Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 95 of 125

  • 9.8 /10 Critical
    CVE-2026-89026 CISA KEVPoC publicNo auth

    Issabel Framework - Authentication Bypass

    Issabel Framework before commit b97dbaf contains a hard-coded HS256 JWT signing key in pbxapi index.php, letting unauthenticated remote attackers forge tokens to execute arbitrary OS commands as Asterisk user.

  • 9.8 /10 Critical
    CVE-2026-88617 No auth

    SmartAdmin - Broken Access Control

    SmartAdmin v3.30.0 contains a broken access control vulnerability caused by an authorization flaw in the configuration query endpoint, letting remote attackers escalate privileges, exploit requires no special conditions.

  • 10.0 /10 Critical
    CVE-2026-87230 No auth

    Oracle Hyperion Financial Management - Broken Access Control

    Oracle Hyperion Financial Management 11.2.26.0.000 contains an unauthorized data access vulnerability caused by insufficient access controls in the Security component, letting unauthenticated network attackers create, delete, or modify critical data, exploit requires network access via HTTP.

  • 9.1 /10 Critical
    CVE-2026-87223 No auth

    Oracle Hyperion Financial Management - Broken Access Control

    Oracle Hyperion Financial Management 11.2.26.0.000 contains an unauthenticated network access vulnerability in Security component, letting remote attackers modify critical data or cause denial of service, exploit requires network access via HTTP.

  • 9.1 /10 Critical
    CVE-2026-87217 No auth

    Oracle Hyperion Financial Management - Broken Access Control

    Oracle Hyperion Financial Management 11.2.26.0.000 contains a broken access control vulnerability caused by improper authorization in the Security component, letting unauthenticated network attackers via HTTP create, delete, or modify critical data.

  • 9.1 /10 Critical
    CVE-2026-87214 Auth required

    Oracle Hyperion Financial Management - Authentication Bypass

    Oracle Hyperion Financial Management 11.2.26.0.000 contains a security vulnerability allowing high privileged attackers with network access via HTTP to compromise the system, potentially impacting additional products, exploit requires high privileges.

  • 9.1 /10 Critical
    CVE-2026-87189 Auth required

    Oracle Hyperion Financial Management - Authentication Bypass

    Oracle Hyperion Financial Management 11.2.26.0.000 contains a security vulnerability caused by an easily exploitable flaw accessible via Oracle Net, letting high privileged attackers compromise the system, exploit requires network access with high privileges.

  • 9.8 /10 Critical
    CVE-2026-87188 No auth

    Oracle Hyperion Financial Management - Authentication Bypass

    Oracle Hyperion Financial Management 11.2.26.0.000 contains a remote unauthenticated takeover vulnerability in Security component, letting attackers with network HTTP access fully compromise the system, exploit requires network access via HTTP.

  • 9.6 /10 Critical
    CVE-2026-87186

    Oracle Hyperion Financial Management - Remote Code Execution

    Oracle Hyperion Financial Management 11.2.26.0.000 contains a remote takeover vulnerability caused by an easily exploitable flaw in the security component, letting unauthenticated attackers with physical network access fully compromise the system, exploit requires physical access to the communication segment.

  • 9.8 /10 Critical
    CVE-2026-87184 No auth

    Oracle Hyperion Financial Management - SQL Injection

    Oracle Hyperion Financial Management 11.2.26.0.000 contains a sql injection caused by unauthenticated network access via SQL, letting attackers fully compromise the system, exploit requires network access without authentication.

  • 9.1 /10 Critical
    CVE-2026-87176 No auth

    Oracle Hyperion Financial Management - Broken Access Control

    Oracle Hyperion Financial Management 11.2.26.0.000 contains an unauthorized data access vulnerability in Security component, letting unauthenticated network attackers create, delete, or modify critical data, exploit requires network access via TCP.

  • 9.1 /10 Critical
    CVE-2026-87175 No auth

    Oracle Hyperion Financial Management - Broken Access Control

    Oracle Hyperion Financial Management 11.2.26.0.000 contains an unauthorized data access vulnerability caused by insufficient access controls in the Security component, letting unauthenticated network attackers create, delete, or modify critical data.

  • 9.1 /10 Critical
    CVE-2026-87173 No auth

    Oracle Hyperion Financial Management - Broken Access Control

    Oracle Hyperion Financial Management 11.2.26.0.000 contains an unauthorized data access vulnerability caused by insufficient access controls in the Security component, letting unauthenticated network attackers create, delete, or modify critical data.

  • 9.9 /10 Critical
    CVE-2026-87172 Auth required

    Oracle Hyperion Financial Management - Authentication Bypass

    Oracle Hyperion Financial Management 11.2.26.0.000 contains a security vulnerability caused by an unspecified flaw in the Security component, letting low privileged attackers with network access via HTTP take over the system, exploit requires network access with low privileges.

  • 9.1 /10 Critical
    CVE-2026-87170 No auth

    Oracle Hyperion Financial Management - Broken Access Control

    Oracle Hyperion Financial Management 11.2.26.0.000 contains an unauthorized access vulnerability in Security component, letting unauthenticated network attackers via HTTP create, delete, or modify critical data, exploit requires network access.