Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 147 of 166
- 9.1 /10 CriticalCVE-2026-87785 No auth
Apache Syncope - Authentication Bypass
Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an authentication bypass caused by JWKS settings disclosure in internal JWT authentication, letting attackers spoof user privileges after valid authentication.
- 9.1 /10 CriticalCVE-2026-86881 PoC public
Apple - Authentication Bypass
Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain a certificate validation bypass caused by improper validation of intermediate certificate authorities, letting attackers with compromised intermediate CAs issue certificates with arbitrary extended key usages, exploit requires compromised intermediate CA.
- 9.8 /10 CriticalCVE-2026-86460 No auth
Apache Syncope - NoSQL Injection
Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain a cypher injection caused by improper handling of FIQL search conditions in the Neo4j persistence layer, letting attackers execute arbitrary queries, exploit requires crafted search conditions.
- 9.1 /10 CriticalCVE-2026-84625 No auth
Apple - Broken Access Control
Apple iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27, and watchOS 27 contain a broken access control caused by insufficient sandbox restrictions, letting apps fingerprint users, exploit requires app installation.
- 9.8 /10 CriticalCVE-2026-84609 No auth
Apple - Broken Access Control
Apple iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain a broken access control caused by insufficient path validation, letting apps modify protected system files, exploit requires app execution.
- 9.8 /10 CriticalCVE-2026-84561 No auth
Apple - Use After Free
Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain a use after free caused by improper memory management, letting apps cause system termination or kernel memory corruption, exploit requires app execution.
- 9.8 /10 CriticalCVE-2026-84520 PoC publicNo auth
Apple macOS Golden Gate - Buffer Overflow
Apple macOS Golden Gate 27 contains a buffer overflow caused by insufficient size validation, letting local attackers cause system termination or kernel memory corruption, exploit requires local access.
- 9.8 /10 CriticalCVE-2026-82787 No auth
CPSL-08P1EN - Authentication Bypass
CPSL-08P1EN contains a broken authentication caused by missing authentication for critical functions, letting remote attackers operate the product without authentication, exploit requires no special conditions.
- 9.1 /10 CriticalCVE-2026-82441 No auth
Apache Storm - Broken Access Control
Apache Storm before 3.1.0 contains a broken access control vulnerability caused by lack of validation on blobstore dependency keys in topology submissions, letting attackers delete blobs of other topologies or cause leadership loss, exploit requires submitting crafted topology with malicious keys.
- 9.8 /10 CriticalCVE-2026-82439 No auth
Apache Storm DRPC - Denial of Service
Apache Storm DRPC server contains a memory exhaustion vulnerability caused by unbounded retention of function name entries in request queues, letting unauthenticated attackers exhaust server heap by sending distinct function names, exploit requires no credentials.
- 9.8 /10 CriticalCVE-2026-82435 No auth
Apache Storm - Denial of Service
Apache Storm contains a denial of service vulnerability caused by the Netty message decoder allocating large buffers before SASL authentication, letting unauthenticated attackers with TCP access to worker ports cause resource exhaustion, exploit requires TCP reachability to worker port.
- 9.8 /10 CriticalCVE-2026-82431 No auth
Apache Storm - Broken Access Control
Apache Storm < 3.1.0 contains a broken access control caused by improper evaluation of nimbus.groups when nimbus.users is empty in SimpleACLAuthorizer, letting authenticated operators bypass group restrictions and perform all user-level operations, exploit requires cluster access with authentication.
- 9.8 /10 CriticalCVE-2026-82232 No auth
Apache Syncope - SQL Injection
Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an SQL injection caused by unsanitized sort clauses in Task search, letting administrators execute arbitrary SQL via stacked queries, exploit requires administrator privileges.
- 9.8 /10 CriticalCVE-2026-78330 No auth
Apache Syncope - Broken Access Control
Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an incorrect privilege assignment vulnerability caused by disclosure of JWKS settings in internal JWT authentication, letting attackers escalate to admin privileges after authentication, exploit requires valid low-privilege JWT.
- 9.1 /10 CriticalCVE-2026-78299 No auth
Eclipse Embedded CDT - Unrestricted File Upload
Eclipse Embedded CDT 6.0 to 6.7 contains an unrestricted file write vulnerability caused by extraction of a compromised CMSIS pack archive, letting attackers write arbitrary files outside intended directories, exploit requires crafted CMSIS pack.