Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 126 of 166

  • 9.9 /10 Critical
    CVE-2026-85885 Auth required

    M365 Copilot - Privilege Escalation

    M365 Copilot contains a command injection caused by improper neutralization of special elements in commands, letting authorized attackers elevate privileges over a network, exploit requires attacker authorization.

  • 10.0 /10 Critical
    CVE-2026-83944 No auth

    Azure Logic Apps - Broken Access Control

    Azure Logic Apps contains an improper access control vulnerability allowing unauthorized attackers to elevate privileges over a network, exploit requires network access.

  • 9.0 /10 Critical
    CVE-2026-77903 No auth

    Microsoft Dataverse - Authentication Bypass

    Microsoft Dataverse contains an authentication bypass caused by spoofing, letting unauthorized attackers elevate privileges over a network, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-73639 No auth

    Imager::File::PNG - Buffer Overflow

    Imager::File::PNG < 1.004 for Perl contains a buffer overflow caused by incorrect row buffer sizing when reading PNGs with tRNS transparency chunk in read_direct8, letting attackers cause heap corruption and crash the process, exploit requires crafted PNG input.

  • 10.0 /10 Critical
    CVE-2026-70200 No auth

    Azure Logic Apps - Path Traversal

    Azure Logic Apps contains a path traversal caused by improper limitation of a pathname to a restricted directory, letting unauthorized attackers elevate privileges over a network, exploit requires network access.

  • 9.3 /10 Critical
    CVE-2026-70009 No auth

    Azure Arc - Path Traversal

    Azure Arc contains a path traversal caused by improper limitation of a pathname to a restricted directory, letting unauthorized attackers elevate privileges over a network, exploit requires network access.

  • 10.0 /10 Critical
    CVE-2026-69865 No auth

    Microsoft Container Registry - Authorization Bypass

    Microsoft Container Registry contains an authorization bypass caused by user-controlled key manipulation, letting unauthorized attackers elevate privileges over a network, exploit requires network access.

  • 10.0 /10 Critical
    CVE-2026-69399

    CVE-2026-69399

    Azure Arc Elevation of Privilege Vulnerability

  • 9.1 /10 Critical
    CVE-2026-63472 No auth

    Vendure - Broken Access Control

    Vendure < 3.7.0 contains a broken access control vulnerability caused by ExternalAuthenticationService.createCustomerAndUser attaching unverified external authentication methods to existing users, letting attackers bind identities to victim accounts and access personal data, exploit requires custom external authentication strategy that does not verify email ownership.

  • 9.8 /10 Critical
    CVE-2026-62108 No auth

    Headless Single Sign On - Authentication Bypass

    Headless Single Sign On <= 1.7.0 contains a broken authentication vulnerability caused by unauthenticated access, letting attackers bypass authentication, exploit requires no special privileges.

  • 10.0 /10 Critical
    CVE-2026-62104 No auth

    Migratico Lite - Remote Code Execution

    Migratico Lite <= 2.6.8 contains a remote code execution caused by unauthenticated access, letting remote attackers execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-62101 No auth

    EduAdmin Booking - Authentication Bypass

    EduAdmin Booking <= 5.4.2 contains a broken authentication vulnerability caused by unauthenticated access, letting attackers bypass authentication, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-54767 No auth

    WeGIA - Command Injection

    WeGIA < 3.8.5 contains a command injection caused by unauthenticated access to a GET endpoint with a hardcoded key allowing TRUNCATE TABLE operations, letting remote attackers permanently delete database records, exploit requires knowledge of the hardcoded key and database truncation privileges.

  • 9.6 /10 Critical
    CVE-2026-54752 No auth

    NetBox Device Type Library - Remote Code Execution

    NetBox Device Type Library contains an insecure deserialization vulnerability caused by untrusted pickle file loading in test harness, letting unauthenticated contributors execute arbitrary code during test runs, exploit requires crafted pickle files and configuration modification.

  • 10.0 /10 Critical
    CVE-2026-54734 No auth

    Prebid Server Java - Server Side Request Forgery

    Prebid Server Java < 3.43.0 contains a server side request forgery caused by improper validation of user-supplied parameters in outbound request URLs, letting attackers cause the server to send requests to unintended destinations, exploit requires attacker to supply bid-request parameters.