Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 96 of 166
- 9.1 /10 CriticalCVE-2026-102794 Auth required
Ziroom ZHOME A0101 - Command Injection
Ziroom ZHOME A0101 1.0.1.0 contains a command injection caused by manipulation of the "url" argument in /api/ZRnetwork/ping, letting remote attackers execute arbitrary commands, exploit requires no special privileges.
- 9.1 /10 CriticalCVE-2026-102793 Auth required
Ziroom ZHOME - Command Injection
Ziroom ZHOME A0101 1.0.1.0 contains a command injection caused by manipulation of the hostname/zonename argument in /api/ZRFirmware/set_time_zone, letting remote attackers execute arbitrary commands, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-102489 CISA KEVPoC publicNo auth
Zammad - Session Hijacking & Remote Code Execution
Zammad 6.3.0 to 6.5.4 contains a session hijack vulnerability caused by improper session management, letting remote attackers execute code as the zammad user, exploit requires vulnerable version and session hijack.
- 9.8 /10 CriticalCVE-2026-102458 No auth
Digiwin EasyFlow .NET - Authentication Bypass
Digiwin EasyFlow .NET contains a missing authentication vulnerability caused by an unauthenticated API, letting remote attackers obtain other users' plaintext passwords, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-102455 No auth
Digiwin EasyFlow .NET - Remote Code Execution
Digiwin EasyFlow .NET contains an insecure deserialization vulnerability caused by processing maliciously crafted serialized content, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires no special privileges.
- 10.0 /10 CriticalCVE-2026-102427 PoC publicNo auth
OrdaSoft Joomla CCK - Remote Code Execution
OrdaSoft Joomla CCK < 8.3.16 contains an unauthenticated remote code execution caused by lack of authentication and improper file extension validation in site/uploader.php, letting attackers upload and execute PHP code remotely, exploit requires no authentication.
- 9.4 /10 CriticalCVE-2026-102149
Kiteworks Email Protection Gateway - Broken Access Control
Kiteworks Email Protection Gateway contains a broken access control vulnerability caused by insufficient restriction on certificate assignment, letting attackers associate certificates with other users' accounts, affecting encrypted mail confidentiality and integrity, and potentially allowing unauthorized access, exploit requires certificate-based login enabled.
- 9.3 /10 CriticalCVE-2026-102147 No auth
Kiteworks Core - Stored XSS
Kiteworks Core contains a stored XSS caused by improper sanitization of user input, letting unauthenticated attackers execute arbitrary JavaScript in an administrator's session, exploit requires administrator to view crafted content.
- 9.8 /10 CriticalCVE-2026-102115 No auth
Kiteworks Core - Authentication Bypass
Kiteworks Core contains a broken authentication caused by improper validation of a parameter in the password reset workflow, letting unauthenticated attackers reset passwords and authenticate as users, including admins, without the reset link.
- 9.1 /10 CriticalCVE-2026-102106 No auth
Kiteworks Email Protection Gateway - Authentication Bypass
Kiteworks Email Protection Gateway contains a broken authentication caused by inconsistent enforcement of administrator password checks in an administrative service, letting attackers bypass authentication to manage users and domains.
- 9.1 /10 CriticalCVE-2026-102105 No auth
Kiteworks Email Protection Gateway - Server-Side Request Forgery
Kiteworks Email Protection Gateway < 9.5.0 contains a server-side request forgery caused by rendering message content referencing external resources, letting remote unauthenticated attackers induce requests to internal systems.
- 9.1 /10 CriticalCVE-2026-102104 No auth
Kiteworks Email Protection Gateway - Server-Side Request Forgery
Kiteworks Email Protection Gateway < 9.5.0 contains a server-side request forgery caused by crafted requests during online certificate status checks, letting remote unauthenticated attackers induce requests to internal network destinations.
- 9.1 /10 CriticalCVE-2026-102103 No auth
Kiteworks Email Protection Gateway - Server-Side Request Forgery
Kiteworks Email Protection Gateway < 9.5.0 contains a server-side request forgery caused by crafted requests triggered during certificate revocation list retrieval, letting remote unauthenticated attackers induce requests to internal networks.
- 9.1 /10 CriticalCVE-2026-102102 No auth
Kiteworks Email Protection Gateway - Server-Side Request Forgery
Kiteworks Email Protection Gateway < 9.5.0 contains a server-side request forgery caused by crafted requests triggered during issuer certificate retrieval in inbound messages, letting remote unauthenticated attackers induce requests to internal networks.
- 9.1 /10 CriticalCVE-2026-102095 No auth
Kiteworks Email Protection Gateway - Server-Side Request Forgery
Kiteworks Email Protection Gateway < 9.5.0 contains a server-side request forgery caused by inadequate restriction of server-side URL fetches in message content, letting remote unauthenticated attackers disclose internal data and affect internal services, exploit requires crafted message.