Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 99 of 166

  • 9.1 /10 Critical
    CVE-2026-79536 No auth

    bytebase dbhub - SQL Injection

    bytebase dbhub v1.2.0 contains a sql injection caused by improper sanitization in /utils/sql-parser.ts, letting attackers access sensitive database information via crafted SQL statements, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-77177 No auth

    Open GenAI Stack - Server-Side Template Injection

    Open GenAI Stack (aka ogx-ai) contains a template injection caused by unsanitized Jinja2 template syntax in prompt injection, letting attackers achieve server-side code execution, exploit requires crafted prompt input.

  • 9.6 /10 Critical
    CVE-2026-76725 No auth

    HPE Networking Instant ON APs - Authentication Bypass

    HPE Networking Instant ON APs contain an authentication bypass caused by a flaw in the management protocol, letting unauthenticated adjacent attackers bypass security controls and execute code remotely with elevated privileges.

  • 9.6 /10 Critical
    CVE-2026-76724

    HPE Networking Instant ON APs - Command Injection

    HPE Networking Instant ON APs contain a command injection caused by improper input handling in the CLI, letting unauthenticated adjacent attackers execute arbitrary commands as privileged users, exploit requires network adjacency.

  • 9.6 /10 Critical
    CVE-2026-76723

    HPE Networking Instant ON APS - Buffer Overflow

    HPE Networking Instant ON APS contains a buffer overflow caused by vulnerabilities in the affected interface, letting unauthenticated adjacent attackers execute arbitrary commands on the underlying OS, exploit requires network adjacency.

  • 9.8 /10 Critical
    CVE-2026-76722 No auth

    HPE Networking Instant ON APs - Remote Code Execution & Denial of Service

    HPE Networking Instant ON APs contain an uncontrolled format string vulnerability in an affected interface, letting unauthenticated remote attackers execute arbitrary commands or cause denial of service, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-76721 No auth

    HPE Networking Instant ON - Buffer Overflow

    HPE Networking Instant ON contains a buffer overflow vulnerability in an affected interface, letting unauthenticated remote attackers execute arbitrary code as privileged users on the underlying operating system.

  • 9.0 /10 Critical
    CVE-2026-72510 Auth required

    Product - SQL Injection

    The product contains a time-based blind SQL injection caused by improper sanitization of the "supplier_no" parameter in the business allocation search feature, letting attackers perform unauthorized database queries, exploit requires crafted input.

  • 9.0 /10 Critical
    CVE-2026-72507 Auth required

    Product Summary Report - SQL Injection

    The product summary report feature in the balancing reports section contains a time-based blind SQL injection caused by improper sanitization of the "reportType" parameter, letting attackers perform SQL injection remotely, exploit requires crafted requests.

  • 10.0 /10 Critical
    CVE-2026-71379 No auth

    Application - Information Disclosure

    The application contains an information disclosure vulnerability caused by an unauthenticated file export endpoint allowing attackers to export arbitrary database tables via crafted POST requests.

  • 9.1 /10 Critical
    CVE-2026-70356 Auth required

    TMS - Unrestricted File Upload

    TMS contains an unrestricted file upload vulnerability caused by lack of server-side file type enforcement in the file upload endpoint, letting attackers upload and execute arbitrary PHP files remotely, exploit requires no special privileges.

  • 9.0 /10 Critical
    CVE-2026-68954 Auth required

    TMS - SQL Injection

    TMS application contains a time-based blind SQL injection caused by unsanitized 'pattern' parameter in the search function on the home page, letting attackers perform blind SQL injection remotely, exploit requires no special privileges.

  • 9.0 /10 Critical
    CVE-2026-68068 Auth required

    Unknown Vendor Unknown Product - SQL Injection

    An unspecified vendor's product contains a time-based blind SQL injection caused by improper sanitization of the "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section, letting attackers perform unauthorized database queries, exploit requires crafted requests.

  • 9.0 /10 Critical
    CVE-2026-63713 Auth required

    Unknown Product - SQL Injection

    The product contains a time-based blind SQL injection caused by unsanitized 'search' parameter in the view audit logs feature within the utilities section, letting attackers perform unauthorized database queries, exploit requires crafted input.

  • 10.0 /10 Critical
    CVE-2026-53988 No auth

    Dockhand - Authentication Bypass

    Dockhand before 1.0.40 contains an authentication bypass caused by a null webhook secret guard condition in git webhook endpoints, letting unauthenticated remote attackers trigger arbitrary stack redeployments, exploit requires no authentication.