Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 113 of 125
- 9.1 /10 CriticalCVE-2026-89532 No auth
Linux Kernel - Out of Bounds Read
Linux kernel contains an out-of-bounds read caused by incorrect upper bound calculation in svcrdma pcl_for_each_segment macro when processing chunks with zero segments, letting remote attackers cause a general protection fault, exploit requires crafted network packets.
- 9.8 /10 CriticalCVE-2026-89530 No auth
Linux Kernel svcrdma - Buffer Overflow
Linux kernel svcrdma contains a buffer overflow caused by improper handling of inline replies that exceed the pull-up buffer size, letting remote RPC-over-RDMA clients cause memory corruption, exploit requires crafted RPC requests without Write list or Reply chunk.
- 9.8 /10 CriticalCVE-2026-89526 No auth
Linux kernel svcrdma - Buffer Over-read
Linux kernel svcrdma contains a buffer over-read caused by improper validation of RPC/RDMA Read chunk positions, letting remote clients cause memory corruption or information disclosure, exploit requires crafted RPC/RDMA requests.
- 9.8 /10 CriticalCVE-2026-89495 No auth
Linux Kernel ocfs2 - Out-of-Bounds Write & Read
Linux kernel ocfs2 contains a heap out-of-bounds write caused by unbounded peer-controlled length fields in dlm_migrate_request_handler and related handlers, letting any node in a DLM domain corrupt or panic other nodes, exploit requires attacker to be a member of the cluster.
- 9.8 /10 CriticalCVE-2026-89494 No auth
Linux Kernel ocfs2 - Out-of-Bounds Read & Write
Linux kernel ocfs2 contains an out-of-bounds read and heap out-of-bounds write caused by unvalidated num_locks and lockname_len fields in dlm_mig_lockres_handler, letting any node in the domain cause a kernel panic or memory corruption, exploit requires network access within the domain.
- 9.8 /10 CriticalCVE-2026-89492 No auth
Linux Kernel ocfs2 - Out-of-Bounds Read
Linux kernel ocfs2 filesystem contains an out-of-bounds read vulnerability caused by missing bounds checks on directory-index entry counts in metadata blocks, letting attackers with crafted on-disk images cause slab out-of-bounds reads during directory operations, exploit requires mounting a crafted filesystem image.
- 9.8 /10 CriticalCVE-2026-89485 No auth
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in lockd due to improper pinning of the next file pointer during nlm_inspect_file lock-drop, letting attackers cause memory corruption, exploit requires concurrent file operations.
- 9.8 /10 CriticalCVE-2026-89482 No auth
Linux Kernel nvme-tcp - Memory Corruption
Linux kernel nvme-tcp contains a memory corruption vulnerability caused by improper validation of C2HData based on blk_rq_payload_bytes() without checking blk_rq_nr_phys_segments(), letting attackers cause wild memory access and kernel crash, exploit requires crafted network packets targeting WRITE_ZEROES commands.
- 9.8 /10 CriticalCVE-2026-89479 No auth
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in SCTP due to improper handling of association deletion in sctp_endpoint_bh_rcv(), letting remote attackers cause memory corruption by sending crafted SCTP packets, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-89478 No auth
Linux Kernel SCTP - Use After Free
Linux kernel SCTP contains a use-after-free vulnerability caused by a race condition where a removed transport is accessed in SCTP packet processing, letting authenticated attackers cause memory corruption, exploit requires authenticated ASCONF DEL-IP.
- 9.3 /10 CriticalCVE-2026-89448
Linux Kernel - Misconfiguration
Linux kernel contains a misconfiguration vulnerability in iommu/vt-d where ACS is not requested when tboot is enabled, causing potential security bypass due to disabled ACS, exploit requires tboot enabled.
- 9.8 /10 CriticalCVE-2026-89259
Hugo - File System Read & Write
Hugo > v0.43 contains a file read and write vulnerability caused by permissive Node tool execution permissions for TailwindCSS, letting attackers read and write files outside the project directory during build, exploit requires use of TailwindCSS.
- 9.8 /10 CriticalCVE-2026-89010 No auth
WAVLINK WN535M1 & WN535M3 - Command Injection
WAVLINK WN535M1 and WN535M3 routers < M35M1_V250922 contain an unauthenticated command injection caused by unsanitized filename input in sync_server daemon on TCP port 13136, letting remote attackers execute arbitrary root commands.
- 9.1 /10 CriticalCVE-2026-89009 No auth
WAVLINK WN535M - Arbitrary File Write
WAVLINK WN535M1 and WN535M3 routers < M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability caused by lack of path canonicalization in sync_server daemon on TCP port 13136, letting remote attackers overwrite files as root, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-8778 No auth
MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields - Unrestricted File Upload
MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields plugin for WordPress <= 1.2.1 contains an unrestricted file upload vulnerability caused by missing file type validation in the mipl_wc_upload_file function, letting unauthenticated attackers upload arbitrary files, potentially leading to remote code execution, exploit requires no authentication.