Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 121 of 125

  • 9.6 /10 Critical
    CVE-2026-87494 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 on Windows contains a use after free vulnerability caused by improper memory handling in the browser, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires user interaction.

  • 9.6 /10 Critical
    CVE-2026-87492 PoC publicNo auth

    Google Chrome - Authorization Bypass

    Google Chrome < 153.0.8010.36 contains an authorization bypass caused by incorrect authorization in DevTools, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-87488 No auth

    Google Chrome - Use After Free

    Google Chrome on Android < 153.0.8010.36 contains a use after free vulnerability in WebGL, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires victim to visit malicious page.

  • 9.6 /10 Critical
    CVE-2026-87474 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in Payments, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires victim to visit malicious page.

  • 9.6 /10 Critical
    CVE-2026-87470 No auth

    Google Chrome - Remote Code Execution

    Google Chrome on Mac < 153.0.8010.36 contains a remote code execution caused by improper quantity validation in Tint, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page.

  • 9.6 /10 Critical
    CVE-2026-87464 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in WebGL, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires victim to visit malicious page.

  • 9.6 /10 Critical
    CVE-2026-87455 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in Aura, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-87448 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in DevTools, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires crafted HTML page.

  • 9.6 /10 Critical
    CVE-2026-87438 No auth

    Google Chrome - Remote Code Execution

    Google Chrome on Android < 153.0.8010.36 contains an out of bounds write in WebGL, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires victim to visit malicious page.

  • 9.8 /10 Critical
    CVE-2026-85978 No auth

    Akana API Platform - Remote Code Execution

    Akana API Platform contains a remote code execution caused by path normalization discrepancy in the Policy Manager console, letting unauthenticated remote attackers execute arbitrary code, exploit requires no authentication or user interaction.

  • 9.8 /10 Critical
    CVE-2026-85103 No auth

    Check Point Quantum Security Management & Quantum Security Gateway - Remote Code Execution

    Check Point Quantum Security Management and Quantum Security Gateway contain a heap-based buffer overflow caused by improper ASN.1 decoding in VPN certificate processing, letting unauthenticated remote attackers execute arbitrary code.

  • 9.8 /10 Critical
    CVE-2026-85102 CISA KEVPoC publicNo auth

    Check Point Quantum Security Gateway - Remote Code Execution

    Check Point Quantum Security Gateway contains a remote code execution caused by improper certificate trust validation during VPN negotiation, letting unauthenticated remote attackers execute arbitrary code.

  • 9.8 /10 Critical
    CVE-2026-80172 No auth

    Dell SCG 5.0 - Authentication Bypass

    Dell SCG 5.0 Appliance < 5.36.00.16 and Dell SCG 5.0 Application < 5.36.00.00 contain an insufficient verification of data authenticity vulnerability, letting unauthenticated remote attackers gain unauthorized ADMIN access and refresh tokens by reusing captured requests indefinitely.

  • 9.8 /10 Critical
    CVE-2026-71805 No auth

    LZ-litchi - Unrestricted File Upload

    LZ-litchi 1.0.0 contains an unrestricted file upload and path traversal vulnerability caused by improper validation of the directory parameter in POST /app-api/infra/file/upload, letting unauthenticated remote attackers upload and write arbitrary files outside intended directories.

  • 9.8 /10 Critical
    CVE-2026-71801 No auth

    s-pms SPMS-Server - Authentication Bypass

    s-pms SPMS-Server through v1.0 contains a broken authentication caused by a hardcoded default access token secret in the core configuration file, letting remote unauthenticated attackers bypass authentication and gain full admin access, exploit requires no special conditions.