Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 85 of 166

  • 9.1 /10 Critical
    CVE-2026-101023 No auth

    Gitea - Authentication Bypass

    Gitea contains an OAuth2 token endpoint vulnerability caused by improper validation of token type in refresh_token grant, letting attackers with access tokens extend access beyond original lifetime, exploit requires valid access token.

  • 9.8 /10 Critical
    CVE-2025-71383 No auth

    Dbit WIFI4 N300 - Denial of Service

    Dbit WIFI4 N300 1.0.0 contains a denial of service caused by an error in JSON parser when a request from local Wi-Fi network lacks /api/login username or password field, letting local attackers crash the management interface.

  • 9.8 /10 Critical
    CVE-2026-97283 No auth

    Liquid Web / StellarWP Advanced Post Manager - Insecure Deserialization

    Liquid Web / StellarWP Advanced Post Manager <= 4.5.5 contains an insecure deserialization vulnerability caused by untrusted data deserialization, letting attackers perform object injection remotely, exploit requires crafted input.

  • 9.3 /10 Critical
    CVE-2026-91107 Auth required

    openSIS Classic - Broken Access Control

    openSIS Classic 9.3 contains a broken access control vulnerability caused by improper authorization in the School Information update path, letting authenticated users with teacher role reset arbitrary staff passwords, exploit requires teacher role authentication.

  • 9.8 /10 Critical
    CVE-2026-88424 No auth

    FineAdmin - SQL Injection

    FineAdmin v1.0 contains a sql injection caused by unsanitized input in the field/order parameter at ButtonService.GetListByFilter(), letting attackers access sensitive database information via crafted SQL statements, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-88395 No auth

    GouGuOA - SQL Injection

    GouGuOA <= 6.0.5 contains a sql injection caused by unsanitized keywords parameter in /home/message/rubbish, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted request.

  • 9.8 /10 Critical
    CVE-2026-88393 No auth

    WookTeam - Remote Code Execution

    WookTeam <= 1.6.6 contains a remote code execution caused by unsafe eval of base64-decoded data parameter in /api/project/task/export, letting attackers execute arbitrary PHP code remotely, exploit requires crafted request.

  • 9.8 /10 Critical
    CVE-2026-88391 No auth

    Northstar - Remote Code Execution

    Northstar <= 9.1.1 contains a remote code execution caused by exposed H2 Console without authentication and default credentials, letting network-reachable attackers execute arbitrary system commands pre-authentication.

  • 9.0 /10 Critical
    CVE-2026-79820 No auth

    HPE Integrated Lights-Out (iLO) 7 - Authentication Bypass

    HPE Integrated Lights-Out (iLO) 7 firmware contains a user validation failure vulnerability, letting remote attackers bypass authentication, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-37719 No auth

    dormakaba evolo Service - Remote Code Execution

    dormakaba evolo Service contains a remote code execution caused by a vulnerability in a .NET component, letting remote attackers execute arbitrary code as SYSTEM, exploit requires network access.

  • 9.3 /10 Critical
    CVE-2026-21589 CISA KEVPoC publicNo auth

    Atlassian Data Center - Arbitrary File Access

    Atlassian Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye Data Center versions contain an arbitrary file access vulnerability caused by improper access control in the web application root directory, letting unauthenticated attackers access specific files with prior knowledge of exact file names and paths, exploit requires prior knowledge of target file path.

  • 9.9 /10 Critical
    CVE-2026-105740 CISA KEVAuth required

    Langflow - Remote Code Execution

    Langflow < 1.9.0 contains a remote code execution caused by unsanitized command injection in MCP server with "Stdio" transport, letting authenticated users execute arbitrary commands on the server, exploit requires user authentication.

  • 9.9 /10 Critical
    CVE-2026-105697

    Langflow - Command Injection

    Langflow < 1.10.3 contains a command injection caused by unsanitized user input in MCP server configuration commands, letting attackers execute arbitrary OS commands as the Langflow process user, exploit requires access to MCP server settings or MCP Tools component.

  • 9.9 /10 Critical
    CVE-2026-105691 Auth required

    Penpot - Command Injection

    Penpot < 2.18.0 contains a command injection caused by unsanitized fill-color value in SVG exporter executed via child_process.exec, letting attackers with file edit or public share link execute arbitrary commands, exploit requires file edit or access to malicious public share link.

  • 9.8 /10 Critical
    CVE-2026-105641 No auth

    Plane - Authentication Bypass

    Plane prior to 1.4.0 contains a broken authentication caused by fixed, publicly known SECRET_KEY and LIVE_SERVER_SECRET_KEY defaults in deployment manifests, letting attackers forge Django-signed values and bypass live-service authentication, exploit requires unchanged default secrets.