Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 84 of 166
- 10.0 /10 CriticalCVE-2026-105857 No auth
Payload @payloadcms/plugin-form-builder - Remote Code Execution
Payload @payloadcms/plugin-form-builder < 3.90.0 and < 4.0.0-canary.34 contains a remote code execution caused by crafted form submissions, letting attackers execute code remotely on the server, exploit requires crafted form submission.
- 9.6 /10 CriticalCVE-2026-105848 Auth required
Payload @payloadcms/plugin-stripe - Broken Access Control
Payload @payloadcms/plugin-stripe < 3.90.0 and canary < 4.0.0-canary.34 contains a broken access control vulnerability caused by insufficient authorization on the Stripe REST proxy, letting authenticated users perform unintended Stripe operations, exploit requires user authentication.
- 9.8 /10 CriticalCVE-2026-105845 No auth
Payload - SQL Injection
Payload 3.0.0 < 3.88.0 and canary < 4.0.0-canary.27 contain a SQL injection caused by untrusted user queries through dynamic filters or joins in SQLite and Postgres adapters, letting attackers execute arbitrary SQL commands remotely, exploit requires ability to query readable collections.
- 9.3 /10 CriticalCVE-2026-105844 PoC publicNo auth
Payload CMS - Remote Code Execution
Payload CMS 3.0.0 < 3.88.0 and canary < 4.0.0-canary.27 contains a remote code execution caused by unauthenticated submission of prototype-sensitive field paths in @payloadcms/plugin-import-export, letting unauthenticated attackers execute code remotely, exploit requires the import-export plugin enabled.
- 9.0 /10 CriticalCVE-2026-105812 Auth required
Amazon Bedrock AgentCore Starter Toolkit - Remote Code Execution
Amazon Bedrock AgentCore Starter Toolkit < 0.3.14 contains a remote code execution caused by improper control of code generation in agent import functionality, letting authenticated same-account actors execute arbitrary code via crafted configuration values, exploit requires authentication.
- 9.1 /10 CriticalCVE-2026-105794 No auth
MsQuic - Man-in-the-Middle
MsQuic < 2.4.20, < 2.5.11, and < 2.6.1 contain a man-in-the-middle vulnerability caused by improper server certificate hostname verification in OpenSSL and QuicTLS backends, letting on-path attackers spoof servers, exploit requires network position.
- 9.1 /10 CriticalCVE-2026-105793 Auth required
Microsoft UFO - Command Injection
Microsoft UFO < 3.0.9 contains a command injection caused by unsanitized key_code parameter in press_key tool, letting authenticated Mobile MCP callers execute commands as Android shell user on authorized devices, exploit requires valid API key, adb, and authorized device.
- 9.9 /10 CriticalCVE-2026-105778 Auth required
Tenda AC5 - Buffer Overflow
Tenda AC5 02.03.01.111_multi contains a stack-based buffer overflow caused by manipulation of the "wifiPwd" argument in /goform/setWifi Wifi Handler, letting remote attackers cause memory corruption, exploit requires no special privileges.
- 9.6 /10 CriticalCVE-2026-105763 Auth required
Twenty - Information Disclosure
Twenty 1.20.10 to 2.7.0 contains an information disclosure caused by unprotected /metadata GraphQL connectedAccounts query exposing plaintext passwords, letting workspace members access other members' external-service credentials, exploit requires membership in the workspace.
- 10.0 /10 CriticalCVE-2026-105484 No auth
TOTOLINK X6000R - Command Injection
TOTOLINK X6000R 9.4.0cu.652_B20230116 contains a command injection caused by manipulation of the "file_name" argument in firmware_check function of /cgi-bin/cstecgi.cgi UploadFirmwareFile Handler, letting remote attackers execute arbitrary OS commands.
- 9.8 /10 CriticalCVE-2026-104070 No auth
SPIP Crayons - Broken Access Control
Crayons plugin for SPIP < 3.5.0 contains a missing authorization vulnerability caused by omission of the secu_ anti-forgery parameter in crayons_store.php, letting unauthenticated attackers modify editable object fields and execute arbitrary PHP code, exploit requires no authentication.
- 9.1 /10 CriticalCVE-2026-103059
Gitea - Authentication Bypass
Gitea contains a broken authentication caused by case-insensitive SQL LIKE comparison of SSH public keys, letting attackers with derived private keys authenticate as other users, exploit requires SSH server enabled.
- 9.6 /10 CriticalCVE-2026-102322 No auth
Google Chrome - Broken Access Control
Google Chrome < 155.0.8059.39 contains an incorrect authorization vulnerability in SiteIsolation, letting remote attackers execute arbitrary code via crafted HTML pages, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-102159 No auth
CV-CUE - Broken Access Control
CV-CUE backend contains an access control flaw allowing unauthenticated network attackers to access internal service functionality, potentially exposing sensitive location information or disrupting services, exploit requires network access.
- 9.1 /10 CriticalCVE-2026-101155 Auth required
Software Management Studio - Broken Access Control
Software Management Studio contains a broken access control vulnerability caused by improper validation of file operations in the Software Repository, letting authenticated attackers with specific permissions read or write files beyond intended scope, exploit requires specific permissions.