Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 112 of 125
- 9.8 /10 CriticalCVE-2026-89613 No auth
Linux Kernel - Denial of Service
Linux kernel contains a denial of service caused by accepting invalid empty mapping pairs in NTFS attributes with inconsistent highest VCN and size, letting attackers cause system instability, exploit requires crafted NTFS attribute.
- 9.8 /10 CriticalCVE-2026-89612 No auth
Linux kernel - Out of Bounds Read
Linux kernel contains an out-of-bounds read caused by improper handling of NTFS boot sector MFT LCNs, letting attackers trigger memory corruption via crafted high-bit values, exploit requires crafted NTFS boot sector.
- 9.8 /10 CriticalCVE-2026-89611 No auth
Linux Kernel ntfs - Memory Corruption
Linux kernel ntfs subsystem contains a buffer overflow vulnerability caused by improper validation of non-resident attribute name offsets during conversion between non-sparse and sparse attributes, letting attackers cause memory corruption, exploit requires crafted malicious MFT record.
- 9.8 /10 CriticalCVE-2026-89610 No auth
Linux Kernel - Privilege Escalation
Linux kernel contains a privilege escalation caused by improper validation of NTFS mapping pairs run length exceeding volume boundary, letting attackers cause memory corruption and escalate privileges, exploit requires crafted NTFS image.
- 9.8 /10 CriticalCVE-2026-89558 No auth
Linux Kernel md/raid10 - Data Corruption
Linux kernel md/raid10 contains a logic error caused by incorrect boolean assignment in raid10_sync_request(), letting attackers cause silent data corruption during device recovery, exploit requires degraded RAID10 array with device failure.
- 9.8 /10 CriticalCVE-2026-89555 No auth
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in mpls_select_multipath caused by stale header pointer after pskb_may_pull() reallocates skb head, letting attackers cause kernel memory corruption, exploit requires crafted Geneve packet with nonlinear skb data.
- 9.8 /10 CriticalCVE-2026-89551 No auth
Linux Kernel - Integer Overflow
Linux kernel contains an integer underflow vulnerability in SUNRPC xdr_buf_trim function caused by improper clamping of buf->len during subtraction, letting attackers cause buffer length miscalculation, exploit requires crafted input triggering xdr_buf_trim.
- 9.8 /10 CriticalCVE-2026-89550 No auth
Linux Kernel - Denial of Service
Linux kernel contains a buffer length validation vulnerability in SUNRPC svcauth_gss component, caused by missing minimum length check on krb5 tokens, letting remote attackers cause a denial of service via crafted tokens, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-89546 No auth
Linux Kernel - Race Condition
Linux kernel contains a race condition in SUNRPC backchannel handling caused by improper teardown of NFS callback service, letting attackers cause resource leaks or use-after-free, exploit requires race condition timing.
- 9.8 /10 CriticalCVE-2026-89542 No auth
Linux Kernel - Memory Corruption & Denial of Service
Linux kernel contains a buffer over-read and integer underflow vulnerability in SUNRPC gss_krb5_unwrap_v2 caused by insufficient validation of token length and buffer boundaries, letting attackers cause memory corruption or denial of service, exploit requires crafted short tokens.
- 9.8 /10 CriticalCVE-2026-89541 No auth
Linux Kernel - Out-of-Bounds Read
Linux kernel contains an out-of-bounds read vulnerability in SUNRPC gss_unwrap_resp_priv due to improper length checks on RPCSEC_GSS opaque length, letting a crafted krb5p NFS server cause memory corruption, exploit requires crafted RPCSEC_GSS reply.
- 9.8 /10 CriticalCVE-2026-89538 No auth
Linux kernel - Authentication Bypass
Linux kernel contains a broken authentication vulnerability in SUNRPC where oversized Kerberos v2 wrap tokens with invalid ec field are not properly rejected, letting attackers with valid GSS context cause semantic buffer inconsistencies, exploit requires valid GSS context.
- 9.1 /10 CriticalCVE-2026-89537
Linux Kernel - Buffer Over-read
Linux kernel contains a buffer over-read vulnerability in SUNRPC gss_krb5_verify_mic_v2 caused by missing length checks on short RFC 4121 MIC tokens, letting malicious NFS servers cause out-of-bounds reads, exploit requires malicious NFS server.
- 9.8 /10 CriticalCVE-2026-89536
CVE-2026-89536
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake callback xs_tls_handshake_sync() gives xs_tls_handshake_done() a reference to the lower transport before submitting the handshake request. On timeout or signal, the synchronous waiter drops that reference after calling tls_handshake_cancel(). handshake_req_cancel() returns false when handshake_complete() has already marked the request complete. In that case the completion callback can still be running, so dropping the callback-owned reference in the waiter can free the lower transport before xs_tls_handshake_done() stores xprt_err or drops its own reference. If cancellation loses to completion, wait until xs_tls_handshake_done() signals handshake_done and let the callback release its reference. This mirrors the server-side handshake lifetime handling and keeps the timeout or signal return value unchanged.
- 9.8 /10 CriticalCVE-2026-89533
Linux Kernel - Integer Overflow
Linux kernel contains an integer underflow and arithmetic defect in svcrdma's svc_rdma_read_chunk_range function, caused by incorrect offset handling in segment length calculation, letting attackers trigger excessive memory allocation, exploit requires crafted RDMA read chunks.