Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 136 of 166

  • 9.6 /10 Critical
    CVE-2026-91716 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.47 contains a use after free vulnerability in authentication, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires user to visit malicious page.

  • 9.6 /10 Critical
    CVE-2026-91710 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.47 contains a use after free vulnerability in WebAppInstalls, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.1 /10 Critical
    CVE-2026-91003 Auth required

    D-Link DI-8300 - Buffer Overflow

    D-Link DI-8300 16.07 contains a buffer overflow caused by manipulation of the "redirct_url" argument in /rzgl.asp CGI Service, letting remote attackers execute code, exploit requires crafted request.

  • 9.9 /10 Critical
    CVE-2026-91001 Auth required

    D-Link DI-8400 - Buffer Overflow

    D-Link DI-8400 16.07 contains a stack-based buffer overflow caused by manipulation of the serv/user/host/wild/mx/bmx/cust/ip arguments in /ddns.asp DDNS Configuration, letting remote attackers execute code, exploit requires crafted request.

  • 9.1 /10 Critical
    CVE-2026-90847 PoC publicAuth required

    EFM ipTIME C200E - Command Injection

    EFM ipTIME C200E 1.094 contains a command injection caused by manipulation in iux_set.cgi System Setup component, letting remote attackers execute arbitrary OS commands, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-90711 No auth

    proxy-addr - Broken Access Control

    proxy-addr 1.1.0 through 2.0.7 contains a broken access control caused by incorrect IPv4-mapped IPv6 subnet prefix handling, letting unauthenticated clients bypass IP-based restrictions by controlling X-Forwarded-For header, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-89040 No auth

    Tencent Mass Service Engine in Cluster (MSEC) - Path Traversal

    Tencent Mass Service Engine in Cluster (MSEC) contains a path traversal vulnerability caused by crafted POST requests including '../', letting remote unauthenticated attackers gain root access and execute arbitrary code, exploit requires no authentication.

  • 9.8 /10 Critical
    CVE-2026-89026 CISA KEVPoC publicNo auth

    Issabel Framework - Authentication Bypass

    Issabel Framework before commit b97dbaf contains a hard-coded HS256 JWT signing key in pbxapi index.php, letting unauthenticated remote attackers forge tokens to execute arbitrary OS commands as Asterisk user.

  • 9.8 /10 Critical
    CVE-2026-88617 No auth

    SmartAdmin - Broken Access Control

    SmartAdmin v3.30.0 contains a broken access control vulnerability caused by an authorization flaw in the configuration query endpoint, letting remote attackers escalate privileges, exploit requires no special conditions.

  • 10.0 /10 Critical
    CVE-2026-87230 No auth

    Oracle Hyperion Financial Management - Broken Access Control

    Oracle Hyperion Financial Management 11.2.26.0.000 contains an unauthorized data access vulnerability caused by insufficient access controls in the Security component, letting unauthenticated network attackers create, delete, or modify critical data, exploit requires network access via HTTP.

  • 9.1 /10 Critical
    CVE-2026-87223 No auth

    Oracle Hyperion Financial Management - Broken Access Control

    Oracle Hyperion Financial Management 11.2.26.0.000 contains an unauthenticated network access vulnerability in Security component, letting remote attackers modify critical data or cause denial of service, exploit requires network access via HTTP.

  • 9.1 /10 Critical
    CVE-2026-87217 No auth

    Oracle Hyperion Financial Management - Broken Access Control

    Oracle Hyperion Financial Management 11.2.26.0.000 contains a broken access control vulnerability caused by improper authorization in the Security component, letting unauthenticated network attackers via HTTP create, delete, or modify critical data.

  • 9.1 /10 Critical
    CVE-2026-87214 Auth required

    Oracle Hyperion Financial Management - Authentication Bypass

    Oracle Hyperion Financial Management 11.2.26.0.000 contains a security vulnerability allowing high privileged attackers with network access via HTTP to compromise the system, potentially impacting additional products, exploit requires high privileges.

  • 9.1 /10 Critical
    CVE-2026-87189 Auth required

    Oracle Hyperion Financial Management - Authentication Bypass

    Oracle Hyperion Financial Management 11.2.26.0.000 contains a security vulnerability caused by an easily exploitable flaw accessible via Oracle Net, letting high privileged attackers compromise the system, exploit requires network access with high privileges.

  • 9.8 /10 Critical
    CVE-2026-87188 No auth

    Oracle Hyperion Financial Management - Authentication Bypass

    Oracle Hyperion Financial Management 11.2.26.0.000 contains a remote unauthenticated takeover vulnerability in Security component, letting attackers with network HTTP access fully compromise the system, exploit requires network access via HTTP.