Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 109 of 166

  • 9.8 /10 Critical
    CVE-2026-93207 No auth

    Linux Kernel - Use After Free

    Linux kernel contains a memory handling vulnerability in SUNRPC's svcauth_gss_decode_credbody() where partially decoded rpc_gss_wire_cred state can persist across requests, letting attackers cause use-after-free or data corruption, exploit requires crafted RPC requests.

  • 9.9 /10 Critical
    CVE-2026-89078 Auth required

    GitLab - Remote Code Execution

    GitLab CE/EE >= 19.2 and < 19.2.7, >= 19.3 and < 19.3.3, >= 19.4 and < 19.4.1 contains a remote code execution caused by a double free issue in regex parsing in CI/CD configuration, letting authenticated users execute arbitrary code on the server.

  • 9.8 /10 Critical
    CVE-2026-88378 No auth

    QuickJS - Out of Bounds Write

    QuickJS contains a heap out-of-bounds write caused by improper bounds checking in JS_ReadFunctionTag(), letting attackers cause memory corruption, exploit requires crafted input.

  • 9.8 /10 Critical
    CVE-2026-88365 No auth

    minimp3 - Integer Overflow

    minimp3 contains an integer overflow caused by improper parsing of the APEv2 tag-size field in mp3dec_skip_id3v1(), letting attackers cause memory corruption or crash, exploit requires crafted MP3 files.

  • 9.8 /10 Critical
    CVE-2026-88351 No auth

    MPack - Integer Overflow

    MPack 1.1.1 on 32-bit platforms contains an integer overflow caused by improper size calculation in mpack_tree_parse_children() when parsing crafted MessagePack array32 or map32 objects, letting attackers cause heap buffer overflow and denial of service, exploit requires crafted MessagePack data.

  • 9.6 /10 Critical
    CVE-2026-81549 Auth required

    IBM DataStage on Cloud Pak for Data - Information Disclosure

    IBM DataStage on Cloud Pak for Data 5.4.0.0 contains an information disclosure vulnerability caused by improper validation of the X-Forwarded-Proto header, letting remote authenticated attackers obtain sensitive information.

  • 9.1 /10 Critical
    CVE-2026-79766 Auth required

    Termix - Command Injection

    Termix 2.4.1 to 2.5.1 contains a command injection caused by improper sanitization of domain and email values in certbot shell command execution, letting authenticated administrators execute arbitrary OS commands.

  • 9.1 /10 Critical
    CVE-2026-78312 No auth

    DIAEnergie - Path Traversal

    DIAEnergie < 1.11.00.022 contains a path traversal vulnerability, letting attackers access arbitrary files, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-78308 No auth

    DIAEnergie - Authentication Bypass

    DIAEnergie < 1.11.00.022 contains an authentication bypass caused by improper authentication, letting attackers bypass authentication, exploit requires no special conditions.

  • 9.3 /10 Critical
    CVE-2026-61741 No auth

    http4s-scala-xml - XML External Entity Injection

    http4s-scala-xml < 0.24.1 and < 1.0.0-M39 contains an XML External Entity (XXE) injection caused by insecure SAXParserFactory configuration in EntityDecoder, letting attackers disclose local files, perform SSRF, or cause DoS, exploit requires parsing untrusted XML.

  • 10.0 /10 Critical
    CVE-2026-61732 PoC publicNo auth

    Decepticon - Command Injection

    Decepticon < 1.1.17 contains a command injection caused by unneutralized ChatML special-token literals in web crawl results under BYOK deployment, letting attackers bypass agent guardrails and execute arbitrary commands in Kali Linux sandbox, exploit requires attacker to plant malicious strings in target web pages.

  • 9.8 /10 Critical
    CVE-2026-51996 No auth

    Geelen MCP-Remote - Remote Code Execution

    Geelen MCP-Remote 0.1.16 through 0.1.38 contains a remote code execution caused by improper handling in src/lib/utils.ts getServerUrlHash function, letting remote attackers execute arbitrary code, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-51994 PoC public

    mcp-remote - Server-Side Request Forgery

    mcp-remote 0.1.32 through 0.1.38 contains a server-side request forgery caused by processing the resource_metadata URL from a remote MCP server's WWW-Authenticate header, letting attackers make arbitrary server requests, exploit requires crafted header from remote server.

  • 9.9 /10 Critical
    CVE-2026-19072 Auth required

    Velociraptor - Broken Access Control

    Velociraptor contains a broken access control vulnerability caused by allowing the internal field "compiled_collector_args" to be set via user API calls, letting investigator role users escalate privileges to run arbitrary VQL statements as administrators, exploit requires investigator role.

  • 9.8 /10 Critical
    CVE-2026-18467 No auth

    Paytium - Privilege Escalation

    Paytium: Mollie payment forms & donations plugin for WordPress <= 5.0.3 contains a privilege escalation caused by lack of signature verification on pt_cf_checkout_meta filter, letting unauthenticated attackers create admin accounts via payment form submission and payment completion.