Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 86 of 125
- 9.0 /10 CriticalCVE-2026-47252 Auth required
Anyquery - Command Injection
Anyquery prior to 0.4.5 contains a command injection caused by improper sanitization of SQL-controlled URLs in macOS virtual tables, letting authenticated users with INSERT or UPDATE access execute arbitrary OS commands, exploit requires authenticated user with specific write permissions.
- 9.0 /10 CriticalCVE-2026-45143 Auth required
Chamilo LMS - Stored XSS
Chamilo LMS 2.0.0 through 2.1.0 contains a stored XSS vulnerability caused by lack of server-side sanitization of private message content, letting authenticated low-privilege users execute scripts in administrator browsers, exploit requires authenticated user sending crafted message.
- 9.8 /10 CriticalCVE-2026-45140 PoC publicNo auth
Chamilo LMS - Remote Code Execution
Chamilo LMS < 2.0.1 contains a remote code execution vulnerability caused by an unspecified issue, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires no special conditions.
- 9.2 /10 CriticalCVE-2026-15688 Auth required
Mitsubishi Electric GX Works3 & Motion Control Setting - Authentication Bypass
Mitsubishi Electric GX Works3 and Motion Control Setting contain an authentication bypass caused by incorrect implementation of the authentication algorithm, letting local attackers authenticate with invalid passwords and manipulate control programs, exploit requires local access and executable modification.
- 9.8 /10 CriticalCVE-2025-55787 No auth
MailData Email Archiving System - SQL Injection
MailData Email Archiving System <= 4.2 contains a sql injection caused by unsanitized input in database queries, letting attackers execute arbitrary SQL commands, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-92805 PoC publicNo auth
UVdesk Community Skeleton - Authentication Bypass
UVdesk Community Skeleton through 1.1.8 contains a broken authentication caused by failure to validate installation state on wizard endpoints in ConfigureHelpdesk controller, letting unauthenticated attackers create super administrator accounts, exploit requires crafted requests to wizard endpoints.
- 9.8 /10 CriticalCVE-2026-92787 No auth
Feast - Authentication Bypass
Feast <= 0.66.0 contains a broken authentication caused by failure to verify JWT token signatures before user identity establishment, letting attackers bypass role-based access control and gain full read/write access, exploit requires presenting an unverified token with a hardcoded claim.
- 9.1 /10 CriticalCVE-2026-92720 No auth
Kubero - Broken Access Control
Kubero <= 3.1.1 contains a broken access control vulnerability caused by missing authentication guards on notifications API endpoints, letting unauthenticated attackers read webhook secrets and modify configurations, exploit requires no authentication.
- 9.1 /10 CriticalCVE-2026-92717 No auth
Covenant - Authentication Bypass
Covenant <= 0.6 contains a broken authentication caused by missing Authorize attribute on CovenantHub SignalR hub, letting unauthenticated attackers obtain signed JWT tokens and access operator API, exploit requires no authentication.
- 9.6 /10 CriticalCVE-2026-92716 Auth required
Shuffle - Privilege Escalation
Shuffle 2.2.1 contains a privilege escalation caused by improper access control in HandleApiGeneration endpoint, letting administrators reset and read API keys of users in other organizations, exploit requires admin privileges.
- 9.1 /10 CriticalCVE-2026-92398 Auth required
Ruijie RG-EW3000GX - Command Injection
Ruijie RG-EW3000GX EW_3.0(1)B11P380 contains a command injection caused by manipulation of the "Name" argument in /etc/rg_config/admin user_list_note module, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.
- 9.1 /10 CriticalCVE-2026-92397 Auth required
Ruijie RG-EW3000GX - Command Injection
Ruijie RG-EW3000GX EW_3.0(1)B11P380 contains a command injection caused by manipulation of the argument data.url in cc_set function of configChange component, letting remote attackers execute arbitrary OS commands, exploit requires remote access.
- 9.1 /10 CriticalCVE-2026-92395 No auth
@fastify/proxy-addr - Broken Access Control
@fastify/proxy-addr 3.0.0 through 5.1.0 contains a broken access control vulnerability caused by improper handling of IPv4-mapped IPv6 trust subnets, letting unauthenticated clients bypass IP-based restrictions by controlling X-Forwarded-For header, exploit requires crafted X-Forwarded-For header.
- 9.8 /10 CriticalCVE-2026-91843 PoC publicNo auth
Unspecified Product - Buffer Overflow
An unspecified product contains a buffer overflow caused during the unauthenticated login process, letting remote attackers execute arbitrary code with root privileges, exploit requires no special conditions.
- 9.8 /10 CriticalCVE-2026-91106
HP HPLIP - Multiple Vulnerabilities
HP HPLIP contains multiple vulnerabilities in various components, potentially enabling remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions, exploit requires specific conditions.