Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 99 of 125

  • 9.6 /10 Critical
    CVE-2026-83040 No auth

    Oracle WebCenter Portal - Remote Code Execution

    Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contain a remote code execution caused by unauthenticated network access via SOAP, letting unauthenticated attackers with user interaction take over the portal, exploit requires human interaction from a third party.

  • 9.9 /10 Critical
    CVE-2026-83039 Auth required

    Oracle WebCenter Portal - Authentication Bypass

    Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contains a critical vulnerability in Composer, letting low privileged attackers with network access via HTTP fully compromise the portal and impact additional products, exploit requires network access.

  • 9.9 /10 Critical
    CVE-2026-83038 Auth required

    Oracle WebLogic Server - Remote Code Execution

    Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contain a remote code execution caused by a vulnerability in TopLink Integration, letting low privileged attackers with network access via HTTP take over the server, exploit requires network access with low privileges.

  • 9.8 /10 Critical
    CVE-2026-83037 No auth

    Oracle WebCenter Sites - Remote Code Execution

    Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 contain a remote code execution vulnerability caused by unauthenticated network access via HTTP, letting unauthenticated attackers fully compromise the system, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-83036 No auth

    Oracle WebCenter Sites - Remote Code Execution

    Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 contain a remote code execution caused by an easily exploitable vulnerability accessible via HTTP, letting unauthenticated attackers fully compromise the system, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-83035 No auth

    Oracle WebCenter Sites - Remote Code Execution

    Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 contain a remote code execution vulnerability caused by unauthenticated network access via HTTP, letting attackers fully compromise the system, exploit requires network access.

  • 9.9 /10 Critical
    CVE-2026-83031 Auth required

    Oracle WebCenter Sites - Remote Code Execution

    Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 contain a remote code execution caused by an easily exploitable vulnerability accessible via HTTP, letting low privileged attackers with network access take over the system, exploit requires low privileges and network access.

  • 9.6 /10 Critical
    CVE-2026-83029 Auth required

    Oracle Managed File Transfer - Broken Access Control

    Oracle Managed File Transfer 12.2.1.4.0 and 14.1.2.0.0 contain a broken access control vulnerability caused by improper authorization in MFT Runtime Server, letting low privileged attackers with network access via HTTP modify or access critical data, exploit requires low privileged network access.

  • 9.3 /10 Critical
    CVE-2026-83027

    Oracle Identity Manager Connector - Broken Access Control

    Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 contains an unauthorized data access vulnerability caused by insufficient access control in the core component, letting unauthenticated attackers with physical network access create, delete, or modify critical data, exploit requires access to the physical communication segment.

  • 10.0 /10 Critical
    CVE-2026-83021 No auth

    Oracle WebLogic Server - Remote Code Execution

    Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 contain a remote code execution caused by unauthenticated network access via HTTP, letting attackers fully compromise the server, exploit requires network access.

  • 10.0 /10 Critical
    CVE-2026-83020 No auth

    Oracle Platform Security for Java - Remote Code Execution

    Oracle Platform Security for Java 12.2.1.4.0 and 14.1.2.0.0 contains a remote code execution caused by unauthenticated network access via HTTP, letting attackers fully compromise the system, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-83006 Auth required

    Oracle WebCenter Enterprise Capture - Remote Code Execution

    Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 contains a remote code execution caused by an easily exploitable vulnerability in Client Bundle, letting high privileged attackers with network access via HTTP take over the system, exploit requires high privileges.

  • 9.1 /10 Critical
    CVE-2026-83001 Auth required

    Oracle Access Manager - Authentication Bypass

    Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 contain an authentication bypass caused by a vulnerability in the Authentication Engine, letting high privileged attackers with network access via HTTP take over the system, exploit requires high privileges.

  • 9.8 /10 Critical
    CVE-2026-83000 No auth

    Oracle Fusion Middleware Service Delivery Platform - Remote Code Execution

    Oracle Fusion Middleware Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 contains a remote code execution caused by unauthenticated network access via HTTP, letting attackers fully compromise the platform, exploit requires network access.

  • 9.9 /10 Critical
    CVE-2026-82999 Auth required

    Oracle Fusion Middleware Service Delivery Platform - Remote Code Execution

    Oracle Fusion Middleware Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 contains a remote code execution caused by a vulnerability in Messaging Enabler, letting low privileged attackers with network access via HTTP take over the platform, exploit requires low privilege network access.