Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 92 of 166
- 9.1 /10 CriticalCVE-2026-51879 No auth
deeptutor - Authorization Bypass
deeptutor 1.4.0 contains an authorization bypass caused by user-controlled object identifier in TutorBotManager.write_bot_file, letting remote attackers overwrite whitelisted control files, exploit requires remote access.
- 9.1 /10 CriticalCVE-2026-51876 No auth
DeepTutor - Authorization Bypass
DeepTutor 1.4.0 contains an authorization bypass caused by reuse of publicly exposed book_id in the book confirmation flow, letting unauthenticated or unauthorized callers overwrite persisted metadata and spine content.
- 9.1 /10 CriticalCVE-2026-51875 No auth
Devika - Path Traversal
Devika v1.0 contains a path traversal vulnerability caused by improper validation in the save_code_to_project function, letting attackers write files outside the project workspace, potentially compromising the server.
- 9.8 /10 CriticalCVE-2026-15989 PoC publicNo auth
Super Forms – Drag & Drop Form Builder - Privilege Escalation
Super Forms – Drag & Drop Form Builder plugin for WordPress <= 6.3.316 contains a privilege escalation caused by improper validation of the 'role' key in Register & Login add-on's before_email_success_msg() function, letting unauthenticated attackers register as administrators by injecting role=administrator in registration forms, exploit requires no authentication.
- 9.3 /10 CriticalCVE-2026-13043 PoC publicAuth required
WatchGuard Endpoint Security - Authentication Bypass
WatchGuard endpoint security contains a missing authentication vulnerability in Kernel Memory Access Driver (PSKMAD), letting local authenticated attackers bypass access control and disclose kernel and process memory.
- 9.8 /10 CriticalCVE-2026-12627
Fortra Core Privileged Access Manager - Buffer Overflow
Fortra Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow caused by improper handling in boks_autoregisterd, letting remote attackers with network access cause memory corruption, exploit requires network access to autoregistration service.
- 9.8 /10 CriticalCVE-2026-104286 CISA KEVPoC publicNo auth
Fortinet FortiMail - Path Traversal
Fortinet FortiMail 7.2.0 through 7.2.9, 7.4.0 through 7.4.8, 7.6.0 through 7.6.6, and 8.0.0 through 8.0.1 contain a path traversal vulnerability caused by improper limitation of pathname in HTTP/HTTPS request handling, letting unauthenticated attackers write arbitrary files on the system, exploit requires crafted HTTP/HTTPS requests.
- 9.8 /10 CriticalCVE-2026-104056 No auth
Authlib - Open Redirect
Authlib <= 1.7.2 contains an open redirect vulnerability caused by caching discovery JSON metadata without validation or issuer-origin binding, letting attackers replace endpoint URLs with attacker-controlled values, exploit requires no special conditions.
- 9.3 /10 CriticalCVE-2026-103922 PoC publicNo auth
Capacitor - Stored XSS
Capacitor 6.0.0 to 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1 contain a stored XSS caused by insufficient validation of WebView navigation guard path, letting attackers execute scripts with same-origin access, exploit requires victim to activate an untrusted link.
- 9.8 /10 CriticalCVE-2026-103752 PoC publicNo auth
Authorizer - Privilege Escalation
Authorizer <= 3.15.3 contains a privilege escalation vulnerability caused by improper access control, letting unauthenticated attackers escalate privileges, exploit requires no authentication.
- 9.1 /10 CriticalCVE-2026-103264 No auth
Fleet - Authentication Bypass
Fleet < 4.87.0 contains an authentication bypass caused by acceptance of hostnames and hardware serials as authentication tokens in device API, letting unauthenticated attackers access device data and trigger device actions, exploit requires knowledge of non-secret identifiers.
- 9.0 /10 CriticalCVE-2026-103255 No auth
n8n - Path Traversal
n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain a path traversal caused by unvalidated insertion of tableId parameter in Supabase node request paths, letting attackers bypass Row Level Security to access and modify data, exploit requires workflows binding tableId to untrusted input.
- 9.0 /10 CriticalCVE-2026-103248 No auth
n8n - NoSQL Injection
n8n < 1.123.80, 2.0.0 < 2.39.6, and 2.40.0 < 2.40.1 contain a filter injection vulnerability in Supabase node's Filters (String) mode caused by failure to escape field values, letting attackers read, update, or delete all table data remotely, exploit requires crafted input.
- 9.8 /10 CriticalCVE-2026-103244 No auth
ground-station - Authentication Bypass
ground-station < 0.8.0 contains an authentication bypass caused by improper validation in setup.restore command during first-run setup mode, letting unauthenticated attackers execute arbitrary SQL and gain admin access, exploit requires first-run setup mode.
- 9.3 /10 CriticalCVE-2026-102628 No auth
Cadmos LTI - Information Disclosure
Cadmos LTI application contains an information disclosure vulnerability caused by enabled Laravel debug mode in a public environment, letting unauthenticated attackers access sensitive server environment variables via unhandled exceptions, exploit requires no authentication.