Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 119 of 125

  • 9.1 /10 Critical
    CVE-2026-19646 No auth

    IBM Common Licensing Agent - Open Redirect

    IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 contain an open redirect caused by improper validation of the HTTP Host header, letting remote attackers redirect users to arbitrary domains, exploit requires crafted HTTP requests.

  • 9.9 /10 Critical
    CVE-2026-19583 Auth required

    Velociraptor - Broken Access Control

    Velociraptor contains a broken access control vulnerability caused by missing permission checks on client monitoring artifacts, letting users schedule restricted artifacts like Linux.Sys.BashShell, exploit requires scheduling privileges.

  • 9.8 /10 Critical
    CVE-2026-18351 PoC publicNo auth

    Elementor Drag and Drop File Upload - Unrestricted File Upload

    Elementor Drag and Drop File Upload plugin for WordPress <= 1.6.0 contains an arbitrary file upload vulnerability caused by insufficient file type validation in is_file_type_valid(), letting unauthenticated attackers upload executable files and achieve remote code execution.

  • 9.8 /10 Critical
    CVE-2026-87929 No auth

    MaxSite CMS - Authentication Bypass

    MaxSite CMS through 109.6 contains a broken authentication caused by a hardcoded session encryption key in application/config/config.php, letting unauthenticated attackers forge administrator session cookies, exploit requires knowledge of the hardcoded key.

  • 9.6 /10 Critical
    CVE-2026-87911 No auth

    Amazon awslabs postgres-mcp-server - Command Injection

    Amazon awslabs postgres-mcp-server < 1.1.7 contains an OS command injection caused by improper read-only enforcement in the SQL validation component, letting unauthenticated actors execute OS commands via crafted COPY ... TO PROGRAM statements, exploit requires authenticated user interaction.

  • 9.6 /10 Critical
    CVE-2026-87654 No auth

    Google Chrome - Buffer Overflow

    Google Chrome < 153.0.8010.36 contains a buffer overflow in ANGLE on Windows, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-87650 No auth

    Google Chrome - Out of Bounds Read

    Google Chrome < 153.0.8010.36 contains an out of bounds read in WebGL, letting remote attackers potentially execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-87646 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in Web Authentication, caused by improper memory handling, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-87643 No auth

    Google Chrome - Integer Overflow

    Google Chrome on Android < 153.0.8010.36 contains an integer overflow in GPU, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires victim to visit malicious page.

  • 9.6 /10 Critical
    CVE-2026-87638 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.36 contains an out of bounds write in Media component, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-87637 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free caused by improper memory handling in Extensions, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-87634 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in WebPackaging, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires crafted HTML page.

  • 9.6 /10 Critical
    CVE-2026-87621 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.36 contains an out of bounds write caused by improper memory handling in ANGLE, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.0 /10 Critical
    CVE-2026-87613 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.36 contains a remote code execution caused by incorrect reference resolution in Extensions, letting remote attackers execute arbitrary code outside the sandbox via crafted network traffic, exploit requires network access.

  • 9.6 /10 Critical
    CVE-2026-87609 No auth

    Google Chrome - Use After Free

    Google Chrome on iOS < 153.0.8010.36 contains a use after free vulnerability in Sharing, letting remote attackers execute arbitrary code outside the sandbox via crafted network traffic.