Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 10 of 125

  • 9.1 /10 Critical
    CVE-2026-96252 No auth

    Active Directory Federation Services - Spoofing

    Active Directory Federation Services contains a spoofing vulnerability caused by improper verification of cryptographic signatures, letting unauthorized attackers perform spoofing over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-96219 No auth

    Windows LSASS - Remote Code Execution

    Windows Local Security Authority Subsystem Service (LSASS) contains an out-of-bounds write vulnerability allowing unauthorized attackers to execute code remotely, exploit requires network access.

  • 9.9 /10 Critical
    CVE-2026-96119 Auth required

    IBM i - Remote Code Execution & Information Disclosure

    IBM i 7.3, 7.4, 7.5, and 7.6 contain a remote code execution and information disclosure vulnerability caused by improper data sanitization in the HTTP Server Administration web application, letting remote authenticated attackers execute arbitrary code or obtain sensitive information.

  • 9.8 /10 Critical
    CVE-2026-96113 No auth

    DNS Server - Remote Code Execution

    DNS Server contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-96096 No auth

    Windows Media Player - Remote Code Execution

    Windows Media Player contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 10.0 /10 Critical
    CVE-2026-94603 No auth

    Podman - Broken Access Control

    Podman 4.4.0 to 5.8.8 and 6.1.3 contains a broken access control vulnerability caused by treating images with io.podman.annotations.checkpoint.runtime.name annotation as checkpoints, letting attackers bypass container creation restrictions, exploit requires use of affected image annotations.

  • 9.1 /10 Critical
    CVE-2026-93909 No auth

    IBM WebSphere Application Server Liberty - Authentication Bypass

    IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 contains an authentication bypass caused by samlWeb-2.0 feature enabled, letting attackers bypass authentication, exploit requires samlWeb-2.0 feature enabled.

  • 9.1 /10 Critical
    CVE-2026-93895 No auth

    IBM WebSphere Application Server Liberty - Access Control Bypass

    IBM WebSphere Application Server Liberty 20.0.0.12 through 26.0.0.10 contains an access control bypass caused by improper enforcement on gRPC service methods, letting unauthenticated remote attackers bypass access controls.

  • 9.8 /10 Critical
    CVE-2026-92909 No auth

    Adobe Commerce - Broken Access Control

    Adobe Commerce contains an incorrect authorization vulnerability that allows arbitrary code execution in the context of the current user, letting attackers execute arbitrary code without user interaction.

  • 9.0 /10 Critical
    CVE-2026-92892

    CVE-2026-92892

    Potential arbitrary code execution, under specific configurations.

  • 9.1 /10 Critical
    CVE-2026-92464 Auth required

    Adobe Commerce - Remote Code Execution

    Adobe Commerce contains an improper input validation vulnerability that allows attackers with high privileges to execute arbitrary code in the context of the current user, exploit requires high privileges.

  • 9.3 /10 Critical
    CVE-2026-91013 No auth

    Adobe Commerce - Stored XSS

    Adobe Commerce contains a stored XSS caused by improper sanitization of form fields, letting attackers inject malicious scripts executed in victim browsers, potentially leading to elevated access or session control, exploit requires victim to visit the vulnerable page.

  • 10.0 /10 Critical
    CVE-2026-90532 No auth

    Adobe Experience Manager - Broken Access Control

    Adobe Experience Manager contains an incorrect authorization vulnerability caused by improper access control, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.6 /10 Critical
    CVE-2026-90531 Auth required

    Adobe Experience Manager - Privilege Escalation

    Adobe Experience Manager contains an XML External Entity Injection (XXE) vulnerability caused by improper restriction of XML external entity references, letting low-privileged attackers escalate privileges, exploit requires no user interaction.

  • 9.3 /10 Critical
    CVE-2026-90530 No auth

    ColdFusion RDS - Path Traversal

    ColdFusion RDS contains a path traversal vulnerability caused by improper limitation of pathname to restricted directories, letting attackers read arbitrary files outside intended scope, exploit requires no user interaction.