Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 13 of 125
- 9.8 /10 CriticalCVE-2026-78802 No auth
SKYWORTH DIGITAL CO.,LTD SK-WR6640X - Remote Code Execution
SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 contains a remote code execution vulnerability caused by unspecified issue, letting remote attackers execute arbitrary code, exploit requires no special conditions.
- 9.8 /10 CriticalCVE-2026-78799 No auth
Quanxun Huiju Network Technology IK-Q3000 - Directory Traversal
Quanxun Huiju Network Technology IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router <= iKuai8_3.7.23_Enterprise and <= iKuai 8_4.0.304-beta contains a directory traversal vulnerability allowing remote attackers to execute arbitrary code, exploit requires network access.
- 9.9 /10 CriticalCVE-2026-77459 Auth required
Argo CD - Broken Access Control
Argo CD 2.10.0 to 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 contains a broken access control vulnerability caused by omission of AppProject destination and resource authorization checks in PostDelete resource hooks, letting users with write access to an Application's Git repository create unauthorized cluster-scoped or namespaced resources during deletion, exploit requires write access to the Application's Git repository.
- 9.3 /10 CriticalCVE-2026-77099 No auth
CVFS - Command Injection
CVFS contains a command injection caused by input validation issue, letting attackers execute arbitrary commands, exploit requires crafted input.
- 9.6 /10 CriticalCVE-2026-75994 No auth
ColdFusion - Broken Access Control
ColdFusion contains an incorrect authorization vulnerability caused by improper access control in administrative network zone, letting attackers execute arbitrary code in the context of the current user, exploit requires network access to administrative zone.
- 9.9 /10 CriticalCVE-2026-75732 Auth required
Adobe Experience Manager - Broken Access Control
Adobe Experience Manager contains an incorrect authorization vulnerability that allows arbitrary code execution in the context of the current user, letting attackers gain elevated access or control, exploit requires no user interaction.
- 9.3 /10 CriticalCVE-2026-75120 No auth
OpenText EnCase SAFE Agents - Authentication Bypass
OpenText EnCase SAFE Agents contains an authentication bypass vulnerability caused by improper security controls during session establishment, letting unauthorized attackers establish connections to vulnerable Agents, exploit requires no authentication.
- 9.0 /10 CriticalCVE-2026-74043 Auth required
Wazuh - Path Traversal
Wazuh > 4.1.1 < 4.14.8 contains a path traversal caused by improper validation in upload_list_file, upload_rule_file, and upload_decoder_file, letting malicious cluster workers write files at arbitrary paths, exploit requires cluster key access.
- 9.1 /10 CriticalCVE-2026-74041 Auth required
Wazuh - Command Injection
Wazuh 4.14.3 before 4.14.8 contains a command injection caused by case-sensitivity mismatch in ossec.conf validator and wazuh-logcollector, letting authenticated users with manager:update_config privileges execute commands as root, exploit requires manager:update_config privileges.
- 9.1 /10 CriticalCVE-2026-74040 Auth required
Wazuh - Remote Code Execution
Wazuh >= 3.9.0 < 4.14.8 contains an arbitrary file overwrite vulnerability caused by trailing-slash basename bypass and missing extra_valid enforcement in MasterHandler.process_files_from_worker, letting cluster workers achieve root remote code execution, exploit requires attacker control of a cluster worker.
- 9.8 /10 CriticalCVE-2026-70300 No auth
Microsoft Office Word - Remote Code Execution
Microsoft Office Word contains an untrusted pointer dereference vulnerability that allows unauthorized attackers to execute code remotely over a network, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-70291 No auth
Microsoft Office Outlook - Remote Code Execution
Microsoft Office Outlook contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 9.3 /10 CriticalCVE-2026-70279 No auth
Microsoft Exchange Server - Stored XSS
Microsoft Exchange Server contains a stored XSS caused by improper neutralization of input during web page generation, letting unauthorized attackers perform spoofing over a network, exploit requires no special conditions.
- 9.8 /10 CriticalCVE-2026-70242 No auth
Microsoft Office Outlook - Remote Code Execution
Microsoft Office Outlook contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.
- 9.1 /10 CriticalCVE-2026-70188 No auth
ASP.NET Core - Authentication Bypass
ASP.NET Core contains an HTTP request smuggling vulnerability caused by inconsistent interpretation of HTTP requests, letting unauthorized attackers bypass security features over a network, exploit requires network access.