Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 18 of 125

  • 9.9 /10 Critical
    CVE-2026-105895 Auth required

    Adobe Experience Manager - Improper Input Validation

    Adobe Experience Manager contains an improper input validation vulnerability that allows attackers to execute arbitrary code in the context of the current user, potentially gaining elevated access, exploit requires no user interaction.

  • 9.4 /10 Critical
    CVE-2026-105445 Auth required

    Docker Hub - Broken Access Control

    Docker Hub contains an incorrect privilege assignment caused by improper handling of personal access token reassignment in account-to-organization conversion, letting authenticated attackers reassign tokens to other users, exploit requires authentication.

  • 9.8 /10 Critical
    CVE-2026-105016 No auth

    Microsoft QUIC - Remote Code Execution

    Microsoft QUIC contains a heap-based buffer overflow caused by improper memory handling, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-105010 No auth

    Microsoft Windows Search Component - Privilege Escalation

    Microsoft Windows Search Component contains a use after free vulnerability allowing unauthorized attackers to elevate privileges over a network, exploit requires network access.

  • 9.0 /10 Critical
    CVE-2026-105008 No auth

    Windows Schannel - Spoofing

    Windows Schannel contains a spoofing vulnerability caused by improper authentication handling, letting unauthorized attackers impersonate entities over a network, exploit requires network access.

  • 8.6 /10 Critical
    CVE-2026-104935 CISA KEVPoC publicNo auth

    ICS - Authentication Bypass

    ICS < 25.1.3.0 contains an authentication bypass by spoofing, letting remote unauthenticated attackers execute arbitrary commands, exploit requires no special privileges.

  • 9.8 /10 Critical
    CVE-2026-104585 PoC publicNo auth

    Mobile Security Framework (MobSF) - Command Injection

    Mobile Security Framework (MobSF) v4.5.2 contains a command injection caused by improper input handling in /download_data/, /api/v1/scan, and Dynamic Analyzer ADB integration module, letting attackers execute arbitrary commands remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-104252 No auth

    Vitess - Stored XSS

    Vitess < 23.0.5 and < 24.0.2 contains a stored XSS caused by unescaped Action and dtid form values in the /twopcz HTTP debug endpoint, letting remote unauthenticated attackers execute scripts in operator browsers, exploit requires operator to open crafted request.

  • 9.6 /10 Critical
    CVE-2026-104192 No auth

    Dragonfly - Use After Free

    Dragonfly < 1.40 contains a double-free vulnerability caused by improper cleanup of shared objects in OpaqueObjLoader::CreateStream, letting unauthenticated clients cause denial of service or remote code execution via crafted RESTORE streams.

  • 9.3 /10 Critical
    CVE-2026-103928 No auth

    Metabase - File System Read & Write

    Metabase 1.55.0 to 1.58.16, 1.59.13, 1.60.9, and 1.61.4 contains a file system read and write vulnerability caused by unrestricted host-facing built-in functions in native queries against H2 data source, letting authorized users read or write arbitrary files on the server, exploit requires user authorization to run native queries.

  • 10.0 /10 Critical
    CVE-2026-103849 No auth

    Adobe Commerce - Template Injection

    Adobe Commerce contains a template injection caused by improper neutralization of special elements in the template engine, letting attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.9 /10 Critical
    CVE-2026-103848 Auth required

    Adobe Experience Manager - OS Command Injection

    Adobe Experience Manager contains an OS command injection caused by improper neutralization of special elements, letting low-privileged attackers execute arbitrary code in the context of the current user, exploit requires no user interaction.

  • 9.3 /10 Critical
    CVE-2026-102989 No auth

    TanStack Router - Stored XSS

    TanStack Router versions @tanstack/start-server-core 1.143.12 to <1.169.39, @tanstack/react-start <1.168.60, @tanstack/solid-start <1.168.57, and @tanstack/vue-start <1.168.56 contain a stored XSS caused by attacker-controlled middleware state reaching error path, letting unauthenticated attackers inject scripts that execute with visitor's authority, exploit requires crafted server-function URL.

  • 9.6 /10 Critical
    CVE-2026-102238 No auth

    Visual Studio Code - Path Traversal

    Visual Studio Code contains a path traversal vulnerability caused by improper limitation of a pathname to a restricted directory, letting unauthorized attackers execute code over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-102210 No auth

    Windows Text Shaping - Remote Code Execution

    Windows Text Shaping contains a heap-based buffer overflow, letting unauthorized attackers execute code remotely, exploit requires network access.