Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 123 of 125

  • 9.6 /10 Critical
    CVE-2026-81376 No auth

    Visual Studio Code - Authentication Bypass

    Visual Studio Code contains an incomplete comparison vulnerability caused by missing factors in security checks, letting unauthorized attackers bypass security features over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-78509 No auth

    Microsoft Office Outlook - Remote Code Execution

    Microsoft Office Outlook contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-78445 No auth

    Windows Services for NFS ONCRPC XDR Driver - Remote Code Execution

    Windows Services for NFS ONCRPC XDR Driver contains a use after free vulnerability, letting unauthorized attackers execute code remotely over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-77493 No auth

    Microsoft Graphics Component - Remote Code Execution

    Microsoft Graphics Component contains a double free vulnerability caused by improper memory management, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.3 /10 Critical
    CVE-2026-76201 No auth

    Adobe Commerce - Stored XSS

    Adobe Commerce contains a stored XSS vulnerability caused by improper sanitization of form fields, letting attackers inject malicious scripts executed in victim browsers, potentially gaining elevated access, exploit requires victim to visit the vulnerable page.

  • 9.3 /10 Critical
    CVE-2026-76200 No auth

    Adobe Commerce - Stored XSS

    Adobe Commerce contains a stored XSS vulnerability caused by improper sanitization of form fields, letting attackers inject malicious scripts executed in victim browsers, exploit requires victim to visit the vulnerable page.

  • 9.1 /10 Critical
    CVE-2026-75746 Auth required

    ColdFusion - SQL Injection

    ColdFusion contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers with high privileges execute arbitrary code, exploit requires high privileges.

  • 9.8 /10 Critical
    CVE-2026-73025 No auth

    Windows iSCSI - Authentication Bypass

    Windows iSCSI contains a broken authentication caused by weak authentication mechanisms, letting unauthorized attackers bypass security features over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-73010 No auth

    Windows Failover Cluster - Remote Code Execution

    Windows Failover Cluster contains a use after free vulnerability allowing unauthorized attackers to execute code remotely over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-73009 No auth

    Windows Secure Socket Tunneling Protocol - Use After Free

    Windows Secure Socket Tunneling Protocol (SSTP) contains a use after free vulnerability, letting unauthorized attackers execute code remotely over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-72983 No auth

    Windows Internet Connection Sharing - Use After Free

    Windows Internet Connection Sharing contains a use after free vulnerability allowing unauthorized attackers to execute code over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-72982 No auth

    Windows Netlogon - Remote Code Execution

    Windows Netlogon contains a stack-based buffer overflow caused by improper input handling, letting unauthorized attackers execute code remotely over the network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-72979 No auth

    Windows DHCP Server - Remote Code Execution

    Windows DHCP Server contains a use after free vulnerability allowing unauthorized attackers to execute code remotely over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-70296 No auth

    Windows Imaging Component - Remote Code Execution

    Windows Imaging Component contains an out-of-bounds write vulnerability allowing unauthorized attackers to execute code remotely over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-69910 No auth

    Windows Hyper-V - Buffer Overflow

    Windows Hyper-V contains a stack-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.