Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 85 of 125

  • 10.0 /10 Critical
    CVE-2026-69399

    CVE-2026-69399

    Azure Arc Elevation of Privilege Vulnerability

  • 9.1 /10 Critical
    CVE-2026-63472 No auth

    Vendure - Broken Access Control

    Vendure < 3.7.0 contains a broken access control vulnerability caused by ExternalAuthenticationService.createCustomerAndUser attaching unverified external authentication methods to existing users, letting attackers bind identities to victim accounts and access personal data, exploit requires custom external authentication strategy that does not verify email ownership.

  • 9.8 /10 Critical
    CVE-2026-62108 No auth

    Headless Single Sign On - Authentication Bypass

    Headless Single Sign On <= 1.7.0 contains a broken authentication vulnerability caused by unauthenticated access, letting attackers bypass authentication, exploit requires no special privileges.

  • 10.0 /10 Critical
    CVE-2026-62104 No auth

    Migratico Lite - Remote Code Execution

    Migratico Lite <= 2.6.8 contains a remote code execution caused by unauthenticated access, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-62101 No auth

    EduAdmin Booking - Authentication Bypass

    EduAdmin Booking <= 5.4.2 contains a broken authentication vulnerability caused by unauthenticated access, letting attackers bypass authentication, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-54767 No auth

    WeGIA - Command Injection

    WeGIA < 3.8.5 contains a command injection caused by unauthenticated access to a GET endpoint with a hardcoded key allowing TRUNCATE TABLE operations, letting remote attackers permanently delete database records, exploit requires knowledge of the hardcoded key and database truncation privileges.

  • 9.6 /10 Critical
    CVE-2026-54752 No auth

    NetBox Device Type Library - Remote Code Execution

    NetBox Device Type Library contains an insecure deserialization vulnerability caused by untrusted pickle file loading in test harness, letting unauthenticated contributors execute arbitrary code during test runs, exploit requires crafted pickle files and configuration modification.

  • 10.0 /10 Critical
    CVE-2026-54734 No auth

    Prebid Server Java - Server Side Request Forgery

    Prebid Server Java < 3.43.0 contains a server side request forgery caused by improper validation of user-supplied parameters in outbound request URLs, letting attackers cause the server to send requests to unintended destinations, exploit requires attacker to supply bid-request parameters.

  • 9.1 /10 Critical
    CVE-2026-54670 No auth

    WeGIA - Broken Access Control & Path Traversal

    WeGIA < 3.8.5 contains a broken access control and path traversal caused by lack of controller and method allowlist and improper include path handling in contribution request dispatcher, letting unauthenticated remote attackers disclose sensitive data and invoke financial operations, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-54627 No auth

    SAIL - Buffer Overflow

    SAIL <= 0.9.10 contains a heap buffer overflow caused by a mode/depth mismatch in PSD Bitmap color mode handling, letting attackers trigger memory corruption or potential code execution by loading crafted PSD files, exploit requires crafted PSD input.

  • 9.8 /10 Critical
    CVE-2026-54626 No auth

    SAIL - Buffer Overflow

    SAIL <= 0.9.10 contains a heap buffer overflow caused by inconsistent pixel size calculation in TGA_INDEXED_RLE image loading, letting attackers cause heap corruption or code execution via crafted TGA files, exploit requires crafted file input.

  • 9.4 /10 Critical
    CVE-2026-54618

    Obsidian Web MCP - Authentication Bypass

    Obsidian Web MCP < 0.2.0 contains an authentication bypass caused by missing login, consent, and session checks in /oauth/authorize and /oauth/token endpoints, letting unauthenticated remote attackers fully access vault operations, exploit requires network access to the tunnel deployment.

  • 9.8 /10 Critical
    CVE-2026-54617 No auth

    GravitLauncher - Path Traversal

    GravitLauncher < 5.7.12 contains a path traversal caused by improper request-target handling in FileServerHandler, letting unauthenticated remote attackers read arbitrary files, exploit requires direct access to LaunchServer on port 9274.

  • 9.8 /10 Critical
    CVE-2026-54460

    OpenReception Appointment Booking Software - Authentication Bypass

    OpenReception appointment booking software < 1.1.1 contains an authentication bypass caused by missing WebAuthnService.verifyRegistration and improper passkey binding, letting unauthenticated attackers create staff sessions and access tenant data, exploit requires knowledge of public tenant ID and target staff email.

  • 9.6 /10 Critical
    CVE-2026-54053 Auth required

    Many Notes - Path Traversal & Stored XSS

    Many Notes < 0.16.0 contains a path traversal and stored XSS caused by improper validation of ZIP archive filenames in vault import, letting authenticated users write arbitrary files and execute scripts in other users' vaults, exploit requires user authentication.