Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 16 of 166

  • 9.6 /10 Critical
    CVE-2026-118312 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 156.0.8078.73 contains a memory corruption vulnerability in Paint component, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires crafted HTML page.

  • 9.6 /10 Critical
    CVE-2026-118310 No auth

    Google Chrome - Remote Code Execution

    Google Chrome on Windows < 156.0.8078.73 contains a remote code execution caused by improper input validation in Views component, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page.

  • 9.6 /10 Critical
    CVE-2026-118309 No auth

    Google Chrome - Remote Code Execution

    Google Chrome on Android < 156.0.8078.73 contains a remote code execution caused by improper input validation in UI, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML page, exploit requires crafted HTML page.

  • 9.6 /10 Critical
    CVE-2026-118308 No auth

    Google Chrome - Use After Free

    Google Chrome < 156.0.8078.73 contains a use after free vulnerability in SVG, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-118306 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 156.0.8078.73 contains a memory corruption vulnerability in FileSystem, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-118305 No auth

    Google Chrome - Remote Code Execution

    Google Chrome < 156.0.8078.73 contains a memory corruption vulnerability caused by improper memory handling in Turbolev, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.8 /10 Critical
    CVE-2026-117564

    nest-admin - Authentication Bypass

    nest-admin < 1.0.1 contains an authentication bypass caused by a hardcoded JWT_SECRET in .env.production, letting unauthenticated attackers forge admin tokens and impersonate users, exploit requires knowledge of the secret.

  • 9.8 /10 Critical
    CVE-2026-117532 PoC publicNo auth

    REDAXO core - Authentication Bypass

    REDAXO core >= 5.3.0 < 5.21.4 contains an authentication bypass caused by predictable session-tied secret in the structure/history plugin, letting unauthenticated attackers forge login tokens and gain backend access and code execution.

  • 9.6 /10 Critical
    CVE-2026-116863 No auth

    Tribulant Software Newsletters - Cross Site Request Forgery

    Tribulant Software Newsletters newsletters-lite <= 4.18.2 contains a cross site request forgery vulnerability caused by lack of CSRF protection, letting attackers perform unauthorized actions via forged requests, exploit requires victim interaction.

  • 9.8 /10 Critical
    CVE-2026-116692 PoC public

    MLflow - Remote Code Execution

    MLflow 3.12.0rc0 to < 3.17.0 contains a remote code execution caused by insecure third-party scorer deserialization in mlflow/genai/scorers/base.py, letting attackers execute arbitrary code via writable allowed packages, exploit requires writable allowed scorer package and appropriate privileges.

  • 9.1 /10 Critical
    CVE-2026-115216

    Eclipse ioFog Operator - Authentication Bypass

    Eclipse ioFog Operator < 3.9.2 contains a broken authentication caused by disabled TLS certificate verification when contacting Controller API and external OIDC issuer, letting on-path attackers capture credentials and access tokens, exploit requires network interception.

  • 9.8 /10 Critical
    CVE-2026-114595 PoC publicNo auth

    EPICS Base - Integer Overflow

    EPICS Base <= 7.0.10 contains an integer overflow caused by improper network request processing, letting remote attackers cause memory corruption, denial of service, or remote code execution, exploit requires crafted network requests.

  • 9.2 /10 Critical
    CVE-2026-112710

    Fireware OS - Buffer Overflow

    Fireware OS contains a heap-based buffer overflow caused by specially crafted responses from a controlled or intercepted Active Directory server, letting attackers cause denial of service or execute arbitrary code remotely, exploit requires control or interception of Active Directory traffic.

  • 9.2 /10 Critical
    CVE-2026-112709

    Fireware OS - Buffer Overflow

    Fireware OS contains a heap-based buffer overflow caused by specially crafted responses from a controlled or intercepted Active Directory server, letting attackers cause denial of service or execute arbitrary code remotely, exploit requires control or interception of Active Directory traffic.

  • 9.1 /10 Critical
    CVE-2026-112362 No auth

    @fastify/express - Broken Access Control

    @fastify/express 4.0.5 through 4.0.8 contains a broken access control caused by mismatch in path normalization between Fastify router and Express middleware when ignoreDuplicateSlashes option is enabled, letting unauthenticated attackers bypass authentication middleware on scoped routes, exploit requires ignoreDuplicateSlashes option enabled.