Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 19 of 125

  • 9.8 /10 Critical
    CVE-2026-100222 No auth

    Network Policy Server - Remote Code Execution

    Network Policy Server contains a heap-based buffer overflow allowing unauthorized attackers to execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-100219 No auth

    Microsoft QUIC - Remote Code Execution

    Microsoft QUIC contains a use after free vulnerability that allows unauthorized attackers to execute code over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-100202 No auth

    Windows Message Queuing Queue Manager - Remote Code Execution

    Windows Message Queuing Queue Manager contains a use after free vulnerability allowing unauthorized attackers to execute code remotely over a network, exploit requires network access.

  • 9.3 /10 Critical
    CVE-2026-100133 No auth

    Adobe Commerce - Stored XSS

    Adobe Commerce contains a stored XSS vulnerability caused by improper sanitization of form fields, letting attackers inject malicious scripts that execute in victim browsers, potentially gaining elevated access, exploit requires victim to visit the vulnerable page.

  • 9.1 /10 Critical
    CVE-2024-34324

    ProPhoenix Law RMS - Authentication Bypass

    ProPhoenix Law RMS v2022.2403.3.101 contains a session hijacking vulnerability caused by injection of a crafted 24-character string into the ASP.NET_SessionId cookie, letting attackers hijack user sessions, exploit requires crafted cookie injection.

  • 10.0 /10 Critical
    CVE-2024-34323 No auth

    ProPhoenix Law RMS - Insecure Direct Object Reference

    ProPhoenix Law RMS v2022.2403.3.101 contains an insecure direct object reference caused by improper access control on the usrLogin$hdnPFID parameter, letting attackers access sensitive information via crafted HTTP requests.

  • 9.8 /10 Critical
    CVE-2024-34320

    ProPhoenix Law RMS - Broken Access Control

    ProPhoenix Law RMS v2022.2403.3.101 contains an incorrect access control issue in sensitive API endpoints, letting attackers bypass authorization, exploit requires access to the API endpoints.

  • 9.9 /10 Critical
    CVE-2026-96012 Auth required

    IBM Db2 Mirror for i - Privilege Escalation

    IBM Db2 Mirror for i 7.4, 7.5, and 7.6 contains a privilege escalation vulnerability caused by bypassing authorization and input validation checks via crafted requests, letting authenticated attackers execute malicious code and elevate privileges.

  • 9.4 /10 Critical
    CVE-2026-93582

    OTRS Community Edition - Authentication Bypass

    OTRS Community Edition <= 6 contains an authentication bypass caused by trusting HTTP_REMOTE_USER environment variable from attacker-controlled HTTP headers, letting unauthenticated remote attackers impersonate users, exploit requires HTTP Basic Authentication backend and vulnerable web server environment.

  • 9.3 /10 Critical
    CVE-2026-92681 No auth

    neo4j/graphql - Authentication Bypass

    @neo4j/graphql <= 7.6.3 contains an authentication bypass caused by ignoring @authentication directives at schema or type level on top-level @cypher fields, letting unauthenticated callers read and modify data, exploit requires exposed top-level @cypher fields.

  • 9.6 /10 Critical
    CVE-2026-9191

    Progress MarkLogic Server - Broken Access Control

    Progress MarkLogic Server 12.x < 12.1.0 and 11.x < 11.3.7 contain a broken access control vulnerability caused by insufficient isolation of user-supplied code in REST and XDBC evaluation paths, letting attackers perform unauthorized actions or compromise authenticated sessions, exploit requires code execution through affected paths.

  • 9.8 /10 Critical
    CVE-2026-90920 No auth

    IBM Maximo AI Service - Remote Code Execution

    IBM Maximo AI Service 9.1.0 and 9.2.0 contain a remote code execution caused by improper control of code generation, letting remote attackers execute arbitrary code, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-87744 No auth

    Quarkus REST Data Panache - Broken Access Control

    Quarkus REST Data Panache contains a broken access control vulnerability caused by @MethodProperties customization dropping class-level security roles, letting unauthenticated attackers bypass security and access endpoints, exploit requires use of @MethodProperties without re-declaring roles.

  • 9.6 /10 Critical
    CVE-2026-85956 Auth required

    Progress MarkLogic Server - Broken Access Control

    Progress MarkLogic Server 12.x < 12.1.0 and 11.x < 11.3.7 contain a broken access control vulnerability caused by improper authorization checks in backup and restore operations, letting remote attackers with delegated database-administrator privileges access or modify security-critical data outside authorized scope.

  • 9.9 /10 Critical
    CVE-2026-85955 Auth required

    Progress MarkLogic Server - Server-Side Code Execution

    Progress MarkLogic Server 12.x < 12.1.0 and 11.x < 11.3.7 contain a server-side code execution vulnerability caused by missing evaluation privilege checks in XQuery evaluation function, letting remote attackers with query-execution access execute code with elevated permissions.