Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 86 of 166
- 9.1 /10 CriticalCVE-2026-105640 No auth
Plane - Authentication Bypass
Plane prior to 1.4.0 contains an authentication bypass caused by trusting unverified email addresses from Gitea and self-managed GitLab OAuth without ownership verification, letting attackers log in as victims, exploit requires unverified OAuth email.
- 9.8 /10 CriticalCVE-2026-105639 No auth
Plane - Authentication Bypass & Broken Access Control
Plane < 1.4.0 contains an authentication bypass caused by lack of out-of-band email ownership verification in signup flow, letting unauthenticated attackers register as target users and join workspaces via invitation tokens, exploit requires attacker to register with target email.
- 9.1 /10 CriticalCVE-2026-105638 No auth
Plane - Authentication Bypass
Plane < 1.4.0 contains an authentication bypass caused by insufficient OTP verification and lack of rate limiting in magic-code email login, letting attackers brute force OTP codes without lockout, exploit requires no special privileges.
- 9.6 /10 CriticalCVE-2026-105637 Auth required
Plane - Broken Access Control
Plane prior to 1.4.0 contains a broken access control vulnerability caused by missing project_id constraint in asset retrieval, letting workspace Guests reassign assets to attacker-controlled projects and obtain presigned download URLs, exploit requires guest access in the workspace.
- 9.9 /10 CriticalCVE-2026-105636 Auth required
Plane - Server Side Request Forgery
Plane < 1.4.0 contains a server-side request forgery caused by lack of redirect target validation in webhook delivery task, letting authenticated users access internal resources via redirects, exploit requires workspace creation privilege.
- 10.0 /10 CriticalCVE-2026-105285 No auth
Totolink A3002MU - Buffer Overflow
Totolink A3002MU 1.0.0-B20230403.1455 contains a stack-based buffer overflow caused by manipulation of the addQos/comment/entry_name argument in /boafrm/formIpQoS QoS Rule Handler, letting remote attackers execute arbitrary code, exploit requires crafted request.
- 10.0 /10 CriticalCVE-2026-105284 No auth
Totolink A3002MU - Authentication Bypass
Totolink A3002MU 1.0.0-B20230403.1455 contains an improper authorization vulnerability caused by manipulation in the Authentication Check function sub_40FCFC in /bin/boa, letting remote attackers bypass authorization, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-104711 PoC public
Apache Struts - Expression Language Injection
Apache Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0 contain an expression language injection caused by improper neutralization of OGNL expressions in legacy RESTful action mapper, letting remote attackers execute arbitrary code, exploit requires legacy RESTful action mapper and OGNL allowlist disabled.
- 9.5 /10 CriticalCVE-2026-103510 No auth
P4 Search - Authentication Bypass
P4 Search < 2026.4.2 contains a broken authentication caused by failure to securely handle blank service authentication tokens, letting unauthenticated attackers with network access gain highest application privileges.
- 9.3 /10 CriticalCVE-2026-103352 No auth
WP BASE Booking - SQL Injection
WP BASE Booking <= 6.4.0 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-102780 No auth
Joomla Extension joomlafry.com - Broken Access Control
Joomla Extension joomlafry.com 2.9.0 - 2.9.4 contains an unauthenticated cross-record publication and mass assignment vulnerability caused by unfiltered raw jform data in RecordController, letting guest attackers modify any TF Content record including published, access, and created_by fields, exploit requires obtaining a valid token from Joomla's public login form.
- 9.8 /10 CriticalCVE-2026-102428 PoC publicNo auth
Joomla OrdaSoft CCK - SQL Injection
OrdaSoft Joomla CCK < 8.3.16 contains an SQL injection caused by improper validation of the user-provided order column, letting unauthenticated attackers execute arbitrary SQL commands remotely.
- 10.0 /10 CriticalCVE-2026-100103 No auth
Perforce P4 Search - Authentication Bypass
Perforce P4 Search container images < 2026.4.2 contain an authentication token reset to a publicly documented default, letting unauthenticated attackers with network access gain highest privileges and execute arbitrary code.
- 9.5 /10 CriticalCVE-2026-100102 No auth
Perforce P4 Search - Remote Code Execution
Perforce P4 Search container images < 2026.4.2 contain a remote code execution caused by an unauthenticated Java debug interface, letting attackers with network access execute arbitrary code as the P4 Search service account.
- 9.1 /10 CriticalCVE-2017-20285 No auth
YAML Perl - Insecure Deserialization
YAML for Perl < 1.30 contains an insecure deserialization vulnerability caused by loading documents that trigger DESTROY methods of arbitrary classes, letting attackers execute arbitrary code, exploit requires crafted YAML input.