Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 11 of 125
- 10.0 /10 CriticalCVE-2026-89309
CVE-2026-89309
The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for GET and HEAD requests; requests using any other HTTP method are processed without an authentication check. Second, for any HTTP method including GET and HEAD, a request carrying a malformed or non-bearer Authorization header is passed through without a valid token being required. The middleware does validate a token whenever a well-formed one is present, but in these two cases it does not require one. A remote attacker with network access to the service can therefore invoke API functionality without valid credentials.
- 10.0 /10 CriticalCVE-2026-89111
SAP Cloud SDK for Python - Server Side Request Forgery
SAP Cloud SDK for Python contains a server side request forgery caused by improper validation of tenant_subdomain parameter in OAuth2 token requests, letting attackers exfiltrate client credentials by redirecting requests to attacker-controlled servers, exploit requires control over tenant_subdomain parameter.
- 9.9 /10 CriticalCVE-2026-89110 Auth required
SAP NetWeaver Visual Composer - Broken Access Control
SAP NetWeaver Visual Composer contains a broken access control vulnerability caused by insufficient authorization checks in portal functionality, letting low-privilege attackers invoke internal operations on remote systems, potentially leading to full system compromise.
- 9.1 /10 CriticalCVE-2026-89108 Auth required
SAP Manufacturing Integration and Intelligence - Broken Access Control
SAP Manufacturing Integration and Intelligence contains a broken access control vulnerability caused by insufficient enforcement of authorization boundaries in administrative functions, letting attackers with MII administrator privileges escalate privileges on the underlying Java application server, exploit requires MII administrator privileges.
- 9.9 /10 CriticalCVE-2026-89107 Auth required
SAP S/4HANA - Insecure Deserialization
SAP S/4HANA contains an insecure deserialization vulnerability caused by insufficient validation of input in rule definition functionality using a domain-specific scripting language, letting authenticated attackers with specific business privileges execute arbitrary ABAP code, exploit requires specific business privileges.
- 9.8 /10 CriticalCVE-2026-88178 No auth
Microsoft Office PowerPoint - Remote Code Execution
Microsoft Office PowerPoint contains a use after free vulnerability allowing unauthorized attackers to execute code remotely over a network, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-88156 No auth
Microsoft Office Outlook - Remote Code Execution
Microsoft Office Outlook contains a stack-based buffer overflow caused by improper handling of input, letting unauthorized attackers execute code remotely, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-88102 No auth
Windows Failover Cluster - Remote Code Execution
Windows Failover Cluster contains a use after free vulnerability allowing unauthorized attackers to execute code remotely over a network, exploit requires network access.
- 9.4 /10 CriticalCVE-2026-88092 No auth
ASP.NET Core - HTTP Request Smuggling
ASP.NET Core contains an HTTP request smuggling vulnerability caused by inconsistent interpretation of HTTP requests, letting unauthorized attackers perform tampering over a network, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-87689 No auth
Metasploit Framework - Broken Access Control
Metasploit Framework <= 6.5.4 contains a broken access control vulnerability caused by missing authentication in update_credential and delete_credentials API handlers, letting unauthenticated attackers read, modify, or delete stored credentials remotely, exploit requires network access to the web service.
- 9.8 /10 CriticalCVE-2026-85928 No auth
Windows Volume Manager Extension Driver - Remote Code Execution
Windows Volume Manager Extension Driver contains a heap-based buffer overflow, letting unauthorized attackers execute code remotely over a network, exploit requires network access.
- 9.0 /10 CriticalCVE-2026-85818 No auth
Windows Schannel - Spoofing
Windows Schannel contains a cryptographic signature verification flaw, letting unauthorized attackers perform network spoofing, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-85814 No auth
Microsoft Windows Media Foundation - Remote Code Execution
Microsoft Windows Media Foundation contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-85809 No auth
Windows Routing and Remote Access Service - Remote Code Execution
Windows Routing and Remote Access Service contains a remote code execution vulnerability allowing attackers to gain unauthorized access to victim's machine, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-85806 No auth
Network Policy Server - Remote Code Execution
Network Policy Server contains an integer underflow caused by improper handling of integer values, letting unauthorized attackers execute code over the network, exploit requires network access.