Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
13360
Critical
2486
CISA KEV
125
Public PoC
437

Most common types

  • Broken Access Control 1691
  • Remote Code Execution 1609
  • Privilege Escalation 1307
  • Authentication Bypass 1121
  • Denial of Service 799

Published per day, last 14 days

21 Oct Critical Other 3 Nov

Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 164 of 166

  • 9.8 /10 Critical
    CVE-2026-21096 PoC publicNo auth

    libimagecodec.quram.so - Remote Code Execution

    libimagecodec.quram.so prior to SMR Sep-2026 Release 1 contains a heap-based buffer overflow in JPEG decoder, letting remote attackers execute arbitrary code remotely, exploit requires crafted JPEG input.

  • 9.8 /10 Critical
    CVE-2026-21095 No auth

    libimagecodec.quram.so - Buffer Overflow

    libimagecodec.quram.so < SMR Sep-2026 Release 1 contains a heap-based buffer overflow in DNG decoder, letting remote attackers execute arbitrary code remotely, exploit requires crafted input.

  • 9.1 /10 Critical
    CVE-2026-16272 No auth

    PayTR Virtual Pos iFrame API WHMCS Module - Authentication Bypass

    PayTR Virtual Pos iFrame API (v9x) WHMCS Module >= 9.0.0 < 9.0.3 contains a use of less trusted source vulnerability caused by improper validation of trusted identifiers, letting attackers exploit trusted identifiers, exploit requires crafted requests.

  • 9.0 /10 Critical
    CVE-2026-85982 Auth required

    Auth0 AD/LDAP Connector - Stored XSS

    Auth0 AD/LDAP Connector contains a stored XSS caused by improper HTML encoding in search results and updater log content, letting authenticated users with directory modification privileges or local users execute scripts in admin browsers.

  • 9.9 /10 Critical
    CVE-2026-84869 CISA KEVAuth required

    ScreenConnect - Remote Code Execution

    ScreenConnect client contains an unauthorized file transfer and execution vulnerability during active remote sessions, letting attackers transfer and execute files without host confirmation, exploit requires active remote session.

  • 9.9 /10 Critical
    CVE-2026-83941 Auth required

    Entra ID - Broken Access Control

    Entra ID contains a broken access control vulnerability caused by missing authorization, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.

  • 10.0 /10 Critical
    CVE-2026-82004 No auth

    Adobe Campaign Classic - OS Command Injection

    Adobe Campaign Classic contains an OS Command Injection caused by improper neutralization of special elements, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.6 /10 Critical
    CVE-2026-81376 No auth

    Visual Studio Code - Authentication Bypass

    Visual Studio Code contains an incomplete comparison vulnerability caused by missing factors in security checks, letting unauthorized attackers bypass security features over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-78509 No auth

    Microsoft Office Outlook - Remote Code Execution

    Microsoft Office Outlook contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-78445 No auth

    Windows Services for NFS ONCRPC XDR Driver - Remote Code Execution

    Windows Services for NFS ONCRPC XDR Driver contains a use after free vulnerability, letting unauthorized attackers execute code remotely over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-77493 No auth

    Microsoft Graphics Component - Remote Code Execution

    Microsoft Graphics Component contains a double free vulnerability caused by improper memory management, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.3 /10 Critical
    CVE-2026-76201 No auth

    Adobe Commerce - Stored XSS

    Adobe Commerce contains a stored XSS vulnerability caused by improper sanitization of form fields, letting attackers inject malicious scripts executed in victim browsers, potentially gaining elevated access, exploit requires victim to visit the vulnerable page.

  • 9.3 /10 Critical
    CVE-2026-76200 No auth

    Adobe Commerce - Stored XSS

    Adobe Commerce contains a stored XSS vulnerability caused by improper sanitization of form fields, letting attackers inject malicious scripts executed in victim browsers, exploit requires victim to visit the vulnerable page.

  • 9.1 /10 Critical
    CVE-2026-75746 Auth required

    ColdFusion - SQL Injection

    ColdFusion contains an SQL injection caused by improper neutralization of special elements in SQL commands, letting attackers with high privileges execute arbitrary code, exploit requires high privileges.

  • 9.8 /10 Critical
    CVE-2026-73025 No auth

    Windows iSCSI - Authentication Bypass

    Windows iSCSI contains a broken authentication caused by weak authentication mechanisms, letting unauthorized attackers bypass security features over a network, exploit requires network access.