Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 89 of 166
- 9.8 /10 CriticalCVE-2026-19660 PoC publicNo auth
Divi Membership WordPress plugin - Authentication Bypass
Divi Membership WordPress plugin <= 2.3.0 contains an authentication bypass caused by lack of validation in process_paypal_callback function, letting unauthenticated attackers log in as any user including admins, exploit requires crafted paypal_param GET parameter.
- 9.8 /10 CriticalCVE-2026-19652 No auth
Divi Membership - Privilege Escalation
Divi Membership WordPress plugin <= 2.2.0 contains a privilege escalation caused by improper role validation in dmem_form_submit_handler(), letting unauthenticated attackers register as administrators and gain full site control, exploit requires publicly accessible WordPress nonce.
- 9.1 /10 CriticalCVE-2026-15896 No auth
Super Forms – Drag & Drop Form Builder - Path Traversal
Super Forms – Drag & Drop Form Builder WordPress plugin <= 6.3.316 contains a path traversal caused by insufficient validation in parse_request function, letting unauthenticated attackers read arbitrary files, exploit requires file upload enabled.
- 9.8 /10 CriticalCVE-2026-14378 PoC publicNo auth
DevKit Pro WordPress plugin - Authentication Bypass
DevKit Pro WordPress plugin <= 2.3.0 contains an authentication bypass caused by improper verification of the original_user_id cookie in revert_switch handler, letting unauthenticated attackers take over administrator accounts by forging cookies and nonces.
- 9.5 /10 CriticalCVE-2026-104849
Tinypool - Prototype Pollution
Tinypool < 2.1.2 contains a prototype pollution vulnerability caused by reading filename from a caller-supplied options object without own property check in pool.run, letting attackers load arbitrary JavaScript and read or modify task data, exploit requires prototype pollution.
- 9.8 /10 CriticalCVE-2026-104846 No auth
Seroval - Remote Code Execution
Seroval 0.12.0 to 1.6.2 contains a remote code execution caused by deserialization of attacker-controlled thenables in fromJSON, letting attackers trigger code execution via native Promise resolution, exploit requires crafted JSON input.
- 9.1 /10 CriticalCVE-2026-104611 Auth required
Tenda AC9 - Buffer Overflow
Tenda AC9 15.03.02.13 contains a stack-based buffer overflow caused by manipulation of the "netWanType" argument in /goform/fast_setting_internet_set POST request handler, letting remote attackers cause denial of service or execute code, exploit requires crafted request.
- 10.0 /10 CriticalCVE-2026-104610 No auth
Tenda HG7, HG9, HG10 - Buffer Overflow
Tenda HG7, HG9, and HG10 300001138_en_xpon contain a stack-based buffer overflow caused by manipulation of the "Ethtype" argument in /boaform/formLoopBack of Boa Web Server, letting remote attackers execute code, exploit requires crafted request.
- 9.0 /10 CriticalCVE-2026-104019 Auth required
Amazon SageMaker Distribution - OS Command Injection
Amazon SageMaker Distribution 2.x < 2.14.12, 3.x < 3.9.12, 4.0.x < 4.0.11, 4.1.x < 4.1.11, 4.2.x < 4.2.8, 4.3.x < 4.3.5, and 4.4.x < 4.4.3 contains an OS command injection caused by unneutralized interpolation of crafted connection resource property in Studio Space startup validation script, letting authenticated remote users with project contributor permissions execute arbitrary commands and obtain temporary execution role credentials, exploit requires project contributor permissions.
- 10.0 /10 CriticalCVE-2026-103956 PoC publicNo auth
Loom for AWS - Authentication Bypass
Loom for AWS < 1.6.1 contains a broken authentication caused by missing authentication for critical functions in the authentication dependency, letting remote actors obtain super-admin authority over the agent control plane, exploit requires no identity provider configured.
- 9.8 /10 CriticalCVE-2026-103877
Apache Directory LDAP API - Insecure Deserialization
Apache Directory LDAP API >= 2.1.0 < 2.1.9 contains an insecure deserialization vulnerability caused by processing serialized Java classes in schema objects from untrusted LDAP servers, letting attackers achieve potential remote code execution, exploit requires a rogue or compromised LDAP server or pre-TLS man-in-the-middle.
- 9.4 /10 CriticalCVE-2026-103765 No auth
Mooncake - Authentication Bypass
Mooncake <= 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler, letting unauthenticated attackers read, overwrite, and delete transfer engine metadata keys, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-103764 No auth
Mooncake transfer engine - Remote Code Execution & Information Disclosure
Mooncake transfer engine < 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader, letting unauthenticated attackers read and write arbitrary process memory via TCP transport data port, exploit requires crafted SessionHeader with arbitrary addr and size values.
- 9.1 /10 CriticalCVE-2026-103648 PoC publicNo auth
image-downloader - Path Traversal
image-downloader 4.3.0 contains a path traversal caused by uncontrolled download URL, letting attackers write downloaded response data outside the configured destination directory, exploit requires control over download URL.
- 9.6 /10 CriticalCVE-2026-103630 No auth
Google Chrome - Use After Free
Google Chrome < 154.0.8037.97 contains a use after free caused by improper memory handling in FedCM, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.