Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 94 of 166

  • 9.8 /10 Critical
    CVE-2026-86131

    WatchGuard Fireware OS - Command Injection

    WatchGuard Fireware OS contains a command injection caused by improper handling of BOVPN Over TLS client configuration, letting attackers controlling the remote VPN server execute arbitrary commands as root, exploit requires attacker to control remote VPN server.

  • 9.8 /10 Critical
    CVE-2026-82307 No auth

    Dolusoft Software Technologies SOPLOG - SQL Injection

    Dolusoft Software Technologies SOPLOG < 2026.9.4.1 contains an sql injection caused by improper neutralization of special elements in SQL commands, letting attackers execute arbitrary SQL queries remotely, exploit requires crafted input.

  • 9.1 /10 Critical
    CVE-2026-77185

    Apache MINA SSHD - Authentication Bypass

    Apache MINA SSHD 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 contain an authentication bypass caused by flawed asynchronous authentication logic in sshd-core, letting attackers skip signature checks in public-key or hostbased authentication, exploit requires server to use asynchronous authentication with these schemes.

  • 9.1 /10 Critical
    CVE-2026-76570 PoC publicNo auth

    Joomla Extension joomcode.com JCTables - SQL Injection

    Joomla Extension joomcode.com JCTables 1.21.1 contains an unauthenticated SQL injection caused by lack of token validation and authentication in front-end CRUD API controller, letting attackers execute arbitrary read and write SQL queries remotely, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-76504 CISA KEVPoC publicNo auth

    Cisco Catalyst SD-WAN Manager - Authentication Bypass

    Cisco Catalyst SD-WAN Manager contains an authentication bypass caused by improper URI encoding handling in HTTP requests, letting unauthenticated remote attackers gain admin privileges, exploit requires crafted HTTP request.

  • 9.8 /10 Critical
    CVE-2026-75873 No auth

    Zella Theme WordPress - Unrestricted File Upload

    Zella Theme WordPress theme < 2.6.3 contains an unrestricted file upload vulnerability caused by lack of capability and nonce checks in font upload action, letting unauthenticated attackers upload arbitrary files including PHP for remote code execution.

  • 9.1 /10 Critical
    CVE-2026-62308 Auth required

    Tugtainer - Server-Side Request Forgery

    Tugtainer < 1.30.6 contains a server-side request forgery caused by unrestricted URL input in /settings/test_notification endpoint, letting authenticated users make backend send arbitrary HTTP requests, exploit requires authentication.

  • 9.8 /10 Critical
    CVE-2026-55494 PoC publicNo auth

    Tugtainer Agent - Authentication Bypass

    Tugtainer Agent < 1.30.4 contains an authentication bypass caused by empty AGENT_SECRET allowing signature verification to succeed, letting unauthenticated attackers access Docker management APIs, exploit requires AGENT_SECRET to be unset.

  • 9.4 /10 Critical
    CVE-2026-55181 No auth

    Tugtainer - Authentication Bypass

    Tugtainer < 1.30.3 contains an authentication bypass caused by OIDC login flow initiation despite OIDC_ENABLED=false, letting attackers bypass OIDC disable switch, exploit requires no special privileges.

  • 9.0 /10 Critical
    CVE-2026-55176

    Soft Machine - Broken Access Control

    Soft Machine <= 0.2.247 contains a broken access control vulnerability caused by acceptance of a global shared secret as bearer token without workspace verification, letting tenants access and modify other tenants' workspace APIs, exploit requires access to user-facing process environment.

  • 10.0 /10 Critical
    CVE-2026-55107 No auth

    Kobako Ruby gem - Remote Code Execution

    Kobako Ruby gem >= 0.1.0 and < 0.9.1 contains a remote code execution caused by sandbox escape allowing guest mruby scripts to execute arbitrary Ruby in the host process, letting attackers fully escape the sandbox, exploit requires running untrusted mruby scripts.

  • 9.8 /10 Critical
    CVE-2026-51872 No auth

    Devika - Code Injection

    Devika v1.0 contains a code injection caused by improper handling in Runner.run_code function in src/agents/runner/runner.py, letting attackers execute arbitrary code remotely, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-51871 No auth

    Devika - Command Injection

    Devika v1.0 contains a code injection caused by direct execution of LLM-generated content in Runner.execute function, letting attackers achieve arbitrary code execution, exploit requires crafted input to the function.

  • 9.8 /10 Critical
    CVE-2026-51870 No auth

    DeepTutor - Command Injection

    DeepTutor v1.4.0 contains a command injection caused by improper handling in /tutorbot/agent/tools/shell.py:ExecTool.execute, letting attackers execute arbitrary commands remotely, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-51869 No auth

    DB-GPT - Command Injection

    DB-GPT v0.8.0 contains a command injection caused by silent fallback to LocalRuntime in sandbox API, letting attackers execute code on the host, exploit requires invoking the sandbox API.