Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 153 of 166
- 9.8 /10 CriticalCVE-2026-89636 No auth
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability caused by ce->tgthint pointing to freed cache_dfs_tgt structures in smb client free_tgts(), letting attackers cause memory corruption or denial of service, exploit requires triggering smb client target list free.
- 9.8 /10 CriticalCVE-2026-89635 No auth
Linux Kernel ksmbd - Use After Free
Linux kernel ksmbd contains a use-after-free vulnerability caused by rebinding oplocks of all detached durable handles on an inode to a reconnecting session instead of only the file's own, letting authenticated attackers cause kernel memory corruption during durable reconnects, exploit requires multiple sessions with durable handles on the same file.
- 9.1 /10 CriticalCVE-2026-89634 No auth
Linux Kernel smb client - Out of Bounds Read & Denial of Service
Linux kernel contains a buffer overflow caused by an ALIGN() overflow in smb client symlink_data() error context loop, letting attackers cause out-of-bounds read or infinite loop, exploit requires crafted SMB response.
- 9.8 /10 CriticalCVE-2026-89633 No auth
Linux Kernel smb client - Out-of-Bounds Read/Write
Linux kernel smb client contains an out-of-bounds read/write caused by unvalidated DataOffset in coalesce_t2(), letting attackers cause memory corruption or crash, exploit requires crafted SMB packets.
- 9.1 /10 CriticalCVE-2026-89631 No auth
Linux kernel smb client - Out of Bounds Read
Linux kernel smb client contains a buffer overflow caused by improper bounds checking of tree connect response byte count in CIFSTCon(), letting attackers cause memory corruption, exploit requires crafted server response.
- 9.1 /10 CriticalCVE-2026-89630 No auth
Linux Kernel smb client - Broken Access Control
Linux kernel smb client contains a broken access control vulnerability caused by incorrect data_offset bound check in is_valid_oplock_break(), letting attackers bypass read overflow protections, exploit requires crafted SMB messages.
- 9.8 /10 CriticalCVE-2026-89614 No auth
Linux Kernel - Out of Bounds Read
Linux kernel ntfs contains an out-of-bounds read caused by improper bounding of the free-cluster bitmap scan in ntfs_cluster_alloc, letting attackers trigger kernel memory corruption, exploit requires crafted NTFS volume with oversized $Bitmap.
- 9.8 /10 CriticalCVE-2026-89613 No auth
Linux Kernel - Denial of Service
Linux kernel contains a denial of service caused by accepting invalid empty mapping pairs in NTFS attributes with inconsistent highest VCN and size, letting attackers cause system instability, exploit requires crafted NTFS attribute.
- 9.8 /10 CriticalCVE-2026-89612 No auth
Linux kernel - Out of Bounds Read
Linux kernel contains an out-of-bounds read caused by improper handling of NTFS boot sector MFT LCNs, letting attackers trigger memory corruption via crafted high-bit values, exploit requires crafted NTFS boot sector.
- 9.8 /10 CriticalCVE-2026-89611 No auth
Linux Kernel ntfs - Memory Corruption
Linux kernel ntfs subsystem contains a buffer overflow vulnerability caused by improper validation of non-resident attribute name offsets during conversion between non-sparse and sparse attributes, letting attackers cause memory corruption, exploit requires crafted malicious MFT record.
- 9.8 /10 CriticalCVE-2026-89610 No auth
Linux Kernel - Privilege Escalation
Linux kernel contains a privilege escalation caused by improper validation of NTFS mapping pairs run length exceeding volume boundary, letting attackers cause memory corruption and escalate privileges, exploit requires crafted NTFS image.
- 9.8 /10 CriticalCVE-2026-89558 No auth
Linux Kernel md/raid10 - Data Corruption
Linux kernel md/raid10 contains a logic error caused by incorrect boolean assignment in raid10_sync_request(), letting attackers cause silent data corruption during device recovery, exploit requires degraded RAID10 array with device failure.
- 9.8 /10 CriticalCVE-2026-89555 No auth
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in mpls_select_multipath caused by stale header pointer after pskb_may_pull() reallocates skb head, letting attackers cause kernel memory corruption, exploit requires crafted Geneve packet with nonlinear skb data.
- 9.8 /10 CriticalCVE-2026-89551 No auth
Linux Kernel - Integer Overflow
Linux kernel contains an integer underflow vulnerability in SUNRPC xdr_buf_trim function caused by improper clamping of buf->len during subtraction, letting attackers cause buffer length miscalculation, exploit requires crafted input triggering xdr_buf_trim.
- 9.8 /10 CriticalCVE-2026-89550 No auth
Linux Kernel - Denial of Service
Linux kernel contains a buffer length validation vulnerability in SUNRPC svcauth_gss component, caused by missing minimum length check on krb5 tokens, letting remote attackers cause a denial of service via crafted tokens, exploit requires network access.