Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 160 of 166

  • 9.0 /10 Critical
    CVE-2026-59679

    libXfont2 - Out-of-Bounds Read & Write

    libXfont2 font-server client contains a heap out-of-bounds read and write caused by inconsistent size checks between FS_QueryXExtents16 and FS_QueryXBitmaps16 replies, letting a malicious font server perform memory corruption remotely, exploit requires a malicious or compromised font server.

  • 9.8 /10 Critical
    CVE-2026-57967 PoC publicNo auth

    Apache Artemis - Authentication Bypass

    Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0 contain a session hijacking vulnerability caused by crafted CORE protocol SESSION_REATTACH packets, letting unauthenticated remote attackers steal active sessions.

  • 9.8 /10 Critical
    CVE-2026-52098 No auth

    Flowise - Remote Code Execution

    Flowise 3.1.2 contains a remote code execution caused by improper input handling in /api/v1/prediction/<flowId> endpoint, letting remote attackers execute arbitrary code, exploit requires no special privileges.

  • 9.1 /10 Critical
    CVE-2026-49364 No auth

    Apache Artemis - Information Disclosure

    Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0 contain an information disclosure vulnerability caused by insecure cluster connection handshake, letting unauthenticated network-adjacent attackers capture cluster administrative credentials, exploit requires network adjacency.

  • 9.1 /10 Critical
    CVE-2026-45764 No auth

    Suricata - Denial of Service

    Suricata < 7.0.16 and < 8.0.5 contain a denial of service caused by type confusion during HTTP/2 protocol processing, letting attackers crash the system remotely, exploit requires crafted HTTP/2 traffic.

  • 9.0 /10 Critical
    CVE-2026-44950

    libXfont2 - Buffer Overflow

    libXfont2 contains a heap buffer overflow caused by improper validation of cumulative glyph bitmap copy sizes in fs_read_glyphs(), letting a malicious font server overflow the destination buffer, exploit requires a malicious font server.

  • 9.8 /10 Critical
    CVE-2026-38626 No auth

    Garlic-Hub - SQL Injection

    Garlic-Hub v1.0.1 contains a sql injection caused by improper sanitization in src/Modules/Items/Repositories/ItemsRepository.php, letting attackers execute arbitrary SQL commands remotely, exploit requires crafted input.

  • 9.1 /10 Critical
    CVE-2026-19646 No auth

    IBM Common Licensing Agent - Open Redirect

    IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 contain an open redirect caused by improper validation of the HTTP Host header, letting remote attackers redirect users to arbitrary domains, exploit requires crafted HTTP requests.

  • 9.9 /10 Critical
    CVE-2026-19583 Auth required

    Velociraptor - Broken Access Control

    Velociraptor contains a broken access control vulnerability caused by missing permission checks on client monitoring artifacts, letting users schedule restricted artifacts like Linux.Sys.BashShell, exploit requires scheduling privileges.

  • 9.8 /10 Critical
    CVE-2026-18351 PoC publicNo auth

    Elementor Drag and Drop File Upload - Unrestricted File Upload

    Elementor Drag and Drop File Upload plugin for WordPress <= 1.6.0 contains an arbitrary file upload vulnerability caused by insufficient file type validation in is_file_type_valid(), letting unauthenticated attackers upload executable files and achieve remote code execution.

  • 9.8 /10 Critical
    CVE-2026-87929 No auth

    MaxSite CMS - Authentication Bypass

    MaxSite CMS through 109.6 contains a broken authentication caused by a hardcoded session encryption key in application/config/config.php, letting unauthenticated attackers forge administrator session cookies, exploit requires knowledge of the hardcoded key.

  • 9.6 /10 Critical
    CVE-2026-87911 No auth

    Amazon awslabs postgres-mcp-server - Command Injection

    Amazon awslabs postgres-mcp-server < 1.1.7 contains an OS command injection caused by improper read-only enforcement in the SQL validation component, letting unauthenticated actors execute OS commands via crafted COPY ... TO PROGRAM statements, exploit requires authenticated user interaction.

  • 9.6 /10 Critical
    CVE-2026-87654 No auth

    Google Chrome - Buffer Overflow

    Google Chrome < 153.0.8010.36 contains a buffer overflow in ANGLE on Windows, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.

  • 9.6 /10 Critical
    CVE-2026-87650 No auth

    Google Chrome - Out of Bounds Read

    Google Chrome < 153.0.8010.36 contains an out of bounds read in WebGL, letting remote attackers potentially execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires no special privileges.

  • 9.6 /10 Critical
    CVE-2026-87646 No auth

    Google Chrome - Use After Free

    Google Chrome < 153.0.8010.36 contains a use after free vulnerability in Web Authentication, caused by improper memory handling, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages.