Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 121 of 166

  • 9.8 /10 Critical
    CVE-2026-84383 PoC publicNo auth

    libheif - Heap Out-of-Bounds Write

    libheif 1.22.0 to < 1.23.2 contains a heap out-of-bounds write caused by improper handling of nested iden and auxl references in Alpha planes during image decoding, letting remote attackers cause memory corruption via crafted files, exploit requires processing a crafted HEIF, HEIC, or AVIF file.

  • 9.8 /10 Critical
    CVE-2026-84082 No auth

    IBM Guardium Data Protection - SQL Injection

    IBM Guardium Data Protection 12.2 contains a SQL injection caused by improper neutralization of special elements in SQL commands, letting remote attackers execute arbitrary SQL commands, exploit requires crafted input.

  • 9.9 /10 Critical
    CVE-2026-84078 No auth

    IBM Guardium Data Protection - Authentication Bypass

    IBM Guardium Data Protection 12.2 contains a broken authentication caused by missing authentication in LoadBalancerServlet, letting unauthenticated users perform privileged load-balancer operations, exploit requires no authentication.

  • 9.9 /10 Critical
    CVE-2026-84075 No auth

    IBM Guardium Data Protection - Authentication Bypass

    IBM Guardium Data Protection 12.2 contains an authentication bypass caused by missing authentication in ChangeTrackerServlet, letting remote attackers bypass security restrictions, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-84073 Auth required

    IBM Guardium Data Protection - SQL Injection

    IBM Guardium Data Protection 12.2 contains a SQL injection caused by improper neutralization of special elements in SQL commands, letting remote authenticated attackers execute arbitrary SQL commands.

  • 9.9 /10 Critical
    CVE-2026-84064 Auth required

    IBM Guardium Data Protection - SQL Injection

    IBM Guardium Data Protection 12.2 contains a SQL injection caused by improper neutralization of special elements in SQL commands, letting remote authenticated attackers execute arbitrary SQL commands.

  • 9.0 /10 Critical
    CVE-2026-84031 Auth required

    IBM Guardium Data Protection - Remote Code Execution

    IBM Guardium Data Protection 12.2 contains a remote code execution caused by improper neutralization of input during web page generation, letting remote authenticated attackers execute arbitrary code.

  • 9.8 /10 Critical
    CVE-2026-82967 No auth

    IBM Guardium Data Protection - Authentication Bypass

    IBM Guardium Data Protection 12.2 contains an authentication bypass caused by improper IP-based access control validation, letting unauthenticated remote attackers access the management interface, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-82832 Auth required

    IBM Guardium Data Protection - Remote Code Execution

    IBM Guardium Data Protection 12.2 contains a remote code execution caused by improper neutralization of input during web page generation, letting remote authenticated attackers execute arbitrary code.

  • 9.8 /10 Critical
    CVE-2026-82340

    IBM Guardium Data Protection - Insecure Deserialization

    IBM Guardium Data Protection 12.2 contains an insecure deserialization vulnerability caused by attacker-controlled reflective method dispatch in the Change Audit System listener, letting network attackers execute code remotely, exploit requires network access to TCP port 16017.

  • 9.8 /10 Critical
    CVE-2026-81657 No auth

    IBM Guardium Data Protection - Remote Code Execution

    IBM Guardium Data Protection 12.2 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting remote unauthenticated attackers execute arbitrary code.

  • 9.8 /10 Critical
    CVE-2026-81321

    CM2507 IP cameras - Information Disclosure

    CM2507 IP cameras contain an information disclosure vulnerability caused by storing wireless network credentials in cleartext within the device filesystem, letting attackers with filesystem access recover network identifiers and keys, exploit requires physical or debugging interface access.

  • 9.9 /10 Critical
    CVE-2026-80442 Auth required

    IBM Guardium Data Protection - Command Injection

    IBM Guardium Data Protection 12.2 contains an authenticated command injection caused by improper input handling in exportCertificate functionality, letting authenticated attackers execute unauthorized OS commands.

  • 9.8 /10 Critical
    CVE-2026-80441 No auth

    IBM Guardium Data Protection - SQL Injection

    IBM Guardium Data Protection 12.2 contains a second-order SQL injection caused by improper sanitization in generateInsertQuery functionality of change-tracker-data.sql, letting remote attackers compromise confidentiality, integrity, and availability, exploit requires no authentication.

  • 9.9 /10 Critical
    CVE-2026-77240 Auth required

    WACRM - Broken Access Control & Information Disclosure

    WACRM <= 0.7.0 contains broken access control caused by improper row-level security policies and SECURITY DEFINER functions, letting authenticated users escalate privileges or access other tenants' data, exploit requires authentication.