Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 97 of 125

  • 9.1 /10 Critical
    CVE-2026-83202 No auth

    Oracle Siebel CRM Deployment - Broken Access Control

    Oracle Siebel CRM Deployment 17.0-26.7 contains an unauthorized access vulnerability in Server Infrastructure, letting unauthenticated network attackers via HTTP create, delete, or modify critical data, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-83201 No auth

    Oracle Siebel CRM Deployment - Broken Access Control

    Oracle Siebel CRM Deployment 17.0-26.7 contains an unauthenticated access control vulnerability in Server Infrastructure, letting remote attackers create, delete, or modify critical data, exploit requires network access via HTTP.

  • 9.1 /10 Critical
    CVE-2026-83197 No auth

    Oracle Siebel CRM Siebel Apps - Financial Services - Authentication Bypass

    Oracle Siebel CRM Siebel Apps - Financial Services 17.0-26.7 contains an unauthenticated network accessible vulnerability in Financial Accounts, letting attackers gain unauthorized data access or cause denial of service, exploit requires network access via HTTP.

  • 9.1 /10 Critical
    CVE-2026-83196 Auth required

    Oracle Siebel CRM - Remote Code Execution

    Oracle Siebel CRM 17.0-26.7 contains a remote code execution caused by a vulnerability in Server Infrastructure, letting high privileged attackers with network access via HTTP take over Siebel CRM Deployment, exploit requires high privileges.

  • 9.1 /10 Critical
    CVE-2026-83154 No auth

    Oracle Siebel CRM End User - Broken Access Control

    Oracle Siebel CRM End User 17.0-26.7 contains a broken access control vulnerability caused by unauthenticated network access via SOAP, letting attackers create, delete, or modify critical data, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-83151 No auth

    Oracle Fusion Middleware Service Delivery Platform - Remote Code Execution

    Oracle Fusion Middleware Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 contains a remote code execution caused by unauthenticated network access via SOAP, letting attackers fully compromise the platform, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-83149 Auth required

    Oracle Application Testing Suite - Authentication Bypass

    Oracle Application Testing Suite 13.3.0.1 contains an authentication bypass caused by insufficient privilege checks, letting low privileged attackers with Test Manager for Web Apps privilege access and modify critical data and cause partial denial of service, exploit requires network access via HTTP.

  • 9.8 /10 Critical
    CVE-2026-83108 No auth

    Oracle Oracle Forms - Remote Code Execution

    Oracle Fusion Middleware Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a remote code execution caused by unauthenticated network access via HTTP, letting attackers fully compromise Oracle Forms, exploit requires network access via HTTP.

  • 9.1 /10 Critical
    CVE-2026-83107 Auth required

    Oracle Oracle Forms - Remote Code Execution

    Oracle Fusion Middleware Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a remote code execution caused by an easily exploitable vulnerability in Forms Services, letting high privileged attackers with network access via HTTP take over Oracle Forms, exploit requires high privileges.

  • 9.0 /10 Critical
    CVE-2026-83105 No auth

    Oracle Oracle Forms - Remote Code Execution

    Oracle Fusion Middleware Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a remote code execution caused by a vulnerability in Forms Services, letting unauthenticated attackers with network HTTP access take over Oracle Forms, exploit requires high attack complexity.

  • 9.1 /10 Critical
    CVE-2026-83104 No auth

    Oracle Fusion Middleware Oracle Forms - Broken Access Control

    Oracle Fusion Middleware Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a broken access control vulnerability in Forms Services, allowing unauthenticated network attackers to create, delete, or modify critical data, or access all Oracle Forms data.

  • 9.1 /10 Critical
    CVE-2026-83103 Auth required

    Oracle Oracle Forms - Remote Code Execution

    Oracle Fusion Middleware Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a remote code execution caused by a vulnerability in Forms Services, letting high privileged attackers with network access via HTTP take over Oracle Forms, exploit requires high privileges.

  • 9.8 /10 Critical
    CVE-2026-83100 No auth

    Oracle Oracle Forms - Remote Code Execution

    Oracle Fusion Middleware Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a remote code execution caused by unauthenticated network access via HTTP, letting attackers fully compromise Oracle Forms, exploit requires network access via HTTP.

  • 10.0 /10 Critical
    CVE-2026-83099 No auth

    Oracle Oracle Forms - Remote Code Execution

    Oracle Fusion Middleware Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a remote code execution caused by an easily exploitable vulnerability in Forms Services, letting unauthenticated attackers with network access via HTTP take over Oracle Forms, exploit requires network access via HTTP.

  • 9.8 /10 Critical
    CVE-2026-83098 No auth

    Oracle Fusion Middleware Oracle Forms - Remote Code Execution

    Oracle Fusion Middleware Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 contain a remote code execution caused by unauthenticated network access via HTTP, letting attackers fully compromise Oracle Forms, exploit requires network access via HTTP.