Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 84 of 125

  • 9.0 /10 Critical
    CVE-2026-88795 No auth

    wpShopGermany IT-RECHT KANZLEI WordPress plugin - Remote Code Execution

    wpShopGermany IT-RECHT KANZLEI WordPress plugin < 2.4 contains a remote code execution caused by insecure API authentication token generation derived from requester-controlled data, letting unauthenticated attackers write arbitrary files remotely.

  • 9.8 /10 Critical
    CVE-2026-87796 PoC publicNo auth

    Multi Uploader for Gravity Forms - Unrestricted File Upload

    Multi Uploader for Gravity Forms WordPress plugin <= 1.1.9 contains an arbitrary file upload vulnerability caused by insufficient file type validation in move_file function during chunked upload handling, letting unauthenticated attackers upload arbitrary files, exploit requires no authentication.

  • 9.6 /10 Critical
    CVE-2026-87701 Auth required

    Azure Cosmos DB - Privilege Escalation

    Azure Cosmos DB contains a privilege escalation caused by improper neutralization of special elements in output used by a downstream component, letting authorized attackers elevate privileges over a network, exploit requires attacker authorization.

  • 9.8 /10 Critical
    CVE-2026-86863 No auth

    pgAdmin 4 - Authentication Bypass

    pgAdmin 4 from 6.2 before 9.18 contains an authentication bypass caused by improper trust of HTTP headers in WebserverAuthentication, letting remote attackers authenticate as any user without credentials, exploit requires 'webserver' enabled in AUTHENTICATION_SOURCES.

  • 9.8 /10 Critical
    CVE-2026-86710 No auth

    Login with QR WordPress plugin - Authentication Bypass

    Login with QR WordPress plugin through 1.0.0 contains an authentication bypass caused by improper verification of login codes, letting unauthenticated attackers log in as any user including administrators, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-86709 No auth

    Pressengine WordPress - Authentication Bypass

    Pressengine WordPress plugin through 1.0 contains an authentication bypass caused by the login handler issuing a session even when authentication fails, letting unauthenticated attackers log in as any user including administrators.

  • 9.8 /10 Critical
    CVE-2026-86707 No auth

    Private Feed WordPress - Authentication Bypass

    Private Feed WordPress plugin through 0.1 contains an authentication bypass caused by improper verification of feed request keys, letting unauthenticated attackers log in as any user including administrators, exploit requires no special privileges.

  • 10.0 /10 Critical
    CVE-2026-85889 No auth

    Azure AI Foundry - Broken Access Control

    Azure AI Foundry contains a broken access control caused by missing authentication for a critical function, letting unauthorized attackers elevate privileges over a network, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-85885 Auth required

    M365 Copilot - Privilege Escalation

    M365 Copilot contains a command injection caused by improper neutralization of special elements in commands, letting authorized attackers elevate privileges over a network, exploit requires attacker authorization.

  • 10.0 /10 Critical
    CVE-2026-83944 No auth

    Azure Logic Apps - Broken Access Control

    Azure Logic Apps contains an improper access control vulnerability allowing unauthorized attackers to elevate privileges over a network, exploit requires network access.

  • 9.0 /10 Critical
    CVE-2026-77903 No auth

    Microsoft Dataverse - Authentication Bypass

    Microsoft Dataverse contains an authentication bypass caused by spoofing, letting unauthorized attackers elevate privileges over a network, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-73639 No auth

    Imager::File::PNG - Buffer Overflow

    Imager::File::PNG < 1.004 for Perl contains a buffer overflow caused by incorrect row buffer sizing when reading PNGs with tRNS transparency chunk in read_direct8, letting attackers cause heap corruption and crash the process, exploit requires crafted PNG input.

  • 10.0 /10 Critical
    CVE-2026-70200 No auth

    Azure Logic Apps - Path Traversal

    Azure Logic Apps contains a path traversal caused by improper limitation of a pathname to a restricted directory, letting unauthorized attackers elevate privileges over a network, exploit requires network access.

  • 9.3 /10 Critical
    CVE-2026-70009 No auth

    Azure Arc - Path Traversal

    Azure Arc contains a path traversal caused by improper limitation of a pathname to a restricted directory, letting unauthorized attackers elevate privileges over a network, exploit requires network access.

  • 10.0 /10 Critical
    CVE-2026-69865 No auth

    Microsoft Container Registry - Authorization Bypass

    Microsoft Container Registry contains an authorization bypass caused by user-controlled key manipulation, letting unauthorized attackers elevate privileges over a network, exploit requires network access.