Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 111 of 125
- 9.8 /10 CriticalCVE-2026-89654
Linux kernel ceph - Use After Free
Linux kernel ceph contains a use-after-free vulnerability in check_new_map() caused by missing reference counting on session objects during mutex unlock, letting concurrent threads access freed memory, exploit requires concurrent session teardown.
- 9.8 /10 CriticalCVE-2026-89653 No auth
Linux Kernel - Out of Bounds Read/Write
Linux kernel contains a buffer overflow caused by unchecked export_targets ranks in ceph mdsmap decode, letting attackers cause memory corruption by providing ranks >= CEPH_MAX_MDS, exploit requires crafted mdsmap data.
- 9.8 /10 CriticalCVE-2026-89652
Linux kernel Ceph - Buffer Overflow
Linux kernel Ceph contains a buffer overflow caused by unchecked dname_len in ceph_get_name and __get_snap_name functions, letting malicious or compromised Ceph MDS cause out-of-bounds write, exploit requires CephFS mount re-exported over NFS.
- 9.8 /10 CriticalCVE-2026-89651 No auth
Linux Kernel ceph - Out-of-Bounds Read
Linux kernel contains an out-of-bounds read vulnerability in ceph handle_session() due to missing bounds checks on MDSCapAuth path and fs_name decoding, letting malicious MDS crash the client during session setup without user interaction.
- 9.1 /10 CriticalCVE-2026-89650
Linux Kernel Ceph - Out-of-Bounds Read
Linux kernel Ceph component (info_v 2 and 3) contains an out-of-bounds read caused by missing bounds check on num_export_targets in ceph_mdsmap_decode(), letting malicious or compromised Ceph monitors trigger kernel memory read, exploit requires a malicious or compromised Ceph monitor or on-path attacker on unsigned messenger session.
- 9.1 /10 CriticalCVE-2026-89649 No auth
Linux kernel CephFS - Information Disclosure
Linux kernel CephFS contains an information disclosure vulnerability caused by missing bounds check on the last xattr value length in __build_xattrs(), letting a malicious metadata server disclose adjacent kernel heap bytes to local users via getxattr(2), exploit requires local user access.
- 9.8 /10 CriticalCVE-2026-89643
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in audit_del_rule() caused by improper handling of tree references during fsnotify rule autoremove, letting attackers cause system instability or denial of service, exploit requires triggering fsnotify autoremove.
- 9.8 /10 CriticalCVE-2026-89637 No auth
Linux kernel smb client - Use After Free
Linux kernel smb client contains a use-after-free and buffer leak caused by improper handling of malformed secondary TRANSACT2 responses in cifs_check_trans2(), letting attackers cause memory corruption, exploit requires crafted malformed secondary T2 response.
- 9.8 /10 CriticalCVE-2026-89636 No auth
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability caused by ce->tgthint pointing to freed cache_dfs_tgt structures in smb client free_tgts(), letting attackers cause memory corruption or denial of service, exploit requires triggering smb client target list free.
- 9.8 /10 CriticalCVE-2026-89635 No auth
Linux Kernel ksmbd - Use After Free
Linux kernel ksmbd contains a use-after-free vulnerability caused by rebinding oplocks of all detached durable handles on an inode to a reconnecting session instead of only the file's own, letting authenticated attackers cause kernel memory corruption during durable reconnects, exploit requires multiple sessions with durable handles on the same file.
- 9.1 /10 CriticalCVE-2026-89634 No auth
Linux Kernel smb client - Out of Bounds Read & Denial of Service
Linux kernel contains a buffer overflow caused by an ALIGN() overflow in smb client symlink_data() error context loop, letting attackers cause out-of-bounds read or infinite loop, exploit requires crafted SMB response.
- 9.8 /10 CriticalCVE-2026-89633 No auth
Linux Kernel smb client - Out-of-Bounds Read/Write
Linux kernel smb client contains an out-of-bounds read/write caused by unvalidated DataOffset in coalesce_t2(), letting attackers cause memory corruption or crash, exploit requires crafted SMB packets.
- 9.1 /10 CriticalCVE-2026-89631 No auth
Linux kernel smb client - Out of Bounds Read
Linux kernel smb client contains a buffer overflow caused by improper bounds checking of tree connect response byte count in CIFSTCon(), letting attackers cause memory corruption, exploit requires crafted server response.
- 9.1 /10 CriticalCVE-2026-89630 No auth
Linux Kernel smb client - Broken Access Control
Linux kernel smb client contains a broken access control vulnerability caused by incorrect data_offset bound check in is_valid_oplock_break(), letting attackers bypass read overflow protections, exploit requires crafted SMB messages.
- 9.8 /10 CriticalCVE-2026-89614 No auth
Linux Kernel - Out of Bounds Read
Linux kernel ntfs contains an out-of-bounds read caused by improper bounding of the free-cluster bitmap scan in ntfs_cluster_alloc, letting attackers trigger kernel memory corruption, exploit requires crafted NTFS volume with oversized $Bitmap.