Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 155 of 166
- 9.8 /10 CriticalCVE-2026-89479 No auth
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in SCTP due to improper handling of association deletion in sctp_endpoint_bh_rcv(), letting remote attackers cause memory corruption by sending crafted SCTP packets, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-89478 No auth
Linux Kernel SCTP - Use After Free
Linux kernel SCTP contains a use-after-free vulnerability caused by a race condition where a removed transport is accessed in SCTP packet processing, letting authenticated attackers cause memory corruption, exploit requires authenticated ASCONF DEL-IP.
- 9.3 /10 CriticalCVE-2026-89448
Linux Kernel - Misconfiguration
Linux kernel contains a misconfiguration vulnerability in iommu/vt-d where ACS is not requested when tboot is enabled, causing potential security bypass due to disabled ACS, exploit requires tboot enabled.
- 9.8 /10 CriticalCVE-2026-89259
Hugo - File System Read & Write
Hugo > v0.43 contains a file read and write vulnerability caused by permissive Node tool execution permissions for TailwindCSS, letting attackers read and write files outside the project directory during build, exploit requires use of TailwindCSS.
- 9.8 /10 CriticalCVE-2026-89010 No auth
WAVLINK WN535M1 & WN535M3 - Command Injection
WAVLINK WN535M1 and WN535M3 routers < M35M1_V250922 contain an unauthenticated command injection caused by unsanitized filename input in sync_server daemon on TCP port 13136, letting remote attackers execute arbitrary root commands.
- 9.1 /10 CriticalCVE-2026-89009 No auth
WAVLINK WN535M - Arbitrary File Write
WAVLINK WN535M1 and WN535M3 routers < M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability caused by lack of path canonicalization in sync_server daemon on TCP port 13136, letting remote attackers overwrite files as root, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-8778 No auth
MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields - Unrestricted File Upload
MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields plugin for WordPress <= 1.2.1 contains an unrestricted file upload vulnerability caused by missing file type validation in the mipl_wc_upload_file function, letting unauthenticated attackers upload arbitrary files, potentially leading to remote code execution, exploit requires no authentication.
- 9.8 /10 CriticalCVE-2026-86793 No auth
SGLang - Insecure Deserialization
SGLang contains an insecure deserialization vulnerability caused by unauthenticated pickle deserialization via /update_weights_from_tensor when no auth keys are configured, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication keys configured.
- 9.8 /10 CriticalCVE-2026-84390
Fortinet FortiMonitorOnSight - Information Disclosure
Fortinet FortiMonitorOnSight 7.2.0 through 7.2.2 and 7.2.4 through 7.2.7 contain an information disclosure caused by inclusion of sensitive information in source code, letting attackers access sensitive data, exploit requires unspecified attack vector.
- 9.8 /10 CriticalCVE-2026-82617 No auth
Apache OpenNLP - Denial of Service
Apache OpenNLP 2.0.0 through 2.5.11 and 3.0.0-M1 through 3.0.0-M5 contain a denial of service caused by ambiguous nested quantifiers in built-in RegexNameFinder patterns for EMAIL and URL, letting attackers supply crafted text to cause excessive CPU usage or thread crashes, exploit requires attacker to supply untrusted text for analysis.
- 9.8 /10 CriticalCVE-2026-81002
Linux Kernel - Memory Corruption
Linux kernel contains a memory corruption vulnerability in xdp_convert_zc_to_xdp_frame caused by improper zero-copy frame layout handling in AF_XDP packets redirected through cpumap, letting attackers cause kernel panic or memory corruption, exploit requires use of AF_XDP zero-copy with cpumap redirection.
- 9.8 /10 CriticalCVE-2026-80986 No auth
Linux Kernel - Out of Bounds Read/Write
Linux kernel contains a buffer over-read vulnerability in net/smc SMC-Rv2 LLC message handling caused by unbounded peer rkey counts, letting attackers cause kernel memory corruption or crash, exploit requires network access to SMC-Rv2 link.
- 9.8 /10 CriticalCVE-2026-80981
Linux Kernel - Use After Free
Linux kernel contains a use-after-free vulnerability in net/smc component caused by use of freed LLC queue entry in smc_llc_srv_add_link(), letting attackers cause memory corruption or system instability, exploit requires kernel-level conditions.
- 9.8 /10 CriticalCVE-2026-80980 No auth
Linux Kernel - Race Condition
Linux kernel contains a race condition in net/smc due to shared single-byte bitfields for connection state flags, letting concurrent contexts cause inconsistent state, exploit requires concurrent access to connection flags.
- 9.8 /10 CriticalCVE-2026-80976 No auth
Linux Kernel - Out-of-Bounds Read
Linux kernel contains a buffer out-of-bounds vulnerability caused by stale IPv6 control block values after IPv6 decapsulation in seg6, letting unprivileged users read beyond skb head, exploit requires local SID installation and packet injection.