Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 77 of 125
- 9.9 /10 CriticalCVE-2026-79920 Auth required
Ajenti - Command Injection
Ajenti < 2.2.16 contains a command injection caused by unvalidated plugin package name and version in /api/core/tasks/start, letting authenticated users execute code as root, exploit requires user authentication.
- 9.1 /10 CriticalCVE-2026-79916 Auth required
MaxKB - Command Injection
MaxKB < 2.10.5-lts contains a command injection caused by unsafe parsing of control characters in AWS credentials fields, letting authenticated workspace members execute commands as root, exploit requires authentication.
- 9.8 /10 CriticalCVE-2026-78847 No auth
gray-matter - Remote Code Execution
gray-matter All versions contains a remote code execution caused by use of eval() in lib/engines.js to parse front matter with language set to js/javascript, letting attackers execute arbitrary code remotely, exploit requires crafted front matter input.
- 10.0 /10 CriticalCVE-2026-77521 PoC publicNo auth
MaxKB - Command Injection
MaxKB prior to 2.10.5-lts contains a command injection caused by exposed execute shell tool in SandboxShellBackend without proper restrictions, letting untrusted content cause command execution without human approval, exploit requires untrusted input.
- 9.8 /10 CriticalCVE-2026-67827 No auth
ZLMediaKit - Broken Access Control
ZLMediaKit contains an incorrect access control vulnerability caused by unauthenticated access to the setServerConfig API endpoint, letting remote attackers achieve remote code execution by overwriting ffmpeg.snap with shell commands, exploit requires no authentication.
- 9.3 /10 CriticalCVE-2026-58491 No auth
Warpgate - Stored XSS & Open Redirect
Warpgate < 0.25.5 contains a stored XSS and open redirect caused by unescaped attacker-controlled 'next' parameter in SSO endpoints, letting attackers execute scripts in authenticated sessions and redirect users, exploit requires victim interaction.
- 9.1 /10 CriticalCVE-2026-36469 No auth
CuteNews - Server-Side Request Forgery
CuteNews 2.1.2 contains a server-side request forgery caused by improper validation in core/modules/media.php upload_from_inet, letting attackers make arbitrary requests from the server, exploit requires access to the Upload by URL feature.
- 9.1 /10 CriticalCVE-2025-12999
Open VSX - Open Redirect & Cache Poisoning
Open VSX contains a cache poisoning vulnerability caused by unvalidated use of X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Prefix headers in URL construction, letting unauthenticated remote attackers inject malicious URLs into cached metadata, exploit requires a proxy that relays client headers without overwriting.
- 10.0 /10 CriticalCVE-2026-94089 No auth
D-Link DIR-868L - Buffer Overflow
D-Link DIR-868L 2.01b05 contains a stack-based buffer overflow caused by improper handling of the id/password argument in /webfa_authentication.cgi Authentication Handler, letting remote attackers execute code, exploit requires crafted input.
- 9.4 /10 CriticalCVE-2026-94084
Suricata - Use After Free
Suricata < 8.0.7 contains a use-after-free vulnerability caused by improper handling of Http2ThreadMultiBuf during inspection of transactions by rules using http.response_header with and without a transform, letting attackers cause memory corruption or denial of service, exploit requires crafted rules triggering the condition.
- 9.4 /10 CriticalCVE-2026-94083 No auth
Suricata - Denial of Service
Suricata < 8.0.7 contains a type confusion caused by improper cleanup of HTTP2 state during DoH2 requests with HTTP1 to HTTP2 upgrade, letting attackers cause denial of service, exploit requires app-layer.protocols.doh2 enabled.
- 10.0 /10 CriticalCVE-2026-94003 No auth
Comfast CF-N1-S - Buffer Overflow
Comfast CF-N1-S 2.6.0.1 contains a stack-based buffer overflow caused by manipulation of input in get_css_path_from_uri function in /cgi-bin/mbox-config Web Management Interface, letting remote attackers execute arbitrary code, exploit requires crafted request.
- 9.1 /10 CriticalCVE-2026-93958 PoC publicAuth required
D-Link R95 - Command Injection
D-Link R95 BE9500_1.00.16 contains a command injection caused by manipulation of the NTPServer argument in /bin/ssi DHMAPI component, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-90817 CISA KEVPoC publicNo auth
REDCap - Remote Code Execution
REDCap >= 13.3.0 contains a remote code execution caused by manipulation of HTTP requests and crafted file-path/stream parameters in survey passthrough routing and Data Import processing, letting unauthenticated attackers remotely execute code, exploit requires knowledge of a valid public survey hash.
- 9.9 /10 CriticalCVE-2026-93985 Auth required
OpenPanel js-runtime - Remote Code Execution
OpenPanel js-runtime contains a sandbox escape vulnerability caused by failure to block computed member access to constructor chains in the JavaScript webhook template validator, letting attackers with project write access execute arbitrary code in the worker process.