Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 152 of 166
- 9.8 /10 CriticalCVE-2026-89669 No auth
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in nfsd4_copy_notify due to improper initialization and publication order of copy-notify stateid, letting remote attackers cause memory corruption via racing OFFLOAD_CANCEL, exploit requires crafted network requests.
- 9.8 /10 CriticalCVE-2026-89662
Linux Kernel NFSD - Use After Free
Linux kernel NFSD contains a use-after-free vulnerability caused by improper lock owner reference handling during client teardown in __destroy_client(), letting attackers cause NULL dereference and potential denial of service, exploit requires client teardown conditions.
- 9.8 /10 CriticalCVE-2026-89660 No auth
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in NFSD during admin state revocation caused by improper client pointer handling in nfs4_client stateid, letting attackers cause memory corruption, exploit requires race condition during client teardown.
- 9.8 /10 CriticalCVE-2026-89659 No auth
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in NFSD delegation revoke caused by improper client reference handling in nfs4_laundromat, letting attackers cause memory corruption, exploit requires client delegation timeout.
- 9.8 /10 CriticalCVE-2026-89658 No auth
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in NFSD during NFSv4.0 revoked-state cleanup caused by improper client reference handling, letting attackers cause memory corruption, exploit requires race condition during client teardown.
- 9.8 /10 CriticalCVE-2026-89656
Linux kernel libceph - Out of Bounds Write
Linux kernel libceph contains an out-of-bounds write caused by mismatched CRUSH bucket ids in crush_decode(), letting attackers trigger memory corruption, exploit requires a malformed CRUSH map.
- 9.8 /10 CriticalCVE-2026-89655 No auth
Linux Kernel ceph - Use After Free
Linux kernel ceph contains a use-after-free vulnerability in __kick_flushing_caps() caused by accessing freed cf entries during list iteration, letting attackers cause memory corruption or denial of service, exploit requires race condition timing.
- 9.8 /10 CriticalCVE-2026-89654
Linux kernel ceph - Use After Free
Linux kernel ceph contains a use-after-free vulnerability in check_new_map() caused by missing reference counting on session objects during mutex unlock, letting concurrent threads access freed memory, exploit requires concurrent session teardown.
- 9.8 /10 CriticalCVE-2026-89653 No auth
Linux Kernel - Out of Bounds Read/Write
Linux kernel contains a buffer overflow caused by unchecked export_targets ranks in ceph mdsmap decode, letting attackers cause memory corruption by providing ranks >= CEPH_MAX_MDS, exploit requires crafted mdsmap data.
- 9.8 /10 CriticalCVE-2026-89652
Linux kernel Ceph - Buffer Overflow
Linux kernel Ceph contains a buffer overflow caused by unchecked dname_len in ceph_get_name and __get_snap_name functions, letting malicious or compromised Ceph MDS cause out-of-bounds write, exploit requires CephFS mount re-exported over NFS.
- 9.8 /10 CriticalCVE-2026-89651 No auth
Linux Kernel ceph - Out-of-Bounds Read
Linux kernel contains an out-of-bounds read vulnerability in ceph handle_session() due to missing bounds checks on MDSCapAuth path and fs_name decoding, letting malicious MDS crash the client during session setup without user interaction.
- 9.1 /10 CriticalCVE-2026-89650
Linux Kernel Ceph - Out-of-Bounds Read
Linux kernel Ceph component (info_v 2 and 3) contains an out-of-bounds read caused by missing bounds check on num_export_targets in ceph_mdsmap_decode(), letting malicious or compromised Ceph monitors trigger kernel memory read, exploit requires a malicious or compromised Ceph monitor or on-path attacker on unsigned messenger session.
- 9.1 /10 CriticalCVE-2026-89649 No auth
Linux kernel CephFS - Information Disclosure
Linux kernel CephFS contains an information disclosure vulnerability caused by missing bounds check on the last xattr value length in __build_xattrs(), letting a malicious metadata server disclose adjacent kernel heap bytes to local users via getxattr(2), exploit requires local user access.
- 9.8 /10 CriticalCVE-2026-89643
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in audit_del_rule() caused by improper handling of tree references during fsnotify rule autoremove, letting attackers cause system instability or denial of service, exploit requires triggering fsnotify autoremove.
- 9.8 /10 CriticalCVE-2026-89637 No auth
Linux kernel smb client - Use After Free
Linux kernel smb client contains a use-after-free and buffer leak caused by improper handling of malformed secondary TRANSACT2 responses in cifs_check_trans2(), letting attackers cause memory corruption, exploit requires crafted malformed secondary T2 response.