Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 78 of 125

  • 9.9 /10 Critical
    CVE-2026-93742 Auth required

    Totolink A3002MU - Command Injection

    Totolink A3002MU Hh-B20211125.1046 contains a command injection caused by manipulation of the "localPin" argument in /boafrm/formWsc, letting remote attackers execute arbitrary commands, exploit requires no special privileges.

  • 10.0 /10 Critical
    CVE-2026-93741 No auth

    Totolink A3002MU - Buffer Overflow

    Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "submit-url" argument in /boafrm/formWlWds, letting remote attackers cause memory corruption or execute code, exploit requires crafted request.

  • 9.1 /10 Critical
    CVE-2026-92229 CISA KEVPoC publicNo auth

    Forminator Forms – Contact Form, Payment Form & Custom Form Builder - Stored XSS

    Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin <= 1.57.2 contains a stored XSS caused by improper validation before running do_shortcode, letting unauthenticated attackers execute arbitrary shortcodes.

  • 9.1 /10 Critical
    CVE-2026-89274 PoC publicNo auth

    WP Recipe Maker - Server-Side Request Forgery

    WP Recipe Maker plugin for WordPress <= 10.8.1 contains an arbitrary shortcode execution caused by unsanitized recursive do_shortcode() calls on recipe metadata, letting unauthenticated attackers execute shortcodes server-side, exploit requires approved comment with shortcode.

  • 9.8 /10 Critical
    CVE-2026-86591 No auth

    Botiga Pro WordPress - Broken Access Control

    Botiga Pro WordPress plugin < 1.6.5 contains broken access control caused by lack of authorization checks on a REST route, letting unauthenticated attackers update options, execute scripts, and trash posts, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-84434 CISA KEVPoC publicNo auth

    Gravity Forms WordPress Plugin - Unrestricted File Upload

    Gravity Forms WordPress plugin <= 3.1.0.4 contains an arbitrary file upload vulnerability caused by bypassing extension validation in hidden file upload fields, letting unauthenticated attackers upload executable files and achieve remote code execution, exploit requires a form with a hidden File Upload field.

  • 9.8 /10 Critical
    CVE-2026-78030 No auth

    Perl DBI - Remote Code Execution

    Perl DBI versions before 1.653 with DBD::DBM contain a code injection vulnerability caused by unvalidated dbm_type and dbm_mldbm attributes allowing arbitrary module loading, letting attackers execute arbitrary code remotely, exploit requires attacker-controlled input in connection attributes.

  • 9.8 /10 Critical
    CVE-2026-93839 No auth

    LightLLM - Authentication Bypass

    LightLLM through 1.2.0 contains an authentication bypass caused by lack of peer address validation in /pd_register WebSocket endpoint, letting unauthenticated attackers register arbitrary nodes and cause information disclosure and denial of service.

  • 9.1 /10 Critical
    CVE-2026-93765 No auth

    Mongoid - Unsafe Reflection

    Mongoid contains an unsafe reflection vulnerability in the document persistence layer caused by unsafe key handling from unauthenticated input, letting attackers cause unintended method invocation and data removal, exploit requires unauthenticated input.

  • 9.8 /10 Critical
    CVE-2026-93762 No auth

    Mongoid - Unsafe Reflection

    Mongoid contains an unsafe reflection weakness in the query path for embedded documents, letting unauthenticated attackers disclose stored data and delete records, exploit requires passing external field names to in-memory query methods.

  • 10.0 /10 Critical
    CVE-2026-93740 No auth

    Totolink A3002MU - Buffer Overflow

    Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "submit-url" argument in /boafrm/formWlEncrypt, letting remote attackers cause memory corruption, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-93739 Auth required

    Totolink A3002MU - Buffer Overflow

    Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "submit-url" argument in /boafrm/formWlAc, letting remote attackers cause memory corruption, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-93738 Auth required

    Totolink A3002MU - Buffer Overflow

    Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "webpage" argument in /boafrm/formSchedule, letting remote attackers cause memory corruption, exploit requires no special privileges.

  • 10.0 /10 Critical
    CVE-2026-93606

    vm2 - Sandbox Escape

    vm2 (npm) <= 3.12.0 contains a sandbox escape caused by improper host Promise rejection sanitization in VM and NodeVM, letting sandboxed code execute arbitrary code on the host, exploit requires exposed host API returning host-realm Promise.

  • 10.0 /10 Critical
    CVE-2026-93605 No auth

    vm2 NodeVM - Remote Code Execution

    vm2 NodeVM < 3.12.1 contains a sandbox escape vulnerability caused by omission of child_process from DANGEROUS_BUILTINS denylist, letting attackers execute arbitrary commands on the host when configured with builtin:['*'] or explicit child_process allowance.