Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 163 of 166
- 9.6 /10 CriticalCVE-2026-87438 No auth
Google Chrome - Remote Code Execution
Google Chrome on Android < 153.0.8010.36 contains an out of bounds write in WebGL, letting remote attackers execute arbitrary code outside the sandbox via crafted HTML pages, exploit requires victim to visit malicious page.
- 9.8 /10 CriticalCVE-2026-85978 No auth
Akana API Platform - Remote Code Execution
Akana API Platform contains a remote code execution caused by path normalization discrepancy in the Policy Manager console, letting unauthenticated remote attackers execute arbitrary code, exploit requires no authentication or user interaction.
- 9.8 /10 CriticalCVE-2026-85103 No auth
Check Point Quantum Security Management & Quantum Security Gateway - Remote Code Execution
Check Point Quantum Security Management and Quantum Security Gateway contain a heap-based buffer overflow caused by improper ASN.1 decoding in VPN certificate processing, letting unauthenticated remote attackers execute arbitrary code.
- 9.8 /10 CriticalCVE-2026-85102 CISA KEVPoC publicNo auth
Check Point Quantum Security Gateway - Remote Code Execution
Check Point Quantum Security Gateway contains a remote code execution caused by improper certificate trust validation during VPN negotiation, letting unauthenticated remote attackers execute arbitrary code.
- 9.8 /10 CriticalCVE-2026-80172 No auth
Dell SCG 5.0 - Authentication Bypass
Dell SCG 5.0 Appliance < 5.36.00.16 and Dell SCG 5.0 Application < 5.36.00.00 contain an insufficient verification of data authenticity vulnerability, letting unauthenticated remote attackers gain unauthorized ADMIN access and refresh tokens by reusing captured requests indefinitely.
- 9.8 /10 CriticalCVE-2026-71805 No auth
LZ-litchi - Unrestricted File Upload
LZ-litchi 1.0.0 contains an unrestricted file upload and path traversal vulnerability caused by improper validation of the directory parameter in POST /app-api/infra/file/upload, letting unauthenticated remote attackers upload and write arbitrary files outside intended directories.
- 9.8 /10 CriticalCVE-2026-71801 No auth
s-pms SPMS-Server - Authentication Bypass
s-pms SPMS-Server through v1.0 contains a broken authentication caused by a hardcoded default access token secret in the core configuration file, letting remote unauthenticated attackers bypass authentication and gain full admin access, exploit requires no special conditions.
- 9.9 /10 CriticalCVE-2026-67401 PoC publicAuth required
cPanel - SQL Injection
cPanel contains a SQL injection caused by improper input sanitization in the EmailTrack component, letting mail-enabled accounts achieve remote code execution as root, exploit requires mail-enabled account access.
- 9.8 /10 CriticalCVE-2026-56207
Apache Impala - Authentication Bypass
Apache Impala >=4.0.0 contains a broken authentication caused by lack of signature verification of Bearer token in the last step of SAML2 authentication for hs2-http interface, letting attackers alter user names and impersonate other users, exploit requires crafted Bearer token.
- 9.6 /10 CriticalCVE-2026-54694 No auth
SkillTree - Stored XSS & CSRF Token Theft
SkillTree < 4.4.2 contains a stored XSS caused by unsanitized user input in account registration fields and unsafe HTML rendering in StringHighlighter.js and HighlightedValue.vue, letting attackers execute arbitrary scripts in admin browsers, exploit requires attacker to self-register with crafted input.
- 9.1 /10 CriticalCVE-2026-53939 No auth
OpenIDC cjose - Cryptographic Key Generation Flaw
OpenIDC cjose 0.6.1 through 0.6.2.5 contains a cryptographic key generation flaw caused by zeroed content-encryption key in AES-CBC-HMAC JWE encryption, letting attackers decrypt and forge JWE content, exploit requires use of affected algorithms.
- 9.8 /10 CriticalCVE-2026-41871
Apache Nutch - Unsafe Reflection
Apache Nutch 1.10 through 1.22 contains an unsafe reflection vulnerability caused by use of externally-controlled input to select classes or code in Nutch Server (Nutch REST API), letting attackers bypass authorization, exploit requires access to Nutch Server.
- 9.1 /10 CriticalCVE-2026-41869 No auth
Apache Nutch - Broken Access Control
Apache Nutch 1.10 through 1.22 contains missing authorization, improper resource shutdown, and job interruption vulnerabilities in the Nutch REST API, letting attackers cause service disruption and unauthorized access, exploit requires network access to the Nutch Service.
- 9.8 /10 CriticalCVE-2026-36433
Actions Semiconductor Co. Ltd Tool- Media Player Utilities - Remote Code Execution
Actions Semiconductor Co. Ltd Tool- Media Player Utilities v4.46 contains a remote code execution caused by vulnerabilities in Production.dll and RdiskUpgrade.exe components, letting physically proximate attackers execute arbitrary code.
- 9.1 /10 CriticalCVE-2026-22590 No auth
eProsima Fast DDS - Out-of-Bounds Read
eProsima Fast DDS < 2.6.12, 2.14.6, 3.2.4, 3.3.1, and 3.4.2 contains an out-of-bounds read caused by improper validation of DATA_FRAG submessage payload length in CacheChange_t::add_fragments, letting remote attackers read adjacent heap memory, exploit requires crafted DATA_FRAG packets.