackers execute arbitrary code, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-15762 No auth

    IBM DataPower Gateway - Remote Code Execution

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contain a buffer overflow caused by an out-of-bounds write, letting remote attackers execute arbitrary code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-14992 No auth

    IBM DataPower Gateway - Buffer Overflow

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contain a buffer overflow caused by improper handling of input, letting attackers potentially execute arbitrary code, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-14991 No auth

    IBM DataPower Gateway - Buffer Overflow

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contains a buffer overflow caused by improper bounds checking, letting local users execute arbitrary code, exploit requires local access.

  • 9.3 /10 Critical
    CVE-2026-14990 No auth

    IBM DataPower Gateway - Stored XSS

    IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 contains a stored XSS caused by improper input sanitization in the Web UI, letting unauthenticated attackers execute arbitrary JavaScript and potentially disclose credentials within a trusted session.

  • 9.8 /10 Critical
    CVE-2026-14502 No auth

    IBM DataPower Gateway - Authentication Bypass

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 contain a broken authentication caused by failure to reject empty passwords during LDAP authentication, letting remote attackers obtain administrative access, exploit requires LDAP authentication.

  • 9.8 /10 Critical
    CVE-2026-14269 No auth

    IBM DataPower Gateway - Remote Code Execution

    IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.0.0 through 10.6.0.10, 10.6.1 through 10.6.6, and 11.0.0.0 through 11.0.0.2 contain a remote code execution caused by heap-based buffer overflow due to improper bounds checking, letting unauthenticated remote attackers execute arbitrary code.

  • 10.0 /10 Critical
    CVE-2026-12260 No auth

    NetBoard CRM - SQL Injection

    NetBoard CRM demo platform contains a SQL injection caused by unsanitized 'user-name' POST parameter in /module/auth/recovery.php, letting attackers extract confidential information and alter data, exploit requires crafted POST requests.

  • 9.8 /10 Critical
    CVE-2026-107780 No auth

    Dromara Skyeye - Command Injection

    Dromara Skyeye contains a command injection caused by improper sanitization of the format parameter in the unauthenticated /post/TtsController/textToSpeech endpoint, letting remote attackers execute OS commands as the Skyeye service account on Windows, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-107779 No auth

    Dromara Skyeye - Authentication Bypass

    Dromara Skyeye contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpoints annotated with @PermissionLimit(limit = false), letting unauthenticated attackers execute commands or stop/delete jobs on the executor host via crafted POST requests.