Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 123 of 166

  • 10.0 /10 Critical
    CVE-2026-10747 No auth

    IBM MQ Appliance - Buffer Overflow

    IBM MQ Appliance contains a heap buffer overflow in protocol message processing before authentication, letting remote attackers cause denial of service or execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2025-66455 No auth

    LMDeploy - Remote Code Execution

    LMDeploy 0.9.2 to < 0.16.0 contains a remote code execution caused by unsafe Python pickle deserialization in PyTorch DistServe control plane, letting unauthenticated attackers execute arbitrary code remotely via crafted payloads.

  • 9.9 /10 Critical
    CVE-2025-53837 Auth required

    XWiki Rendering - Remote Code Execution

    XWiki Rendering < 14.10.2 and < 15.0 RC1 contains a remote code execution caused by unescaped rendering output in HTML macros, letting users with edit rights execute arbitrary script macros with programming rights, exploit requires edit access to user profile or documents.

  • 10.0 /10 Critical
    CVE-2025-15399 No auth

    IBM Common Licensing Agent - Cross-Site Request Forgery

    IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 contain a cross-site request forgery vulnerability caused by lack of proper request validation, letting attackers execute unauthorized actions via trusted user sessions, exploit requires victim user interaction.

  • 9.8 /10 Critical
    CVE-2023-54399 CISA KEVNo auth

    Hongjing e-HR - SQL Injection

    Hongjing e-HR < 8.2 contains a SQL injection caused by unsanitized 'categories' parameter in /servlet/codesettree after HRMS-encoding is stripped, letting unauthenticated remote attackers read arbitrary database content.

  • 9.6 /10 Critical
    CVE-2026-93374 No auth

    Google Chrome - Use After Free

    Google Chrome on Android < 153.0.8010.52 contains a use after free vulnerability in Dawn, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-93373 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.52 contains a use after free vulnerability in Extensions, letting remote attackers execute arbitrary code outside the sandbox via crafted extensions.

  • 9.6 /10 Critical
    CVE-2026-93372 No auth

    Google Chrome - Buffer Overflow

    Google Chrome on Android < 153.0.8010.52 contains a buffer overflow in WebGL, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 10.0 /10 Critical
    CVE-2026-92960 No auth

    vm2 - Sandbox Escape

    vm2 before 3.11.6 contains a sandbox escape caused by failure to restrict access to os and dns builtins under builtin: ['*'] configuration, letting attackers hijack host DNS resolver globally, exploit requires crafted sandbox code.

  • 9.9 /10 Critical
    CVE-2026-92957 Auth required

    vm2 - Command Injection

    vm2 <= 3.11.6 contains a command injection caused by improper normalization of node:-prefixed builtin specifiers in NodeVM require policy, letting sandboxed attackers execute host commands via child_process, exploit requires crafted require policy.

  • 10.0 /10 Critical
    CVE-2026-92956 PoC public

    vm2 - Sandbox Escape

    vm2 3.10.1 through 3.11.6 contains a sandbox escape caused by manipulation of WebAssembly promise rejection and Symbol.species in default new VM() sandbox on Node.js 26, letting attackers gain host Node.js capabilities without special permissions, exploit requires Node.js 26 environment.

  • 10.0 /10 Critical
    CVE-2026-92955 No auth

    vm2 - Sandbox Escape

    vm2 < 3.11.8 contains a sandbox escape vulnerability caused by access to host __proto__ getter/setter through console._stdout and console._stderr in NodeVM, letting attackers execute code with process context, exploit requires crafted input.

  • 10.0 /10 Critical
    CVE-2026-92953 No auth

    vm2 - Prototype Pollution

    vm2 versions >= 3.11.0 and < 3.11.8 contain a prototype pollution caused by failure to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation, letting attackers modify host prototypes affecting typed arrays after VM.run(), exploit requires attacker to run code in sandbox.

  • 9.9 /10 Critical
    CVE-2026-92951 Auth required

    vm2 - Broken Access Control

    vm2 < 3.11.7 contains an incorrect authorization vulnerability caused by non-exact substring matching in the external package allowlist check, letting attackers bypass allowlist and execute unauthorized host packages, exploit requires crafted package names.

  • 9.9 /10 Critical
    CVE-2026-92948

    vm2 - Sandbox Escape

    vm2 versions >= 3.9.6 and <= 3.11.6 contain a sandbox escape caused by a NodeVM builtin allowlist bypass on Node.js 24+, letting attackers execute arbitrary code outside the sandbox, exploit requires explicit allowance of node:test builtin.