Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 148 of 166

  • 9.8 /10 Critical
    CVE-2026-77181 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an incorrect authorization vulnerability caused by improper entitlement checks on ClientApp update operations, letting administrators perform unauthorized actions, exploit requires administrator privileges.

  • 9.8 /10 Critical
    CVE-2026-77051 No auth

    Apache Syncope - SQL Injection

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an SQL injection caused by unsanitized entityKey and opEvent parameters, letting administrators execute arbitrary SQL via stacked queries, exploit requires administrator privileges.

  • 9.8 /10 Critical
    CVE-2026-76461 CISA KEVPoC publicNo auth

    Cisco AsyncOS Software for Cisco Secure Email Gateway - Command Injection

    Cisco AsyncOS Software for Cisco Secure Email Gateway contains a command injection caused by insufficient validation in email parsing logic, letting unauthenticated remote attackers execute arbitrary commands with root privileges, exploit requires sending crafted email messages.

  • 9.8 /10 Critical
    CVE-2026-76443

    CVE-2026-76443

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76443 are related to issues with improper neutralization that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-707.

  • 9.8 /10 Critical
    CVE-2026-76441 No auth

    Cisco Secure Email Gateway & Secure Email and Web Manager - Broken Access Control

    Cisco Secure Email Gateway and Cisco Secure Email and Web Manager contain an improper access control vulnerability caused by insufficient authorization checks, letting attackers gain unauthorized access, exploit requires no special conditions.

  • 9.8 /10 Critical
    CVE-2026-76440 No auth

    Cisco Secure Email Gateway & Secure Email and Web Manager - Path Traversal

    Cisco Secure Email Gateway and Cisco Secure Email and Web Manager contain path traversal vulnerabilities caused by improper input validation, letting attackers access unauthorized files, exploit requires crafted requests.

  • 9.8 /10 Critical
    CVE-2026-75030 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain a missing authorization vulnerability caused by insufficient group administration checks, letting administrators with task execution entitlements mass (de)provision group members beyond their privileges, exploit requires administrator with task execution entitlements.

  • 9.8 /10 Critical
    CVE-2026-73668 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an incorrect authorization vulnerability caused by inadequate realm access control in REST API, letting administrators read confidential connector configurations from other realms, exploit requires administrator privileges.

  • 9.8 /10 Critical
    CVE-2026-73579 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an incorrect authorization vulnerability caused by an empty Realms filter in non-recursive search requests, letting attackers bypass permission restrictions, exploit requires crafted non-recursive search requests.

  • 9.8 /10 Critical
    CVE-2026-73470 No auth

    Apache Syncope - Improper Privilege Management

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an improper privilege management vulnerability caused by delegation of roles outside the user's ownership or realm subtree, letting attackers escalate privileges, exploit requires delegation management permissions.

  • 9.8 /10 Critical
    CVE-2026-73370 No auth

    Apache Syncope - Broken Access Control

    Apache Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an incorrect authorization vulnerability caused by incomplete delegated administration security checks in the Reconciliation service's pull and push, letting administrators without adequate entitlements perform unauthorized actions, exploit requires attacker to be an authenticated administrator.

  • 9.8 /10 Critical
    CVE-2026-65414 No auth

    Apple - Out of Bounds Write

    Apple iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27 contain an out-of-bounds write caused by insufficient bounds checking, letting remote attackers cause app termination or execute arbitrary code, exploit requires remote access.

  • 10.0 /10 Critical
    CVE-2026-65381 No auth

    Apple macOS - Sandbox Escape

    Apple macOS Golden Gate 27, Sequoia 15.8, and Tahoe 26.7 contain a sandbox escape caused by improper entitlement verification, letting malicious apps break out of their sandbox, exploit requires malicious app execution.

  • 9.1 /10 Critical
    CVE-2026-61534 No auth

    Yayson - Prototype Pollution

    Yayson < 4.3.0 contains a prototype pollution vulnerability caused by attacker-controlled JSON:API type, id, and relationship names used as keys in object lookup tables, letting attackers cause process-wide prototype pollution, exploit requires crafted JSON:API documents.

  • 9.8 /10 Critical
    CVE-2026-59178 No auth

    ESPHome Device Builder Dashboard - Authentication Bypass

    ESPHome Device Builder Dashboard prior to 1.0.12 contains an authentication bypass caused by removal of fallback environment variables for credentials, letting unauthenticated attackers access the dashboard remotely, exploit requires exposed dashboard port.