Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 124 of 166
- 10.0 /10 CriticalCVE-2026-92947 No auth
vm2 - Information Disclosure & Denial of Service
vm2 < 3.11.7 contains an information disclosure and denial of service vulnerability caused by exposure of Node's shared Buffer pool to sandboxed code, letting attackers read and write host memory, exploit requires sandboxed code execution.
- 10.0 /10 CriticalCVE-2026-92946 No auth
vm2 - Remote Code Execution
vm2 < 3.11.7 contains a remote code execution caused by unrestricted NodeVM instantiation via require.external without require.root excluding node_modules, letting sandboxed code execute arbitrary host OS commands.
- 9.8 /10 CriticalCVE-2026-92944
vm2 - Remote Code Execution
vm2 3.10.2 through 3.11.6 contains a sandbox escape vulnerability caused by a stale PromiseThenLookupChain protector in V8 14.6 affecting Promise.prototype.finally(), letting attackers execute arbitrary code by exploiting async functions with attacker-controlled Symbol.species, exploit requires Node.js 26 environment.
- 10.0 /10 CriticalCVE-2026-92941 No auth
vm2 - Privilege Escalation & Man-in-the-Middle
vm2 versions > 3.11.3 and < 3.11.7 contain a privilege escalation caused by exposure of the host tls module to NodeVM sandbox code, letting attackers replace process-wide certificate authorities, exploit requires access to allowed tls and url builtins.
- 10.0 /10 CriticalCVE-2026-92940 No auth
vm2 - Information Disclosure & Remote Code Execution
vm2 3.11.3 through 3.11.6 contains an information disclosure caused by forwarding method calls on https.globalAgent to sandboxed code in NodeVM, letting attackers read sensitive HTTPS request data and issue authenticated requests, exploit requires NodeVM configured to allow require('https').
- 9.9 /10 CriticalCVE-2026-92939 Auth required
vm2 - Sandbox Escape & Remote Code Execution
vm2 3.11.3 through 3.11.6 contains a sandbox escape caused by exposure of the host Node.js crypto module via a recursive read-only proxy, letting sandboxed JavaScript execute arbitrary native code with host-process authority, exploit requires allowing the crypto builtin.
- 9.9 /10 CriticalCVE-2026-92938 Auth required
vm2 - Remote Code Execution
vm2 3.11.3 through 3.11.6 contains a native code execution vulnerability caused by improper handling of the node:sqlite module in NodeVM, letting sandboxed code execute arbitrary native code with host privileges, exploit requires builtin: ['*'] or explicit node:sqlite permission.
- 10.0 /10 CriticalCVE-2026-92937
vm2 - Remote Code Execution
vm2 3.11.6 contains a sandbox escape caused by improper sanitization of rejected host Promise values in lib/bridge.js, letting remote attackers execute arbitrary code in the host Node.js process, exploit requires exposure of a host-realm Promise to the sandbox.
- 9.0 /10 CriticalCVE-2026-92935 No auth
vm2 - Remote Code Execution
vm2 >= 3.11.4 and <= 3.11.6 contains a sandbox escape vulnerability caused by improper validation of the require option in NodeVM constructor, letting attackers execute arbitrary commands with host privileges by creating an inner NodeVM with elevated builtin allowlist, exploit requires attacker to supply crafted JavaScript with specific NodeVM configuration.
- 9.0 /10 CriticalCVE-2026-92934
vm2 - Sandbox Escape
vm2 < 3.11.8 contains a sandbox escape caused by incomplete Error.cause sanitization in handling revisited host-wrapped AggregateError objects, letting attackers execute remote code and disclose process information, exploit requires crafted exception handling.
- 9.1 /10 CriticalCVE-2026-92860 Auth required
rcourtman Pulse - Improper Input Validation
rcourtman Pulse <= 6.0.4/6.1.0-rc.4 contains an improper input validation vulnerability caused by manipulation of the Username argument in /api/security/quick-setup Quick Security Setup Handler, letting remote attackers potentially exploit the issue.
- 9.8 /10 CriticalCVE-2026-92489 No auth
Linux Kernel - Denial of Service
Linux kernel contains a double-free vulnerability caused by improper skb freeing in xfrm_dev_direct_output(), letting attackers cause denial of service by crashing the kernel, exploit requires packet processing through netfilter.
- 9.8 /10 CriticalCVE-2026-90823 No auth
FatPipe MPVPN, WARP, and IPVPN - Remote Code Execution
FatPipe MPVPN, WARP, and IPVPN appliances 10.1.2r60p100 contain a stack-based buffer overflow caused by unchecked copy in /usr/sbin/auth_user_pass, letting unauthenticated remote attackers execute arbitrary code as root, exploit requires enabled management interface.
- 9.8 /10 CriticalCVE-2026-90822 No auth
FatPipe MPVPN, WARP, and IPVPN - Command Injection
FatPipe MPVPN, WARP, and IPVPN appliances 10.1.2r60p100 contain a command injection caused by improper input handling in the xtremed daemon's AuthFormServlet endpoint, letting unauthenticated remote attackers execute arbitrary root commands, exploit requires enabled management interface.
- 9.1 /10 CriticalCVE-2026-90414 No auth
Linux Kernel IB/isert - Out-of-Bounds Read
Linux kernel IB/isert contains an out-of-bounds read vulnerability caused by accepting PDUs declaring more data than actually received, letting remote initiators cause memory corruption, exploit requires a malicious initiator after login.