Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 96 of 125
- 9.1 /10 CriticalCVE-2026-87129 No auth
Oracle Hyperion Data Relationship Management - Broken Access Control
Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an access control vulnerability in Access and security, letting unauthenticated network attackers via HTTP create, delete, or modify critical data, exploit requires network access.
- 9.1 /10 CriticalCVE-2026-87128 No auth
Oracle Hyperion Data Relationship Management - Broken Access Control
Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an access control vulnerability in Access and security, letting unauthenticated network attackers via HTTP create, delete, or modify critical data, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-83462 No auth
Oracle Mobile Application Server - Remote Code Execution
Oracle Mobile Application Server 12.2.3-12.2.15 contains a remote code execution vulnerability caused by unauthenticated network access via TCP, letting unauthenticated attackers fully compromise the server, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-83452 No auth
Oracle Document Management and Collaboration - Authentication Bypass
Oracle Document Management and Collaboration 12.2.3-12.2.15 contains a remote unauthenticated takeover vulnerability caused by internal operations flaw, letting attackers with network HTTP access fully compromise the system, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-83355 No auth
Oracle Enterprise Manager - Remote Code Execution
Oracle Enterprise Manager for Fusion Middleware 13.5 and 24.1 contains a remote code execution vulnerability caused by an easily exploitable flaw in Metrics component, letting unauthenticated attackers with network access via HTTP take over the system, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-83339 No auth
Oracle WebCenter Enterprise Capture - Remote Code Execution
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 contains a remote code execution caused by unauthenticated network access via HTTP, letting unauthenticated attackers fully compromise the system, exploit requires network access via HTTP.
- 9.8 /10 CriticalCVE-2026-83327 No auth
Oracle Oracle Applications Framework - Authentication Bypass
Oracle E-Business Suite Oracle Applications Framework 12.2.3-12.2.15 contains a remote unauthenticated takeover vulnerability caused by insecure SOAP access in Personalization component, letting attackers fully compromise the framework, exploit requires network access via SOAP.
- 9.8 /10 CriticalCVE-2026-83283 No auth
Oracle Business Intelligence Enterprise Edition - Authentication Bypass
Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 contains a remote unauthenticated takeover vulnerability in Platform Security, letting attackers with network HTTP access fully compromise the system, exploit requires network access via HTTP.
- 9.9 /10 CriticalCVE-2026-83282 Auth required
Oracle Business Intelligence Enterprise Edition - Remote Code Execution
Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 contains a remote code execution caused by platform security flaws, letting low privileged attackers with network access via HTTP take over the system, exploit requires low privileges.
- 9.8 /10 CriticalCVE-2026-83269 No auth
Oracle BI Publisher - Remote Code Execution
Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 contains a remote code execution caused by unauthenticated network access via HTTP, letting attackers fully compromise the system, exploit requires no authentication.
- 9.1 /10 CriticalCVE-2026-83268 Auth required
Oracle BI Publisher - Authentication Bypass
Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 contain a critical vulnerability in BI Platform Security, letting high privileged attackers with network access via HTTP take over the system, exploit requires high privileges.
- 9.8 /10 CriticalCVE-2026-83261 No auth
Oracle Product Lifecycle Analytics - Remote Code Execution
Oracle Product Lifecycle Analytics 3.6.1 contains a remote unauthenticated takeover vulnerability caused by an easily exploitable issue in the core component, letting attackers fully compromise the system, exploit requires network access via HTTP.
- 9.1 /10 CriticalCVE-2026-83260 Auth required
Oracle Agile PLM - Remote Code Execution
Oracle Agile PLM 9.3.6 contains a remote code execution caused by vulnerability in Event Java PX component, letting high privileged attackers with network access via T3, IIOP fully compromise the system, exploit requires high privileges.
- 9.8 /10 CriticalCVE-2026-83232 No auth
Oracle Data Integrator - Remote Code Execution
Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 contain a remote code execution vulnerability in Console / Repository Explorer, letting unauthenticated attackers with network access via HTTP fully compromise the system, exploit requires network access.
- 9.1 /10 CriticalCVE-2026-83229 Auth required
Oracle Siebel CRM - Remote Code Execution
Oracle Siebel CRM 17.0-26.7 contains a remote code execution caused by a vulnerability in Siebel Management Console, letting high privileged attackers with network access via HTTP take over Siebel CRM Deployment, exploit requires high privileges.