Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 120 of 166

  • 9.1 /10 Critical
    CVE-2026-93765 No auth

    Mongoid - Unsafe Reflection

    Mongoid contains an unsafe reflection vulnerability in the document persistence layer caused by unsafe key handling from unauthenticated input, letting attackers cause unintended method invocation and data removal, exploit requires unauthenticated input.

  • 9.8 /10 Critical
    CVE-2026-93762 No auth

    Mongoid - Unsafe Reflection

    Mongoid contains an unsafe reflection weakness in the query path for embedded documents, letting unauthenticated attackers disclose stored data and delete records, exploit requires passing external field names to in-memory query methods.

  • 10.0 /10 Critical
    CVE-2026-93740 No auth

    Totolink A3002MU - Buffer Overflow

    Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "submit-url" argument in /boafrm/formWlEncrypt, letting remote attackers cause memory corruption, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-93739 Auth required

    Totolink A3002MU - Buffer Overflow

    Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "submit-url" argument in /boafrm/formWlAc, letting remote attackers cause memory corruption, exploit requires no special privileges.

  • 9.9 /10 Critical
    CVE-2026-93738 Auth required

    Totolink A3002MU - Buffer Overflow

    Totolink A3002MU Hh-B20211125.1046 contains a buffer overflow caused by manipulation of the "webpage" argument in /boafrm/formSchedule, letting remote attackers cause memory corruption, exploit requires no special privileges.

  • 10.0 /10 Critical
    CVE-2026-93606

    vm2 - Sandbox Escape

    vm2 (npm) <= 3.12.0 contains a sandbox escape caused by improper host Promise rejection sanitization in VM and NodeVM, letting sandboxed code execute arbitrary code on the host, exploit requires exposed host API returning host-realm Promise.

  • 10.0 /10 Critical
    CVE-2026-93605 No auth

    vm2 NodeVM - Remote Code Execution

    vm2 NodeVM < 3.12.1 contains a sandbox escape vulnerability caused by omission of child_process from DANGEROUS_BUILTINS denylist, letting attackers execute arbitrary commands on the host when configured with builtin:['*'] or explicit child_process allowance.

  • 10.0 /10 Critical
    CVE-2026-93603 No auth

    vm2 - Sandbox Escape

    vm2 <= 3.12.0 contains a sandbox escape caused by improper handling of nullish `this` receiver in the apply trap of its bridge, letting sandboxed code execute arbitrary commands on the host, exploit requires exposure of non-strict host functions.

  • 9.8 /10 Critical
    CVE-2026-93467 No auth

    HGiga OAKlouds - Insecure Deserialization

    HGiga OAKlouds contains an insecure deserialization vulnerability caused by processing maliciously crafted serialized content, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-93019 No auth

    Perl Imager - Denial of Service

    Perl Imager < 1.036 contains a denial of service caused by improper handling of large TGA colour map length in tga_palette_read, letting attackers cause uncatchable process exit by reading crafted TGA files, exploit requires attacker-supplied file input.

  • 9.1 /10 Critical
    CVE-2026-92702 No auth

    Cocos AI - Authentication Bypass

    Cocos AI <= 0.8.2 contains an attestation freshness enforcement bypass caused by missing or empty expected reportData in the intra-handshake attested TLS AMD SEV-SNP verification path, letting attackers supply stale or unrelated evidence, exploit requires omission of expected reportData.

  • 9.1 /10 Critical
    CVE-2026-92701 PoC publicNo auth

    Trusted Execution Environments - Authentication Bypass

    Trusted Execution Environments up to 0.8.2 contain a session-misbinding vulnerability caused by missing freshness value copy in Intel TDX quote validation, letting attackers bind sessions to unintended attestation contexts, exploit requires crafted TDX QuoteV4 Evidence.

  • 9.9 /10 Critical
    CVE-2026-85878 Auth required

    Azure Database for PostgreSQL - Broken Access Control

    Azure Database for PostgreSQL contains a broken access control vulnerability caused by improper authorization, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.

  • 9.8 /10 Critical
    CVE-2026-85497

    CareCam CM2507 - Authentication Bypass

    CareCam CM2507 IP cameras contain a broken authentication caused by storing root-account password using a fixed legacy password hash, letting attackers recover credentials offline, exploit requires access to firmware or password database.

  • 9.1 /10 Critical
    CVE-2026-84738 Auth required

    AF Companion WordPress plugin - Unrestricted File Upload

    AF Companion WordPress plugin < 2.2.0 contains an unrestricted file upload vulnerability caused by lack of file type validation in import feature, letting low-privileged store-management users execute remote code.