Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 105 of 125

  • 9.9 /10 Critical
    CVE-2026-90693 Auth required

    D-Link DIR-878 - Buffer Overflow

    D-Link DIR-878 120B05 contains a stack-based buffer overflow caused by manipulation of the Primary/Secondary argument in SetWan3Settings of WAN Settings, letting remote attackers execute arbitrary code, exploit requires network access.

  • 9.9 /10 Critical
    CVE-2026-90692 Auth required

    D-Link DIR-878 - Buffer Overflow

    D-Link DIR-878 120B05 contains a stack-based buffer overflow caused by manipulation of the IPv6Address/Hostname argument in SetDynamicDNSIPv6Settings, letting remote attackers execute arbitrary code, exploit requires crafted request.

  • 9.9 /10 Critical
    CVE-2026-90680 Auth required

    D-Link DIR-823G - Buffer Overflow

    D-Link DIR-823G 1.0.2B05_20181207 contains a stack-based buffer overflow caused by improper handling of PAddress/SubnetMask/Gateway arguments in /HNAP1/SetStaticRouteSettings, letting remote attackers execute code, exploit requires crafted request.

  • 9.9 /10 Critical
    CVE-2026-90608 Auth required

    Totolink A3002MU - Buffer Overflow

    Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "service_type" argument in /boafrm/formPortFw component boa, letting remote attackers cause memory corruption, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-90607 Auth required

    Totolink A3002MU - Buffer Overflow

    Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "submit-url" argument in /boafrm/formNewSchedule component boa, letting remote attackers cause memory corruption, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-90606 Auth required

    Totolink A3002MU - Buffer Overflow

    Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "static_ipv6" argument in /boafrm/formIpv6Setup component boa, letting remote attackers cause memory corruption, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-90605 Auth required

    Totolink A3002MU - Buffer Overflow

    Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "ip6addr" argument in /boafrm/formFilter component boa, letting remote attackers cause memory corruption, exploit requires crafted request.

  • 9.1 /10 Critical
    CVE-2026-87802

    Apache Syncope - Authentication Bypass

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an authentication bypass caused by improper verification of cryptographic signatures in OAuth 2.0 SRA configuration without JWKS URI, letting attackers forge JWTs to impersonate users and gain full access, exploit requires misconfigured OAuth 2.0 SRA without JWKS URI.

  • 9.1 /10 Critical
    CVE-2026-87785 No auth

    Apache Syncope - Authentication Bypass

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an authentication bypass caused by JWKS settings disclosure in internal JWT authentication, letting attackers spoof user privileges after valid authentication.

  • 9.1 /10 Critical
    CVE-2026-86881 PoC public

    Apple - Authentication Bypass

    Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain a certificate validation bypass caused by improper validation of intermediate certificate authorities, letting attackers with compromised intermediate CAs issue certificates with arbitrary extended key usages, exploit requires compromised intermediate CA.

  • 9.8 /10 Critical
    CVE-2026-86460 No auth

    Apache Syncope - NoSQL Injection

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain a cypher injection caused by improper handling of FIQL search conditions in the Neo4j persistence layer, letting attackers execute arbitrary queries, exploit requires crafted search conditions.

  • 9.1 /10 Critical
    CVE-2026-84625 No auth

    Apple - Broken Access Control

    Apple iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27, and watchOS 27 contain a broken access control caused by insufficient sandbox restrictions, letting apps fingerprint users, exploit requires app installation.

  • 9.8 /10 Critical
    CVE-2026-84609 No auth

    Apple - Broken Access Control

    Apple iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain a broken access control caused by insufficient path validation, letting apps modify protected system files, exploit requires app execution.

  • 9.8 /10 Critical
    CVE-2026-84561 No auth

    Apple - Use After Free

    Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain a use after free caused by improper memory management, letting apps cause system termination or kernel memory corruption, exploit requires app execution.

  • 9.8 /10 Critical
    CVE-2026-84520 PoC publicNo auth

    Apple macOS Golden Gate - Buffer Overflow

    Apple macOS Golden Gate 27 contains a buffer overflow caused by insufficient size validation, letting local attackers cause system termination or kernel memory corruption, exploit requires local access.