Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 108 of 125

  • 9.8 /10 Critical
    CVE-2026-54334 No auth

    UEFI Firmware Parser - Buffer Overflow

    UEFI Firmware Parser < 1.14 contains a buffer overflow caused by improper bounds checking in ReadCLen() during parsing of Tiano or EFI compressed firmware, letting attackers cause heap corruption, crash, or potential code execution, exploit requires crafted firmware input.

  • 9.8 /10 Critical
    CVE-2026-54333 No auth

    UEFI Firmware Parser - Buffer Overflow

    UEFI Firmware Parser < 1.14 contains a buffer overflow caused by lack of validation of bit-length values in MakeTable() during Tiano or EFI compressed firmware parsing, letting attackers cause stack corruption and potential code execution, exploit requires crafted firmware bitstream.

  • 9.1 /10 Critical
    CVE-2026-53713 Auth required

    Envoy Gateway - Path Traversal

    Envoy Gateway < 1.7.4 and < 1.8.1 contains a file system read caused by improper path normalization in to_absolute_normalized_path in internal/gatewayapi/luavalidator/security.lua, letting attackers read arbitrary files from the gateway controller pod, exploit requires submission of Lua code through EnvoyExtensionPolicy.

  • 9.1 /10 Critical
    CVE-2026-50006 No auth

    Anyquery - SQL Injection

    Anyquery < 0.4.5 contains an unrestricted ATTACH DATABASE vulnerability in its MySQL-compatible server port, letting remote attackers create or overwrite arbitrary files, causing filesystem integrity loss and denial of service, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-43790 No auth

    Apple macOS - Denial of Service

    Apple macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7 contain a memory corruption vulnerability caused by improper memory handling, letting remote attackers cause system termination or kernel memory corruption, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-20353

    CVE-2026-20353

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20353 are related to issues with improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-664.

  • 9.0 /10 Critical
    CVE-2026-18119 Auth required

    Concrete CMS - Stored XSS & Privilege Escalation

    Concrete CMS < 9.5.3 contains a stored cross-site scripting caused by unsanitized custom style values in the Block Design dialog, letting editor-level users execute scripts in administrator sessions and escalate privileges, exploit requires editor access.

  • 9.9 /10 Critical
    CVE-2026-16338 Auth required

    IBM DataStage - Unrestricted File Upload

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an unrestricted file write vulnerability caused by improper validation of file paths, letting remote authenticated attackers write arbitrary files.

  • 9.6 /10 Critical
    CVE-2026-12944 PoC publicAuth required

    IBM Langflow OSS - Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.10.0 contains a remote code execution caused by submission of components with socket or urllib imports, letting attackers execute arbitrary Python code with root privileges, exploit requires crafted component submission.

  • 10.0 /10 Critical
    CVE-2026-81648 PoC publicNo auth

    CryptoPayment Gateway WordPress plugin - Broken Access Control

    CryptoPayment Gateway WordPress plugin 1.2.1 to 1.2.2 contains a broken access control caused by missing authorization check on an AJAX endpoint, letting unauthenticated attackers perform administrative operations including file deletion and credential recovery.

  • 9.8 /10 Critical
    CVE-2026-90558 No auth

    sngrep - Buffer Overflow

    sngrep <= 1.8.4 contains a stack buffer overflow caused by improper handling of oversized SIP header values in attribute formatting routines, letting attackers execute arbitrary code or cause crashes during packet parsing.

  • 9.9 /10 Critical
    CVE-2026-87719 Auth required

    GitLab EE - Information Disclosure

    GitLab EE 18.3 < 19.1.8, 19.2 < 19.2.6, and 19.3 < 19.3.2 contain an information disclosure caused by bypassing serialization in GraphQL subscription arguments, letting authenticated users with Duo Chat access obtain sensitive Advanced Search configurations.

  • 10.0 /10 Critical
    CVE-2026-85706 CISA KEVPoC publicNo auth

    GitLab CE/EE - Path Traversal

    GitLab CE/EE >= 18.7, < 19.1.8, 19.2 < 19.2.6, and 19.3 < 19.3.2 contain a path traversal caused by improper path confinement and missing authentication enforcement in the repository commits API, letting unauthenticated users read arbitrary files.

  • 9.8 /10 Critical
    CVE-2026-85681 No auth

    WP Component WordPress - Broken Access Control

    WP Component WordPress plugin through 2.2.4 contains a broken access control vulnerability caused by lack of capability and nonce checks on an action, letting unauthenticated attackers overwrite site options, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-84171 No auth

    Piclect WordPress plugin - Unrestricted File Upload

    Piclect WordPress plugin <= 1.0 contains an unrestricted file upload vulnerability caused by lack of validation on uploaded file names and types, letting unauthenticated attackers upload arbitrary files and execute code on the server, exploit requires no authentication.