Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 106 of 125

  • 9.8 /10 Critical
    CVE-2026-82787 No auth

    CPSL-08P1EN - Authentication Bypass

    CPSL-08P1EN contains a broken authentication caused by missing authentication for critical functions, letting remote attackers operate the product without authentication, exploit requires no special conditions.

  • 9.1 /10 Critical
    CVE-2026-82441 No auth

    Apache Storm - Broken Access Control

    Apache Storm before 3.1.0 contains a broken access control vulnerability caused by lack of validation on blobstore dependency keys in topology submissions, letting attackers delete blobs of other topologies or cause leadership loss, exploit requires submitting crafted topology with malicious keys.

  • 9.8 /10 Critical
    CVE-2026-82439 No auth

    Apache Storm DRPC - Denial of Service

    Apache Storm DRPC server contains a memory exhaustion vulnerability caused by unbounded retention of function name entries in request queues, letting unauthenticated attackers exhaust server heap by sending distinct function names, exploit requires no credentials.

  • 9.8 /10 Critical
    CVE-2026-82435 No auth

    Apache Storm - Denial of Service

    Apache Storm contains a denial of service vulnerability caused by the Netty message decoder allocating large buffers before SASL authentication, letting unauthenticated attackers with TCP access to worker ports cause resource exhaustion, exploit requires TCP reachability to worker port.

  • 9.8 /10 Critical
    CVE-2026-82431 No auth

    Apache Storm - Broken Access Control

    Apache Storm < 3.1.0 contains a broken access control caused by improper evaluation of nimbus.groups when nimbus.users is empty in SimpleACLAuthorizer, letting authenticated operators bypass group restrictions and perform all user-level operations, exploit requires cluster access with authentication.

  • 9.8 /10 Critical
    CVE-2026-82232 No auth

    Apache Syncope - SQL Injection

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an SQL injection caused by unsanitized sort clauses in Task search, letting administrators execute arbitrary SQL via stacked queries, exploit requires administrator privileges.

  • 9.8 /10 Critical
    CVE-2026-78330 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an incorrect privilege assignment vulnerability caused by disclosure of JWKS settings in internal JWT authentication, letting attackers escalate to admin privileges after authentication, exploit requires valid low-privilege JWT.

  • 9.1 /10 Critical
    CVE-2026-78299 No auth

    Eclipse Embedded CDT - Unrestricted File Upload

    Eclipse Embedded CDT 6.0 to 6.7 contains an unrestricted file write vulnerability caused by extraction of a compromised CMSIS pack archive, letting attackers write arbitrary files outside intended directories, exploit requires crafted CMSIS pack.

  • 9.8 /10 Critical
    CVE-2026-77181 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an incorrect authorization vulnerability caused by improper entitlement checks on ClientApp update operations, letting administrators perform unauthorized actions, exploit requires administrator privileges.

  • 9.8 /10 Critical
    CVE-2026-77051 No auth

    Apache Syncope - SQL Injection

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an SQL injection caused by unsanitized entityKey and opEvent parameters, letting administrators execute arbitrary SQL via stacked queries, exploit requires administrator privileges.

  • 9.8 /10 Critical
    CVE-2026-76461 CISA KEVPoC publicNo auth

    Cisco AsyncOS Software for Cisco Secure Email Gateway - Command Injection

    Cisco AsyncOS Software for Cisco Secure Email Gateway contains a command injection caused by insufficient validation in email parsing logic, letting unauthenticated remote attackers execute arbitrary commands with root privileges, exploit requires sending crafted email messages.

  • 9.8 /10 Critical
    CVE-2026-76443

    CVE-2026-76443

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76443 are related to issues with improper neutralization that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-707.

  • 9.8 /10 Critical
    CVE-2026-76441 No auth

    Cisco Secure Email Gateway & Secure Email and Web Manager - Broken Access Control

    Cisco Secure Email Gateway and Cisco Secure Email and Web Manager contain an improper access control vulnerability caused by insufficient authorization checks, letting attackers gain unauthorized access, exploit requires no special conditions.

  • 9.8 /10 Critical
    CVE-2026-76440 No auth

    Cisco Secure Email Gateway & Secure Email and Web Manager - Path Traversal

    Cisco Secure Email Gateway and Cisco Secure Email and Web Manager contain path traversal vulnerabilities caused by improper input validation, letting attackers access unauthorized files, exploit requires crafted requests.

  • 9.8 /10 Critical
    CVE-2026-75030 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain a missing authorization vulnerability caused by insufficient group administration checks, letting administrators with task execution entitlements mass (de)provision group members beyond their privileges, exploit requires administrator with task execution entitlements.