Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 13360
- Critical
- 2486
- CISA KEV
- 125
- Public PoC
- 437
Most common types
- Broken Access Control 1691
- Remote Code Execution 1609
- Privilege Escalation 1307
- Authentication Bypass 1121
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 3 Nov 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 25 of 166
- 9.8 /10 CriticalCVE-2026-79854
CVE-2026-79854
The vendor has not published a description for this vulnerability. Its CVSS v3.1 base assessment scores it for exploitation over a network; confidentiality is affected at a high level, integrity at a high level, availability at a high level. See the vendor advisory in the references for details.
- 9.8 /10 CriticalCVE-2026-79853
CVE-2026-79853
The vendor has not published a description for this vulnerability. Its CVSS v3.1 base assessment scores it for exploitation over a network; confidentiality is affected at a high level, integrity at a high level, availability at a high level. See the vendor advisory in the references for details.
- 9.8 /10 CriticalCVE-2026-79852
CVE-2026-79852
The vendor has not published a description for this vulnerability. Its CVSS v3.1 base assessment scores it for exploitation over a network; confidentiality is affected at a high level, integrity at a high level, availability at a high level. See the vendor advisory in the references for details.
- 10.0 /10 CriticalCVE-2026-79851
CVE-2026-79851
The vendor has not published a description for this vulnerability. Its CVSS v3.1 base assessment scores it for exploitation over a network; confidentiality is affected at a high level, integrity at a high level, availability at a high level. See the vendor advisory in the references for details.
- 10.0 /10 CriticalCVE-2026-79850
CVE-2026-79850
The vendor has not published a description for this vulnerability. Its CVSS v3.1 base assessment scores it for exploitation over a network; confidentiality is affected at a high level, integrity at a high level. See the vendor advisory in the references for details.
- 10.0 /10 CriticalCVE-2026-79849
CVE-2026-79849
The vendor has not published a description for this vulnerability. Its CVSS v3.1 base assessment scores it for exploitation over a network; confidentiality is affected at a high level, integrity at a high level, availability at a high level. See the vendor advisory in the references for details.
- 10.0 /10 CriticalCVE-2026-79848
CVE-2026-79848
The vendor has not published a description for this vulnerability. Its CVSS v3.1 base assessment scores it for exploitation over a network; confidentiality is affected at a high level, integrity at a high level, availability at a high level. See the vendor advisory in the references for details.
- 10.0 /10 CriticalCVE-2026-79847
CVE-2026-79847
The vendor has not published a description for this vulnerability. Its CVSS v3.1 base assessment scores it for exploitation over a network; confidentiality is affected at a high level, integrity at a high level, availability at a high level. See the vendor advisory in the references for details.
- 10.0 /10 CriticalCVE-2026-79846
CVE-2026-79846
The vendor has not published a description for this vulnerability. Its CVSS v3.1 base assessment scores it for exploitation over a network; confidentiality is affected at a high level, integrity at a high level, availability at a high level. See the vendor advisory in the references for details.
- 10.0 /10 CriticalCVE-2026-79844
CVE-2026-79844
The vendor has not published a description for this vulnerability. Its CVSS v3.1 base assessment scores it for exploitation over a network; confidentiality is affected at a high level, integrity at a high level. See the vendor advisory in the references for details.
- 9.9 /10 CriticalCVE-2026-115384 Auth required
Wasmtime - Buffer Overflow
Wasmtime 39.0.0 < 48.0.4 and 49.0.0 < 49.0.2 contain a stack buffer overflow caused by unvalidated async callback result types in component-model-async callbacks, letting malicious guests overwrite return addresses to crash host or escape sandbox, exploit requires supplying mistyped async callbacks.
- 9.9 /10 CriticalCVE-2026-115377 Auth required
Incus - Arbitrary File Write
Incus < 6.0.7, 6.1.0 < 7.0.2, and 7.1.0 < 7.5.0 contain an arbitrary file write vulnerability caused by planting symlinks in transferred volumes during migration, letting attackers write files as root for full host compromise, exploit requires crafted migration sources.
- 9.9 /10 CriticalCVE-2026-115375 Auth required
Incus - Path Traversal
Incus 7.0.0 < 7.0.2 and 7.1.0 < 7.5.0 contains a path traversal caused by unvalidated dependent custom volume names in instance backup index.yaml files, letting clients able to create instances write files on the host, exploit requires ability to create instances.
- 9.9 /10 CriticalCVE-2026-114625 CISA KEVAuth required
VeloCloud Orchestrator - Broken Access Control
VeloCloud Orchestrator (VCO) contains a broken access control vulnerability allowing authenticated users to gain operator privileges and access internal functionality, letting remote attackers compromise confidentiality, integrity, and availability.
- 9.9 /10 CriticalCVE-2026-114612 Auth required
LiteLLM - Authentication Bypass
LiteLLM 1.87.0 to 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2 contains an authentication bypass caused by reuse of cryptographic context for secrets and tokens, letting authenticated internal users gain administrative access and execute arbitrary commands, exploit requires authentication and specific configuration.