Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 8 of 166

  • 10.0 /10 Critical
    CVE-2026-84295 No auth

    Progress Software WS_FTP Server - Authentication Bypass

    Progress Software WS_FTP Server < 2024.0.6 and < 2025.0.3 on Windows contains an authentication bypass caused by improper authentication, letting unauthenticated remote attackers access sensitive information including administrative credentials, exploit requires network access.

  • 9.4 /10 Critical
    CVE-2026-66088 Auth required

    openEQUELLA - Command Injection

    openEQUELLA < 2026.1 contains a command injection caused by unvalidated system.execute() function in the scripting engine, letting users with script creation/edit privileges execute arbitrary OS commands with service account privileges.

  • 9.8 /10 Critical
    CVE-2026-62131 No auth

    Zoho Flow - Insecure Deserialization

    Zoho Flow <= 2.14.5 contains an insecure deserialization vulnerability caused by unauthenticated PHP object injection, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-62018 No auth

    Gunslinger - PHP Object Injection

    Gunslinger <= 1.11 contains an unauthenticated PHP Object Injection caused by unsafe deserialization, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-62017 No auth

    Good Homes - PHP Object Injection

    Good Homes <= 1.3.13 contains a PHP Object Injection caused by unsafe unserialization of user input, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-62016 No auth

    Gamic - PHP Object Injection

    Gamic <= 1.19 contains an unauthenticated PHP Object Injection caused by improper handling of user input, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-62015 No auth

    Gamezone - Remote Code Execution

    Gamezone <= 1.1.11 contains a PHP Object Injection caused by unsafe unserialization, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-62014 No auth

    EmojiNation - Insecure Deserialization

    EmojiNation <= 1.0.12 contains an insecure deserialization vulnerability caused by unauthenticated PHP object injection, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-62013 No auth

    Edge Decor - PHP Object Injection

    Edge Decor <= 2.9 contains an unauthenticated PHP Object Injection caused by improper handling of user input, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-62012 No auth

    Coinpress - Insecure Deserialization

    Coinpress <= 1.0.15 contains an insecure deserialization vulnerability caused by unauthenticated PHP object injection, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-62011 No auth

    Bonbon - Insecure Deserialization

    Bonbon <= 1.11 contains an insecure deserialization vulnerability caused by unauthenticated PHP object injection, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-62010 No auth

    Avventure - Insecure Deserialization

    Avventure <= 1.1.12 contains an insecure deserialization vulnerability caused by unauthenticated PHP object injection, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-62009 No auth

    Filmax - PHP Object Injection

    Filmax <= 1.1.11 contains an unauthenticated PHP Object Injection caused by improper handling of serialized objects, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-62008 No auth

    Orpheus - Insecure Deserialization

    Orpheus <= 1.8 contains an insecure deserialization vulnerability caused by unauthenticated PHP object injection, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-62006 No auth

    Nuts - PHP Object Injection

    Nuts <= 1.12 contains an unauthenticated PHP Object Injection caused by unsafe deserialization, letting remote attackers execute arbitrary code, exploit requires no authentication.