Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 154 of 166
- 9.8 /10 CriticalCVE-2026-89546 No auth
Linux Kernel - Race Condition
Linux kernel contains a race condition in SUNRPC backchannel handling caused by improper teardown of NFS callback service, letting attackers cause resource leaks or use-after-free, exploit requires race condition timing.
- 9.8 /10 CriticalCVE-2026-89542 No auth
Linux Kernel - Memory Corruption & Denial of Service
Linux kernel contains a buffer over-read and integer underflow vulnerability in SUNRPC gss_krb5_unwrap_v2 caused by insufficient validation of token length and buffer boundaries, letting attackers cause memory corruption or denial of service, exploit requires crafted short tokens.
- 9.8 /10 CriticalCVE-2026-89541 No auth
Linux Kernel - Out-of-Bounds Read
Linux kernel contains an out-of-bounds read vulnerability in SUNRPC gss_unwrap_resp_priv due to improper length checks on RPCSEC_GSS opaque length, letting a crafted krb5p NFS server cause memory corruption, exploit requires crafted RPCSEC_GSS reply.
- 9.8 /10 CriticalCVE-2026-89538 No auth
Linux kernel - Authentication Bypass
Linux kernel contains a broken authentication vulnerability in SUNRPC where oversized Kerberos v2 wrap tokens with invalid ec field are not properly rejected, letting attackers with valid GSS context cause semantic buffer inconsistencies, exploit requires valid GSS context.
- 9.1 /10 CriticalCVE-2026-89537
Linux Kernel - Buffer Over-read
Linux kernel contains a buffer over-read vulnerability in SUNRPC gss_krb5_verify_mic_v2 caused by missing length checks on short RFC 4121 MIC tokens, letting malicious NFS servers cause out-of-bounds reads, exploit requires malicious NFS server.
- 9.8 /10 CriticalCVE-2026-89536
CVE-2026-89536
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake callback xs_tls_handshake_sync() gives xs_tls_handshake_done() a reference to the lower transport before submitting the handshake request. On timeout or signal, the synchronous waiter drops that reference after calling tls_handshake_cancel(). handshake_req_cancel() returns false when handshake_complete() has already marked the request complete. In that case the completion callback can still be running, so dropping the callback-owned reference in the waiter can free the lower transport before xs_tls_handshake_done() stores xprt_err or drops its own reference. If cancellation loses to completion, wait until xs_tls_handshake_done() signals handshake_done and let the callback release its reference. This mirrors the server-side handshake lifetime handling and keeps the timeout or signal return value unchanged.
- 9.8 /10 CriticalCVE-2026-89533
Linux Kernel - Integer Overflow
Linux kernel contains an integer underflow and arithmetic defect in svcrdma's svc_rdma_read_chunk_range function, caused by incorrect offset handling in segment length calculation, letting attackers trigger excessive memory allocation, exploit requires crafted RDMA read chunks.
- 9.1 /10 CriticalCVE-2026-89532 No auth
Linux Kernel - Out of Bounds Read
Linux kernel contains an out-of-bounds read caused by incorrect upper bound calculation in svcrdma pcl_for_each_segment macro when processing chunks with zero segments, letting remote attackers cause a general protection fault, exploit requires crafted network packets.
- 9.8 /10 CriticalCVE-2026-89530 No auth
Linux Kernel svcrdma - Buffer Overflow
Linux kernel svcrdma contains a buffer overflow caused by improper handling of inline replies that exceed the pull-up buffer size, letting remote RPC-over-RDMA clients cause memory corruption, exploit requires crafted RPC requests without Write list or Reply chunk.
- 9.8 /10 CriticalCVE-2026-89526 No auth
Linux kernel svcrdma - Buffer Over-read
Linux kernel svcrdma contains a buffer over-read caused by improper validation of RPC/RDMA Read chunk positions, letting remote clients cause memory corruption or information disclosure, exploit requires crafted RPC/RDMA requests.
- 9.8 /10 CriticalCVE-2026-89495 No auth
Linux Kernel ocfs2 - Out-of-Bounds Write & Read
Linux kernel ocfs2 contains a heap out-of-bounds write caused by unbounded peer-controlled length fields in dlm_migrate_request_handler and related handlers, letting any node in a DLM domain corrupt or panic other nodes, exploit requires attacker to be a member of the cluster.
- 9.8 /10 CriticalCVE-2026-89494 No auth
Linux Kernel ocfs2 - Out-of-Bounds Read & Write
Linux kernel ocfs2 contains an out-of-bounds read and heap out-of-bounds write caused by unvalidated num_locks and lockname_len fields in dlm_mig_lockres_handler, letting any node in the domain cause a kernel panic or memory corruption, exploit requires network access within the domain.
- 9.8 /10 CriticalCVE-2026-89492 No auth
Linux Kernel ocfs2 - Out-of-Bounds Read
Linux kernel ocfs2 filesystem contains an out-of-bounds read vulnerability caused by missing bounds checks on directory-index entry counts in metadata blocks, letting attackers with crafted on-disk images cause slab out-of-bounds reads during directory operations, exploit requires mounting a crafted filesystem image.
- 9.8 /10 CriticalCVE-2026-89485 No auth
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in lockd due to improper pinning of the next file pointer during nlm_inspect_file lock-drop, letting attackers cause memory corruption, exploit requires concurrent file operations.
- 9.8 /10 CriticalCVE-2026-89482 No auth
Linux Kernel nvme-tcp - Memory Corruption
Linux kernel nvme-tcp contains a memory corruption vulnerability caused by improper validation of C2HData based on blk_rq_payload_bytes() without checking blk_rq_nr_phys_segments(), letting attackers cause wild memory access and kernel crash, exploit requires crafted network packets targeting WRITE_ZEROES commands.