Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 87 of 166

  • 9.1 /10 Critical
    CVE-2026-105215 No auth

    ZITADEL - Authentication Bypass

    ZITADEL < 3.4.14 and 4.x < 4.16.2 contain an authentication bypass caused by trusting client-supplied external identity fields without completed IdP callback in hosted Login V1 UI, letting unauthenticated attackers pre-create accounts bound to victim's external IdP identity.

  • 9.6 /10 Critical
    CVE-2026-105209 Auth required

    ZITADEL - Broken Access Control

    ZITADEL 3.x < 3.4.15 and 4.x < 4.17.1 contain an improper authorization vulnerability caused by insufficient organization verification in passkey or passwordless enrollment code issuance, letting attackers with user-write permission in one organization take over accounts in another organization, exploit requires user-write permission in one organization.

  • 9.8 /10 Critical
    CVE-2026-105207 No auth

    ZITADEL - Authentication Bypass

    ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 contains an authentication bypass caused by linking user accounts to external identity providers without verifying primary factors or caller permissions, letting unauthenticated attackers bind external identities and sign in as victims, exploit requires knowledge of victim's login name.

  • 10.0 /10 Critical
    CVE-2026-105135 No auth

    InternLM MindSearch - Command Injection

    InternLM MindSearch 0.1.0 contains a command injection caused by manipulation of the "inputs" argument in ExecutionAction.run of Planner Agent, letting remote attackers execute arbitrary code, exploit requires crafted input.

  • 10.0 /10 Critical
    CVE-2026-105134 CISA KEVPoC publicNo auth

    Ahsay AhsayCBS - Command Injection

    Ahsay AhsayCBS <= 10.3.2 contains a command injection caused by manipulation of the "random" argument in /rps/api/json/UpdateReceivers.do of Replication Receiver, letting remote attackers execute OS commands, exploit requires crafted request.

  • 9.3 /10 Critical
    CVE-2026-103355 PoC publicNo auth

    Unlimited Elements Unlimited Elements For Elementor - SQL Injection

    Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.20 contains a sql injection caused by improper neutralization of special elements in SQL commands, letting attackers perform blind SQL injection remotely, exploit requires crafted input.

  • 9.1 /10 Critical
    CVE-2026-92084 PoC publicNo auth

    Beaver Builder Page Builder - Remote Code Execution

    Beaver Builder Page Builder for WordPress <= 2.11.0.5 contains an arbitrary shortcode execution vulnerability caused by improper validation before running do_shortcode, letting unauthenticated attackers execute arbitrary shortcodes, exploit requires a Beaver Builder page with Sidebar module containing attacker-controlled widget text.

  • 9.1 /10 Critical
    CVE-2026-87115 No auth

    VikAppointments Services Booking Calendar - Arbitrary File Deletion

    VikAppointments Services Booking Calendar WordPress plugin <= 1.2.21 contains an arbitrary file deletion vulnerability caused by insufficient file path validation in the extract function, letting unauthenticated attackers delete files remotely, exploit requires a published File-type custom field on the confirmation page shortcode.

  • 9.2 /10 Critical
    CVE-2026-71885

    Bouncy Castle - Authentication Bypass

    Bouncy Castle for Java < 1.86 contains a broken authentication caused by improper binding of X.509 credentials to LeafNode signature_key in MLS implementation, letting unauthenticated attackers impersonate others and decrypt group messages, exploit requires deployment admitting external commits without independent credential checks.

  • 9.8 /10 Critical
    CVE-2026-105105

    NASA-AMMOS AIT-Core - Authentication Bypass

    NASA-AMMOS AIT-Core <= 3.1.1 contains missing authentication for critical functions caused by unauthenticated ZeroMQ message bus sockets binding to all interfaces, letting unauthenticated remote attackers inject or exfiltrate spacecraft command and telemetry data, exploit requires network access to TCP ports 5559 or 5560.

  • 9.9 /10 Critical
    CVE-2026-105080 PoC publicAuth required

    ConvertX - Command Injection

    ConvertX < 0.19.0 contains a command injection caused by passing unblocked .recipe or .downloaded_recipe files to the ebook-convert program, letting attackers execute arbitrary code, exploit requires crafted recipe files.

  • 9.8 /10 Critical
    CVE-2026-97637 No auth

    WordPress JSON API Auth - Authentication Bypass

    WordPress JSON API Auth plugin <= 3.1.2 contains an authentication bypass caused by cached session cookie disclosure in the PI-Media/json-api parent plugin, letting unauthenticated attackers fully authenticate as Administrator, exploit requires active parent plugin with Auth controller and prior admin POST.

  • 9.4 /10 Critical
    CVE-2026-95102 No auth

    WebSocket Endpoints - Authentication Bypass

    WebSocket endpoints contain a broken authentication caused by lack of proper authentication mechanisms, letting attackers impersonate charging stations and gain unauthorized access, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-94541 PoC public

    WPMobile.App - Authorization Bypass

    WPMobile.App – Android and iOS App Builder plugin for WordPress <= 11.82 contains an authorization bypass caused by improper user authorization verification, letting unauthenticated attackers exfiltrate password-reset URLs and take over accounts, exploit requires mail-to-push feature enabled.

  • 9.9 /10 Critical
    CVE-2026-93698 Auth required

    Multilang - Command Injection

    Multilang contains a command injection caused by insufficient validation in adminbin, letting attackers execute arbitrary commands remotely, exploit requires no special privileges.