Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 14 of 125

  • 9.8 /10 Critical
    CVE-2026-70157 No auth

    Windows System Information Console - Remote Code Execution

    Windows System Information Console contains a heap-based buffer overflow, letting unauthorized attackers execute code remotely over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-70153 No auth

    Microsoft PostScript Printer Driver - Remote Code Execution

    Microsoft PostScript Printer Driver contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-70147 No auth

    Microsoft PostScript Printer Driver - Remote Code Execution

    Microsoft PostScript Printer Driver contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-70096 No auth

    Windows Rich Text Edit Control - Buffer Overflow

    Windows Rich Text Edit Control contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-70024 No auth

    Windows Internet Information Services - Buffer Overflow

    Windows Internet Information Services contains a stack-based buffer overflow allowing unauthorized attackers to execute code remotely over a network, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-69886 No auth

    Windows Imaging Component - Remote Code Execution

    Windows Imaging Component contains a heap-based buffer overflow allowing unauthorized attackers to execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-69883 No auth

    Windows iSCSI - Remote Code Execution

    Windows iSCSI contains a use after free vulnerability that allows unauthorized attackers to execute code over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-69705 No auth

    Windows iSCSI - Remote Code Execution

    Windows iSCSI contains an out-of-bounds write vulnerability allowing unauthorized attackers to execute code remotely over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-69639 No auth

    Windows Libarchive - Remote Code Execution

    Windows Libarchive contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-69634 No auth

    Windows iSCSI - Remote Code Execution

    Windows iSCSI contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-69227 No auth

    Portal for ArcGIS - Authentication Bypass

    Portal for ArcGIS contains an authentication bypass caused by unauthenticated access to certain /portaladmin/local API endpoints, letting unauthenticated attackers access administrative functionality, exploit requires specific conditions.

  • 9.1 /10 Critical
    CVE-2026-65173 No auth

    NVIDIA AIStore - Broken Authentication

    NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint, letting unauthenticated remote attackers submit crafted token-revocation lists, leading to data tampering and denial of service.

  • 10.0 /10 Critical
    CVE-2026-65162

    NVIDIA AIStore - Remote Code Execution & Privilege Escalation & Information Disclosure & Data Tampering & Denial of Service

    NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings, letting remote attackers execute code, escalate privileges, disclose information, tamper data, and cause denial of service, exploit requires access to the vulnerable API.

  • 9.6 /10 Critical
    CVE-2026-63354 No auth

    Affected Devices - Stored XSS

    Affected devices contain a stored XSS vulnerability caused by improper validation and sanitization of visual marker data in imported CSV trace files, letting attackers execute JavaScript in authorized users' browsers, exploit requires user with 'Read diagnostics' rights to import crafted trace file.

  • 9.6 /10 Critical
    CVE-2026-63353 No auth

    Affected devices - Stored XSS

    Affected devices contain a stored XSS vulnerability caused by improper sanitization of comment fields in imported trace files, letting attackers execute JavaScript in authorized users' browsers, exploit requires user with 'Read diagnostics' rights to import crafted trace file.