Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 135 of 166

  • 9.8 /10 Critical
    CVE-2026-92037 No auth

    Firefox - Undefined Vulnerability

    Firefox contains a vulnerability in the DOM Animation component caused by incorrect boundary conditions, letting attackers potentially cause unexpected behavior, exploit requires no special conditions.

  • 9.8 /10 Critical
    CVE-2026-92036 No auth

    Firefox - Undefined

    Firefox contains a vulnerability caused by incorrect boundary conditions in the Networking: HTTP component, letting attackers potentially cause undefined impact, exploit requires no special conditions.

  • 9.6 /10 Critical
    CVE-2026-92035 No auth

    Firefox - Sandbox Escape

    Firefox < 156 and Firefox ESR < 153.3 contain a sandbox escape caused by incorrect boundary conditions in the Graphics component, letting attackers escape sandbox restrictions, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-92034

    Mozilla Firefox - Site Isolation Bypass

    Mozilla Firefox contains a site isolation issue in the Graphics component, letting attackers bypass site isolation protections, exploit requires unspecified conditions.

  • 9.6 /10 Critical
    CVE-2026-92032 No auth

    Firefox - Sandbox Escape

    Firefox < 156, ESR < 140.16 and ESR < 153.3 contain a sandbox escape caused by invalid pointer handling in the Graphics component, letting attackers escape sandbox restrictions, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-92018

    Firefox - Sandbox Escape

    Firefox contains a sandbox escape vulnerability caused by flaws in the DOM Core & HTML component, letting attackers escape sandbox restrictions, exploit requires specific conditions in DOM processing.

  • 9.9 /10 Critical
    CVE-2026-91998 Auth required

    Casdoor - Authorization Bypass

    Casdoor through 4.4.0 contains an authorization bypass caused by improper access control in the /api/mcp endpoint, letting attackers with any application's clientId and clientSecret gain unrestricted user administration access across all organizations, exploit requires valid clientId and clientSecret from any application.

  • 9.1 /10 Critical
    CVE-2026-91995 No auth

    Pig - Authentication Bypass

    Pig < 4.1.0 contains an authentication bypass caused by discarded password verification results in /register/password endpoint, letting remote attackers overwrite any account credentials including admin, exploit requires crafted request.

  • 9.3 /10 Critical
    CVE-2026-91949 PoC publicNo auth

    FreeRDP - Authentication Bypass

    FreeRDP server < 3.31.0 contains a protocol negotiation bypass caused by improper handling of incompatible protocol requests, letting unauthenticated attackers establish RDSTLS connections despite server policy, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-91939 No auth

    Cotonti Comments - Insecure Deserialization

    Cotonti 1.0.0 Comments plugin contains a PHP object injection caused by passing the ci GET parameter to unserialize() without allowed_classes restriction, letting unauthenticated attackers instantiate arbitrary PHP objects to manipulate database or execute code, exploit requires crafted serialized payload.

  • 9.6 /10 Critical
    CVE-2026-91749 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.47 contains a use after free vulnerability in Workers, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-91738 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 153.0.8010.47 contains a remote code execution caused by improper input validation in ANGLE, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-91729 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.47 contains a use after free vulnerability in DigitalCredentials, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires social engineering.

  • 9.6 /10 Critical
    CVE-2026-91728 No auth

    Google Chrome - Integer Overflow

    Google Chrome < 153.0.8010.47 contains an integer overflow caused by improper handling in V8 engine, letting remote attackers execute arbitrary code inside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-91718 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.47 contains a use after free caused by memory mismanagement in Core, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.