Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 76 of 125
- 9.8 /10 CriticalCVE-2026-94301 No auth
Apache MINA - Broken Access Control
Apache MINA 2.0.29, 2.1.13, and later 2.0.x and 2.1.x versions contain an acceptMatchers filter bypass caused by missing resolveProxyClass() override, letting attackers bypass allow-list filters, exploit requires crafted proxy classes.
- 9.9 /10 CriticalCVE-2026-94101 Auth required
Netcore NBR200V2 - Buffer Overflow
Netcore NBR200V2 1.3.241127.071246 contains a buffer overflow caused by manipulation of the "wan_num" argument in vlan_load_form_uci function of /usr/bin/routerd, letting remote attackers cause memory corruption, exploit requires no special privileges.
- 9.9 /10 CriticalCVE-2026-94100 Auth required
Netcore NBR200V2 - Buffer Overflow
Netcore NBR200V2 1.3.241127.071246 contains a buffer overflow caused by manipulation of the argument vlan_wanX.ports in wan_config_set_vlan function of /usr/bin/routerd, letting remote attackers cause memory corruption, exploit requires remote access.
- 9.9 /10 CriticalCVE-2026-94099 Auth required
Netcore NBR200V2 - Command Injection
Netcore NBR200V2 1.3.241127.071246 contains a command injection caused by manipulation of the QUERY_STRING argument in restore.cgi Backup Restore component, letting remote attackers execute arbitrary commands, exploit requires crafted request.
- 9.1 /10 CriticalCVE-2026-94098 Auth required
Netcore NBR200V2 - Command Injection
Netcore NBR200V2 1.3.241127.071246 contains a command injection caused by manipulation of the QUERY_STRING argument in /www/cgi-bin/upgrade Firmware Upgrade CGI Endpoint, letting remote attackers execute arbitrary commands, exploit requires no special privileges.
- 10.0 /10 CriticalCVE-2026-94097 No auth
Netcore NBR200V2 - Command Injection
Netcore NBR200V2 1.3.241127.071246 contains a command injection caused by manipulation of the argument param/key/val in /www/cgi-bin/network_tools CGI Diagnostic Endpoint, letting remote attackers execute arbitrary commands, exploit requires no special privileges.
- 9.9 /10 CriticalCVE-2026-94096 Auth required
Netcore NBR200V2 - Command Injection
Netcore NBR200V2 1.3.241127.071246 contains a command injection caused by manipulation of the "ipv4" argument in /usr/bin/network_tools LAN IP Configuration Handler, letting remote attackers execute arbitrary commands, exploit requires no special privileges.
- 9.9 /10 CriticalCVE-2026-94095 PoC publicAuth required
Netcore NBR200V2 - Command Injection
Netcore NBR200V2 1.3.241127.071246 contains a command injection caused by manipulation of the "url" argument in /usr/bin/network_tools Traceroute Diagnostic Feature, letting remote attackers execute arbitrary commands, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-93012 No auth
Email::Sender::Transport::Sendmail - Command Injection
Email::Sender::Transport::Sendmail < 2.602 for Perl contains a command injection caused by unsafe shell command construction on Windows in _sendmail_pipe, letting attackers execute arbitrary commands via crafted email headers, exploit requires attacker control of email headers.
- 9.8 /10 CriticalCVE-2026-88405 No auth
Univer - Remote Code Execution
Univer v1.0.0-alpha.2 contains a remote code execution caused by crafted payload in RemoteRegisterFunctionService function, letting remote attackers execute arbitrary code, exploit requires crafted payload.
- 9.8 /10 CriticalCVE-2026-88404 No auth
Univer - Remote Code Execution
Univer v1.0.0-alpha.2 contains a remote code execution caused by crafted payload in UniscriptExecutionService.execute() function, letting remote attackers execute arbitrary code, exploit requires crafted payload.
- 9.8 /10 CriticalCVE-2026-88402 No auth
nocobase - SQL Injection
nocobase v2.1.21 contains a sql injection caused by improper sanitization in the checkSQL function, letting attackers access sensitive database information via crafted SQL statements, exploit requires no special privileges.
- 9.1 /10 CriticalCVE-2026-86473 No auth
Apache Airflow - Authentication Bypass
Apache Airflow Core API contains a broken authentication caused by logout endpoint revoking only session tokens from cookies but not bearer tokens, letting attackers with stolen bearer tokens maintain access after victim logout, exploit requires attacker to already possess a valid token.
- 9.8 /10 CriticalCVE-2026-85751 No auth
Mailu - Authentication Bypass
Mailu 2.0 to 2024.06.55 and helm-charts prior to 2.7.3 contain an authentication bypass caused by trusting client-controlled X-Forwarded-By header when REAL_IP_HEADER is unset, letting unauthenticated remote attackers bypass proxy authentication, exploit requires PROXY_AUTH_WHITELIST configured and REAL_IP_HEADER unset.
- 9.8 /10 CriticalCVE-2026-82187 No auth
Web to Print Online Designer WordPress - Unrestricted File Upload
Web to Print Online Designer WordPress plugin < 2.15.0 contains an unrestricted file upload vulnerability caused by lack of validation on file type and extension, letting unauthenticated attackers upload and execute arbitrary code remotely, exploit requires no authentication.