Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 101 of 166

  • 9.6 /10 Critical
    CVE-2026-102304 No auth

    Google Chrome - Use After Free

    Google Chrome < 154.0.8037.92 contains a use after free vulnerability in Passwords, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 10.0 /10 Critical
    CVE-2026-102240 No auth

    Netcore NAP930 - Command Injection

    Netcore NAP930 0.1.241010.141410 contains a command injection caused by manipulation of the "sid" argument in /www/cgi-bin/network_tools Network Tools CGI, letting remote attackers execute OS commands, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-101354 No auth

    FAST FAC1203R - Buffer Overflow

    FAST FAC1203R 20200116_2.0.4 contains a stack-based buffer overflow caused by manipulation in _tWlanTask function of MmtAtePrase Parser, letting local network attackers execute code, exploit requires local network access.

  • 9.1 /10 Critical
    CVE-2026-101264 Auth required

    Ziroom ZHOME A0101 - Command Injection

    Ziroom ZHOME A0101 1.0.1.0 contains a command injection caused by manipulation of the "password1" argument in /api/ZRnetwork/set_passwd, letting remote attackers execute arbitrary commands, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-101263 Auth required

    Ziroom ZHOME A0101 - Command Injection

    Ziroom ZHOME A0101 1.0.1.0 contains a command injection caused by manipulation of the "mac" argument in /api/ZRQos/set_online_client, letting remote attackers execute arbitrary commands, exploit requires no special privileges.

  • 9.4 /10 Critical
    CVE-2026-101127 No auth

    Joomla Balbooa Forms - Stored XSS

    Balbooa Forms < 2.4.3.4 contains a stored XSS caused by storing attacker-supplied original multipart filename verbatim in submission attachments, letting unauthenticated attackers execute script when admin views submission, exploit requires admin to open submission.

  • 9.6 /10 Critical
    CVE-2026-100829 No auth

    Firefox ESR - Mitigation Bypass

    Firefox ESR contains a mitigation bypass caused by a flaw in the DOM security component, letting attackers bypass security mitigations, exploit requires no special conditions.

  • 9.6 /10 Critical
    CVE-2026-100828

    Firefox ESR - Mitigation Bypass

    Firefox ESR contains a mitigation bypass vulnerability in the Bookmarks & History component, letting attackers bypass security mitigations, exploit requires unspecified conditions.

  • 9.6 /10 Critical
    CVE-2026-100819 No auth

    Mozilla Firefox - Sandbox Escape

    Mozilla Firefox contains a sandbox escape caused by incorrect boundary conditions in the XPCOM component, letting attackers escape sandbox restrictions, exploit requires no special conditions.

  • 9.6 /10 Critical
    CVE-2026-100818 No auth

    Firefox - Sandbox Escape

    Firefox ESR < 153.4, Firefox < 157, and Firefox ESR < 140.17 contain a sandbox escape caused by use-after-free in the Widget: Gtk component, letting attackers escape sandbox restrictions, exploit requires crafted input.

  • 9.6 /10 Critical
    CVE-2026-100811 No auth

    Mozilla Firefox - Sandbox Escape

    Mozilla Firefox < 157 and Firefox ESR < 153.4 contain a sandbox escape caused by use-after-free in the DOM: Core & HTML component, letting attackers escape sandbox restrictions, exploit requires crafted web content.

  • 9.8 /10 Critical
    CVE-2026-100810

    CVE-2026-100810

    Other issue in the DevTools component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.

  • 9.6 /10 Critical
    CVE-2026-100804 No auth

    Firefox - Sandbox Escape

    Firefox contains a use-after-free vulnerability in the Preferences: Backend component, letting attackers escape sandbox restrictions, exploit requires triggering use-after-free condition.

  • 9.6 /10 Critical
    CVE-2026-100800

    Firefox - Sandbox Escape

    Firefox ESR < 153.4 and Firefox < 157 contain a use-after-free vulnerability in the Disability Access APIs component, letting attackers escape sandbox restrictions, exploit requires triggering the use-after-free condition.

  • 9.6 /10 Critical
    CVE-2026-100794 No auth

    Mozilla Firefox - Sandbox Escape

    Mozilla Firefox ESR < 153.4, Firefox < 157, and Firefox ESR < 140.17 contain a sandbox escape caused by incorrect boundary conditions in the Internationalization component, letting attackers escape sandbox restrictions, exploit requires crafted input.