Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 74 of 166
- 9.3 /10 CriticalCVE-2026-107726 No auth
Hazelcast - Information Disclosure & Remote Code Execution
Hazelcast < 5.4.5, < 5.5.10, and < 5.6.1 contain an information disclosure and potential remote code execution caused by improper validation of data from malicious clients, letting attackers read arbitrary memory and crash or corrupt cluster members, exploit requires attacker to connect to the cluster.
- 9.8 /10 CriticalCVE-2026-107722
fast-jwt - Authentication Bypass
fast-jwt 6.2.0 to 6.3.0 contains an authentication bypass caused by misclassification of RSA public-key text as HMAC secret due to improper PEM header detection, letting attackers sign arbitrary HS256 claims, exploit requires attacker knowledge of public key bytes.
- 9.8 /10 CriticalCVE-2026-107704 No auth
image_optimizer Ruby gem - Command Injection
image_optimizer Ruby gem 1.3.0 through 1.9.0 contains a command injection caused by improper sanitization of image path in ImageOptimizer#identify_format, letting attackers execute OS commands with Ruby process privileges, exploit requires crafted image path with shell metacharacters.
- 9.8 /10 CriticalCVE-2026-107703 No auth
@enmaso/node-convert - Command Injection
@enmaso/node-convert <= 1.0.0 contains a command injection caused by unsanitized filepath and convertTo arguments in convert.js, letting attackers execute OS commands with Node.js process privileges, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-107700 No auth
dot-access - Command Injection
dot-access 0.0.3 through 1.0.0 contains a command injection caused by concatenation of crafted paths into a new Function body in index.js, letting remote attackers execute arbitrary OS commands, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-107699 No auth
ppt2png - Command Injection
ppt2png <= 0.0.6 contains a command injection caused by unsanitized input in file name arguments to child_process.exec() in ppt2png.js, letting attackers execute OS commands with Node.js process privileges.
- 9.1 /10 CriticalCVE-2026-107640 No auth
Integrics Enswitch - Authentication Bypass
Integrics Enswitch 3.13 through 4.4 contains an authentication bypass caused by omission of the reset parameter in /api/json/user/password/update/, letting unauthenticated attackers change account passwords and take over administrator accounts, exploit requires valid username enumeration.
- 9.1 /10 CriticalCVE-2026-107510 Auth required
Unspecified Product - Privilege Escalation
An unspecified product contains a privilege escalation caused by injection of arguments in troubleshooting commands, letting authenticated high privilege users escalate their privileges.
- 9.8 /10 CriticalCVE-2026-107459 No auth
Openfind SecuShare Pro - Command Injection
Openfind SecuShare Pro contains an OS command injection caused by improper input sanitization, letting unauthenticated remote attackers execute arbitrary OS commands on the server, exploit requires no authentication.
- 9.5 /10 CriticalCVE-2026-107406 PoC public
Citrix NetScaler ADC - Remote Code Execution & Denial of Service
Citrix NetScaler ADC and NetScaler Gateway in specified versions contain a memory overflow vulnerability caused by improper handling in SAML SP or IdP configurations, letting attackers cause remote code execution or denial of service, exploit requires SAML SP or IdP configuration.
- 9.9 /10 CriticalCVE-2026-106126 Auth required
Tenable Identity Exposure - Command Injection
Tenable Identity Exposure (SaaS) contains a command injection caused by improper input handling in Active Directory Events Listener, letting authenticated low-privileged attackers execute arbitrary commands as SYSTEM on the PDCe, exploit requires authentication.
- 9.8 /10 CriticalCVE-2026-105110 No auth
Iskratel Innbox GPON ONT - Command Injection
Iskratel Innbox GPON ONT contains a command injection caused by improper sanitization of the CLI parameter in the login.xgi CGI endpoint, letting unauthenticated remote attackers execute arbitrary commands as root.
- 9.1 /10 CriticalCVE-2026-104076 No auth
TVU Networks Receiver/Transceiver - Authentication Bypass
TVU Networks Receiver/Transceiver devices < 7.9 contain a missing authentication vulnerability caused by unprotected REST API endpoints on port 8288, letting remote unauthenticated attackers read sensitive information and modify device configuration.
- 9.8 /10 CriticalCVE-2026-104075 No auth
TVU Networks Receiver/Transceiver - Authentication Bypass
TVU Networks Receiver/Transceiver devices < 7.9 contain an authentication bypass caused by improper validation of the UserName parameter in the web management login endpoint, letting remote unauthenticated attackers gain administrative sessions, exploit requires crafted HTTP request.
- 9.8 /10 CriticalCVE-2026-103692 No auth
Frontend Dashboard WordPress - Broken Access Control
Frontend Dashboard WordPress plugin < 3.0.5 contains a broken access control vulnerability caused by lack of authorization and nonce checks on actions, letting unauthenticated attackers take over any account including administrators.