Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 9 of 166

  • 9.8 /10 Critical
    CVE-2026-62005 No auth

    Muzicon - Insecure Deserialization

    Muzicon <= 1.15 contains an insecure deserialization vulnerability caused by unauthenticated PHP object injection, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-62004 No auth

    Motorix - Insecure Deserialization

    Motorix <= 1.11 contains an insecure deserialization vulnerability caused by unauthenticated PHP object injection, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-62003 No auth

    Mission - PHP Object Injection

    Mission <= 1.22 contains an unauthenticated PHP Object Injection caused by improper input handling, letting unauthenticated attackers execute arbitrary code or manipulate objects remotely, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-62002 No auth

    Meals & Wheels - Authentication Bypass

    Meals & Wheels <= 1.1.13 contains an unauthenticated PHP object injection caused by improper handling of user input, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-62001 No auth

    Marcell - PHP Object Injection

    Marcell <= 1.2.14 contains a PHP Object Injection caused by unsafe deserialization of user input, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-61998 No auth

    Le Truffe - Insecure Deserialization

    Le Truffe <= 1.1.7 contains an insecure deserialization vulnerability caused by unauthenticated PHP object injection, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-61997 No auth

    Legal Stone - Insecure Deserialization

    Legal Stone <= 1.2.11 contains an unauthenticated PHP object injection caused by improper handling of user input, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-61992 No auth

    GEO my WordPress - PHP Object Injection

    GEO my WordPress <= 4.5.5.3 contains an unauthenticated PHP Object Injection caused by improper input handling, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 10.0 /10 Critical
    CVE-2026-61991 No auth

    AjaxLoadMore Cache - Remote Code Execution

    AjaxLoadMore Cache <= 3.1.1 contains a remote code execution caused by unauthenticated access, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.0 /10 Critical
    CVE-2026-61707 Auth required

    SOCFortress CoPilot - Server-Side Template Injection

    SOCFortress CoPilot < 0.1.76 contains a server-side template injection caused by insufficient validation and non-sandboxed Jinja2 template rendering, letting low-privilege users execute arbitrary code as root, exploit requires attacker to upload malicious templates.

  • 9.1 /10 Critical
    CVE-2026-61645 Auth required

    Docat - Unrestricted File Upload

    Docat contains an unrestricted file upload vulnerability caused by lack of validation on uploaded file path or type in the Upload API, letting attackers overwrite sensitive files or upload malicious content, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-54860 No auth

    Ozisti - Insecure Deserialization

    Ozisti <= 1.1.10 contains an unauthenticated PHP object injection caused by improper handling of user input, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-54859 No auth

    Preservation - PHP Object Injection

    Preservation <= 1.15 contains an unauthenticated PHP Object Injection caused by unsafe deserialization, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-54858 No auth

    Printy - PHP Object Injection

    Printy <= 1.13.0 contains an unauthenticated PHP Object Injection caused by unsafe deserialization, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-54857 No auth

    Quirky - Insecure Deserialization

    Quirky <= 1.23 contains an insecure deserialization vulnerability caused by unauthenticated PHP object injection, letting remote attackers execute arbitrary code, exploit requires no authentication.