Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 75 of 125
- 9.8 /10 CriticalCVE-2026-47116
LTSecurity LTK3500SF - Hardcoded Credentials
LTSecurity LTK3500SF contains a hardcoded credentials vulnerability caused by reversible hashed root and guest passwords in /etc/shadow, letting attackers authenticate via Telnet or SSH to gain root access, exploit requires access to hashed passwords.
- 9.8 /10 CriticalCVE-2026-43641 No auth
Softaculous Virtualizor - OS Command Injection
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection caused by deserialization of crafted billing_data POST field in the billing module handler, letting unauthenticated remote attackers execute arbitrary commands as root, exploit requires specific parameter combinations to bypass authentication.
- 9.8 /10 CriticalCVE-2026-28324
SolarWinds Observability Self-Hosted - Remote Code Execution
SolarWinds Observability Self-Hosted contains a remote code execution vulnerability caused by insufficient integrity checks in non-default, non-secure configurations, letting unauthenticated attackers execute code remotely, exploit requires non-default insecure configuration.
- 9.8 /10 CriticalCVE-2026-25254 No auth
Unspecified Product - Remote Code Execution
An unspecified product contains a remote code execution caused by improper authorization in the SocketIO interface, letting attackers execute arbitrary code remotely, exploit requires no special conditions.
- 9.8 /10 CriticalCVE-2026-19658 PoC public
GiveWP Give Tributes - Insecure Deserialization
GiveWP Give Tributes plugin for WordPress <= 2.3.1 contains a PHP Object Injection caused by deserialization of untrusted input when 'Allow Multiple Recipients' is enabled and 'Custom Message' is disabled, letting unauthenticated attackers inject PHP objects, exploit requires specific plugin settings and presence of a POP chain in other plugins or themes.
- 9.9 /10 CriticalCVE-2026-18169 Auth required
IBM Financial Transaction Manager - Information Disclosure
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains an information disclosure vulnerability caused by improper validation of symbolic links, letting remote authenticated attackers obtain sensitive information.
- 9.8 /10 CriticalCVE-2026-18163 No auth
IBM Financial Transaction Manager (FTM) for RedHat OpenShift - Insecure Deserialization
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains an insecure deserialization vulnerability caused by improper deserialization of untrusted data, letting remote attackers execute arbitrary code, exploit requires crafted malicious input.
- 9.8 /10 CriticalCVE-2026-18162 No auth
IBM Financial Transaction Manager (FTM) for RedHat OpenShift - Remote Code Execution
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a remote code execution vulnerability caused by improper neutralization of user-controlled input within the new Function constructor, letting remote attackers execute arbitrary code, exploit requires no special conditions.
- 9.1 /10 CriticalCVE-2026-17645 Auth required
IBM Financial Transaction Manager - Privilege Escalation
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a privilege escalation caused by improper privilege management, letting remote authenticated attackers gain elevated privileges.
- 9.1 /10 CriticalCVE-2026-17635 No auth
IBM Financial Transaction Manager - Broken Access Control
IBM Financial Transaction Manager (FTM) for RedHat OpenShift contains a broken access control caused by improper configuration of HTTP method-based security constraints, letting remote attackers perform unauthorized actions, exploit requires no special privileges.
- 9.6 /10 CriticalCVE-2026-17472 Auth required
IBM Concert - Broken Access Control
IBM Concert 1.0.0 through 3.0.0 contains a broken access control caused by use of wildcards in RBAC permission definitions, letting remote authenticated attackers access or modify unauthorized resources.
- 9.9 /10 CriticalCVE-2026-16346 Auth required
IBM DataStage - Command Injection
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a command injection caused by improper neutralization of special elements in OS commands, letting remote authenticated attackers execute arbitrary commands.
- 9.8 /10 CriticalCVE-2026-13355 PoC publicNo auth
Meta Box AIO - Privilege Escalation
Meta Box AIO plugin for WordPress <= 3.11.0 contains a privilege escalation caused by lack of authorization checks in populate_via_query_string() and improper role validation in mb-user-profile component, letting unauthenticated attackers escalate to Administrator via crafted shortcode injection.
- 9.8 /10 CriticalCVE-2026-12718 No auth
Karel Electronic Industry and Trade Inc. KarelIPS - SQL Injection
Karel Electronic Industry and Trade Inc. KarelIPS <= 22092026 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2016-15059 No auth
Net::IDN::Punycode - Buffer Overflow
Net::IDN::Punycode < 2.301 for Perl contains a heap buffer overflow caused by unchecked writes past the output buffer in encode_punycode XS backend, letting attackers corrupt heap memory remotely, exploit requires crafted input string.