Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 73 of 125

  • 9.6 /10 Critical
    CVE-2026-80154 No auth

    Lantronix - Authentication Bypass

    Lantronix SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 firmware contain an authentication bypass caused by predictable session token generation and crafted URI exploiting file extension handling in web management portal, letting unauthenticated attackers bypass source IP and User-Agent validation to gain elevated privileges.

  • 9.1 /10 Critical
    CVE-2026-80152 Auth required

    Lantronix SLC8000 & EMG8500/EMG7500 - Command Injection

    Lantronix SLC8000 < 9.7.0.3, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain a command injection caused by unsanitized input in the set script schedule command, letting authenticated attackers with services permission execute arbitrary shell commands as root.

  • 9.1 /10 Critical
    CVE-2026-80151 Auth required

    Lantronix SLC8000 - Command Injection

    Lantronix SLC8000 < 9.7.0.3, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain a command injection caused by unsanitized input in the set nfs download command, letting authenticated attackers with services permission execute arbitrary shell commands as root.

  • 9.9 /10 Critical
    CVE-2026-80147 Auth required

    Lantronix SLC8000 - Buffer Overflow

    Lantronix SLC8000 < 9.7.0.2, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow caused by an undocumented mfc eeprom write command copying unbounded input into a stack buffer, letting authenticated attackers execute arbitrary code via terminal or CLI interface.

  • 9.9 /10 Critical
    CVE-2026-80146 Auth required

    Lantronix SLC8000 - Remote Code Execution

    Lantronix SLC8000 < 9.7.0.2, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain a stack-based buffer overflow caused by an undocumented mfc eeprom read command copying unbounded input to a stack buffer, letting authenticated attackers execute arbitrary code via system() call.

  • 9.1 /10 Critical
    CVE-2026-80145 Auth required

    Lantronix SLC8000 - Command Injection

    Lantronix SLC8000 < 9.7.0.2, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain a command injection caused by unsanitized input in the set cifs password command, letting authenticated attackers with services permission execute arbitrary shell commands as root.

  • 9.9 /10 Critical
    CVE-2026-80144 Auth required

    Lantronix SLC8000 - Command Injection

    Lantronix SLC8000 < 9.7.0.2, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain a command injection caused by unsanitized input in an undocumented mfc eeprom write command, letting authenticated attackers execute arbitrary shell commands as root, exploit requires authentication.

  • 9.9 /10 Critical
    CVE-2026-80143 Auth required

    Lantronix SLC8000 & EMG8500/EMG7500 - Command Injection

    Lantronix SLC8000 < 9.7.0.2, EMG8500/EMG7500 < 9.7.0.1, and all versions of SLB882/SLCx-03/SLCx-02 contain a command injection caused by unsanitized input in an undocumented mfc eeprom read command, letting authenticated attackers execute arbitrary shell commands as root, exploit requires authentication.

  • 9.8 /10 Critical
    CVE-2026-79313 No auth

    webpy web.py - Authentication Bypass

    webpy web.py 0.76 contains an insufficient session expiration vulnerability caused by reliance on periodic cleanup instead of last-access time checks, letting attackers replay expired sessions to access protected resources.

  • 9.8 /10 Critical
    CVE-2026-77987

    GitHub Enterprise Server - Server-Side Request Forgery

    GitHub Enterprise Server 3.17 through 3.22 contains a server-side request forgery caused by improper port validation in the notebook viewer, letting attackers extract instance secrets and achieve remote code execution, exploit requires network access and authentication depending on private mode.

  • 9.1 /10 Critical
    CVE-2026-77254 PoC public

    MCP Atlassian - Broken Access Control

    MCP Atlassian < 0.22.0 contains a broken access control vulnerability caused by allowing requests without per-user identity to use global Jira or Confluence credentials, letting network attackers perform operations with operator permissions, exploit requires lack of independent authentication boundary.

  • 10.0 /10 Critical
    CVE-2026-77244 PoC public

    MCP Atlassian - Broken Access Control

    MCP Atlassian < 0.22.0 contains a broken access control vulnerability caused by accepting requests without verified user identity in HTTP transport, letting network clients invoke Atlassian tools as the operator, exploit requires network access to MCP endpoint.

  • 9.8 /10 Critical
    CVE-2026-76709 No auth

    Analytics and Location Engine - Broken Access Control

    Analytics and Location Engine contains a broken access control vulnerability in the internal administrative component, letting unauthenticated remote attackers gain unauthorized write access to the file system with elevated privileges, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-76708 No auth

    Analytics and Location Engine - Authentication Bypass

    Analytics and Location Engine contains a hardcoded credentials vulnerability caused by use of default credentials for administrative and system accounts, letting unauthenticated remote attackers gain unauthorized access, exploit requires no special privileges.

  • 10.0 /10 Critical
    CVE-2026-75745 No auth

    Adobe Experience Manager Forms JEE - Authentication Bypass

    Adobe Experience Manager Forms JEE contains an incorrect authorization vulnerability that allows attackers to execute arbitrary code in the context of the current user, exploit requires no user interaction.