Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 91 of 166

  • 9.8 /10 Critical
    CVE-2026-59797 No auth

    Apache HTTP Server - Broken Access Control

    Apache HTTP Server 2.4.0 through 2.4.68 contains an improper privilege management vulnerability caused by mod_ssl's SSLRequire and file-related expressions, letting attackers bypass intended access controls, exploit requires crafted expressions.

  • 9.8 /10 Critical
    CVE-2026-57941 No auth

    Apache HTTP Server - Use After Free

    Apache HTTP Server 2.4.0 through 2.4.68 contains a use after free vulnerability caused by shared session->bbtmp re-entrancy in mod_http2, letting attackers cause memory corruption or denial of service, exploit requires crafted HTTP/2 requests.

  • 9.6 /10 Critical
    CVE-2026-56662 No auth

    GetSimple CMS CE - Cross-Site Request Forgery & Remote Code Execution

    GetSimple CMS CE < 1.5 contains a cross-site request forgery caused by missing anti-CSRF token and request-origin verification in the UpdateCE update form, letting remote attackers execute arbitrary code via administrator session, exploit requires administrator authentication.

  • 9.1 /10 Critical
    CVE-2026-56660 Auth required

    GetSimple CMS CE - Remote Code Execution

    GetSimple CMS CE < 1.5 contains a remote code execution caused by unsafe ZIP archive extraction and directory traversal in UpdateCE.php, letting attackers execute arbitrary PHP code as the web-server user, exploit requires processing a malicious archive.

  • 9.8 /10 Critical
    CVE-2026-56154 No auth

    Apache HTTP Server - Use After Free

    Apache HTTP Server 2.4.0 through 2.4.68 contains a use after free vulnerability caused by improper handling of lookahead (%{LA-U:HTTP:...}) in mod_rewrite, letting attackers cause denial of service or potentially execute code, exploit requires crafted requests.

  • 9.1 /10 Critical
    CVE-2026-55083 Auth required

    DHIS2 - Remote Code Execution

    DHIS2 2.42.0 < 2.42.5.1, 2.43.0 < 2.43.0.1 contains a remote code execution caused by unsafe Java deserialization, letting remote attackers execute arbitrary code, exploit requires crafted input to the deserialization component.

  • 9.1 /10 Critical
    CVE-2026-53953 No auth

    GetSimple CMS - Authentication Bypass

    GetSimple CMS CE 3.3.22 contains a broken authentication caused by predictable temporary password generation using PHP rand() seeded with microtime() in the password reset endpoint, letting attackers perform administrator account takeover, exploit requires no authentication but relies on timing attack.

  • 9.8 /10 Critical
    CVE-2026-51897

    RAGFlow - Broken Access Control

    RAGFlow 0.24.0 contains a broken access control vulnerability in get_dataset (api/apps/evaluation_app), letting attackers execute arbitrary code or commands, exploit requires access to the exposed entry point.

  • 9.8 /10 Critical
    CVE-2026-51893 No auth

    Infiniflow Ragflow - Broken Access Control

    Infiniflow Ragflow 0.24.0 contains an incorrect access control vulnerability caused by trace_mindmap accepting caller-selected tenant identifiers without ownership or membership checks, letting external attackers access unauthorized data.

  • 9.8 /10 Critical
    CVE-2026-51886 CISA KEVNo auth

    langflow-ai langflow - Code Injection

    langflow-ai langflow <= 1.9.3 contains a code injection caused by lack of sandboxing in /api/v1/validate/code endpoint, letting authenticated attackers execute arbitrary Python code remotely, exploit requires authentication.

  • 9.8 /10 Critical
    CVE-2026-51884 No auth

    Langchain Chatchat - Path Traversal

    Langchain Chatchat 0.3.1 contains a path traversal caused by crafted malicious filenames in /knowledge_base/upload_temp_docs endpoint, letting attackers write files to arbitrary server locations, exploit requires crafted filenames.

  • 9.1 /10 Critical
    CVE-2026-51883 No auth

    Langchain-Chatchat - Path Traversal

    Langchain-Chatchat 0.3.0;0.3.1 contains a path traversal caused by injection of path traversal sequences in the knowledge_base_name parameter, letting attackers write files outside the knowledge base root directory, exploit requires crafted input.

  • 9.1 /10 Critical
    CVE-2026-51882 No auth

    Langchain-Chatchat - Path Traversal

    Langchain-Chatchat 0.3.0 contains a path traversal caused by crafted malicious filenames in the /v1/files upload endpoint, letting attackers write files outside the intended directory, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-51881 No auth

    deeptutor - Command Injection

    deeptutor 1.4.0 contains a command injection caused by unsanitized input in ExecTool.execute, letting remote attackers execute arbitrary shell commands via the live tutorbot WebSocket interface, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-51880 No auth

    deeptutor - Path Traversal

    deeptutor 1.4.0 contains a path traversal caused by improper validation in EditFileTool.execute, letting remote attackers write or edit files outside the intended workspace via the live tutorbot WebSocket interface, exploit requires network access.