Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 131 of 166
- 9.6 /10 CriticalCVE-2026-86106
Edge - Privilege Escalation
Edge units with HA enabled contain a privilege escalation vulnerability caused by unauthenticated access to sensitive HA peer functions over the private HA interconnect, letting unauthenticated actors execute elevated commands.
- 9.6 /10 CriticalCVE-2026-85385 No auth
Concrete CMS - Stored XSS
Concrete CMS < 9.5.4 contains a stored cross-site scripting caused by lack of validation and output encoding of user timezone value on the Dashboard user management page, letting attackers execute scripts in administrator sessions, exploit requires concrete.misc.user_timezones enabled and either authenticated user or public registration enabled.
- 9.8 /10 CriticalCVE-2026-82717
NLnet Labs Unbound - Remote Code Execution
NLnet Labs Unbound <= 1.26.0 contains a heap buffer overflow caused by improper handling of CNAME synthesis and max TTL rewriting in packet buffer, letting remote attackers cause memory corruption or remote code execution, exploit requires crafted upstream response.
- 9.8 /10 CriticalCVE-2026-82311 No auth
Apache Airflow FAB provider - Authentication Bypass
Apache Airflow FAB provider before 3.9.0 contains a broken authentication caused by inconsistent session identifier comparison in database-backed sessions, letting attackers with stolen session cookies maintain access after password reset, exploit requires use of FAB auth manager with database session backend.
- 9.8 /10 CriticalCVE-2026-81642 PoC publicNo auth
NLnet Labs Unbound - Buffer Overflow
NLnet Labs Unbound <= 1.26.0 contains a buffer overflow in DNSSEC validator caused by a DNSKEY with an owner compression pointer to its own RDATA, letting remote attackers cause denial of service or remote code execution, exploit requires attacker-controlled malicious zone.
- 10.0 /10 CriticalCVE-2026-76460 CISA KEVPoC publicNo auth
Cisco Identity Services Engine - Authentication Bypass
Cisco Identity Services Engine contains an authentication bypass caused by insufficient authentication control on an API endpoint, letting unauthenticated remote attackers gain unauthorized access, exploit requires crafted request to API endpoint.
- 10.0 /10 CriticalCVE-2026-76423
Cisco ISE - Broken Access Control
Cisco ISE and Cisco ISE-PIC contain a broken access control vulnerability caused by insufficient authorization checks in the REST API web service, letting unauthenticated remote attackers gain administrative access, exploit requires access to the REST API port.
- 9.0 /10 CriticalCVE-2026-76420
Cisco Secure FMC Software - Command Injection
Cisco Secure FMC Software contains a command injection caused by incorrect initialization of encryption parameters in the Apache JServ Protocol (AJP) connector, letting unauthenticated remote attackers execute commands as root, exploit requires sftunnel connection to Cisco Secure FTD Software to be down.
- 9.8 /10 CriticalCVE-2026-76187 No auth
Apache Airflow - Authentication Bypass
Apache Airflow Keycloak provider contains an authentication bypass caused by unauthenticated token endpoint accepting any confidential client credentials in a shared Keycloak realm, letting attackers authenticate as any client, exploit requires valid credentials of any confidential client in the realm.
- 9.1 /10 CriticalCVE-2026-76186 No auth
Apache Airflow - Broken Access Control
Apache Airflow 3.3+ with Keycloak auth manager contains a broken access control caused by separate unauthenticated cookies for Keycloak tokens not bound to session identity, letting logged-in users escalate privileges by pairing foreign tokens, exploit requires valid Airflow login and foreign Keycloak tokens.
- 9.1 /10 CriticalCVE-2026-75513 Auth required
Marten - SQL Injection
Marten 7.0.0 to 9.13.0 contains a SQL injection caused by unescaped interpolation of attacker-controlled strings into single-quoted SQL literals in LINQ and tenant-management paths, letting attackers bypass filters and exfiltrate or modify data, exploit requires crafted input with single quotes.
- 10.0 /10 CriticalCVE-2026-73456
Arista EOS - Remote Code Execution
Arista EOS contains a remote code execution caused by crafted malicious requests in gRPC Network Packet Sampling Interface (gNPSI), letting unauthenticated attackers gain full administrative control, exploit requires gNPSI enabled.
- 10.0 /10 CriticalCVE-2026-73453 No auth
Arista EOS - Remote Code Execution
Arista EOS contains a remote code execution caused by crafted malicious packets during P4Runtime session initiation, letting unauthenticated attackers gain complete administrative control, exploit requires P4Runtime enabled and network access.
- 9.1 /10 CriticalCVE-2026-73447 Auth required
Arista EOS - Command Injection & Privilege Escalation
Arista EOS-based products contain a command injection caused by crafted requests to gRPC Network Security Interface (gNSI) Certz and Bootz services, letting authenticated attackers escalate privileges and execute arbitrary OS commands.
- 10.0 /10 CriticalCVE-2026-70416 No auth
Dell ObjectScale - Remote Code Execution
Dell ObjectScale < 4.4.0.0 contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting unauthenticated remote attackers execute arbitrary code remotely, exploit requires remote access.