Critical CVEs

New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.

Book a demo Request a scan

Feed at a glance

Tracked
10143
Critical
1867
CISA KEV
79
Public PoC
365

Most common types

  • Broken Access Control 1254
  • Privilege Escalation 1186
  • Remote Code Execution 1092
  • Authentication Bypass 810
  • Denial of Service 799

Published per day, last 14 days

3 Oct Critical Other 16 Oct

Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026

Critical CVEs

Newest first · severity as published by the vendor or NVD · page 30 of 125

  • 10.0 /10 Critical
    CVE-2026-96207 No auth

    Microsoft Partner Center - Authentication Bypass

    Microsoft Partner Center contains a broken authentication caused by improper certificate validation, letting unauthorized attackers elevate privileges over a network, exploit requires network access.

  • 9.1 /10 Critical
    CVE-2026-95210

    GnuTLS - Weak Cryptography

    GnuTLS 3.8.13 contains an insecure certificate validation caused by acceptance of certificates with invalid extensions, letting attackers bypass certificate validation, exploit requires attacker to present crafted certificates.

  • 9.9 /10 Critical
    CVE-2026-94510 No auth

    Microsoft Bookings - Authorization Bypass

    Microsoft Bookings contains an authorization bypass caused by user-controlled key manipulation, letting unauthorized attackers elevate privileges over a network, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-93034

    SGLang - Remote Code Execution

    SGLang contains a remote code execution vulnerability caused by unconditionally deserializing PickleWrapper payloads via pickle.loads() in the ZMQ message decoder, letting remote attackers execute arbitrary code, exploit requires data-parallel attention enabled with non-loopback --dist-init-addr.

  • 9.8 /10 Critical
    CVE-2026-92555 PoC publicNo auth

    AKIN Software AKINSOFT WOLVOX Control Panel - Information Disclosure

    AKIN Software AKINSOFT WOLVOX Control Panel 26.02.25 before 26.02.26 contains an information disclosure vulnerability caused by insertion of sensitive information into sent data, letting attackers pull data from system resources, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-9209 No auth

    mJobTime - SQL Injection & Remote Code Execution

    mJobTime through 15.7.3.32 contains an unauthenticated SQL injection caused by execution of caller-supplied SQL in Login.aspx admin panel handlers, letting attackers achieve pre-authentication remote code execution as LocalSystem via HTTP request.

  • 9.1 /10 Critical
    CVE-2026-88647

    GnuTLS - Authentication Bypass

    GnuTLS 3.8.13 contains a hostname verification bypass caused by improper Common Name fallback mechanism handling, letting attackers eavesdrop on communications via crafted certificates, exploit requires crafted certificate.

  • 9.8 /10 Critical
    CVE-2026-88131 No auth

    Microsoft Dataverse - Insecure Deserialization

    Microsoft Dataverse contains an insecure deserialization vulnerability caused by deserialization of untrusted data, letting unauthorized attackers execute code remotely, exploit requires network access.

  • 9.8 /10 Critical
    CVE-2026-87684 No auth

    Brocade Fabric - Buffer Overflow

    Brocade Fabric < 10.0.1 contains a stack-based buffer overflow caused by improper length validation of user-supplied context name in SNMP daemon request handling, letting remote unauthenticated attackers cause memory corruption, DoS, or code execution.

  • 9.8 /10 Critical
    CVE-2026-87659

    Brocade Fabric OS - Authorization Bypass

    Brocade Fabric OS < 10.0.1 contains an authorization bypass caused by crafted inband Fibre Channel vendor-unique CT management requests in Management Server, letting compromised peer switches perform administrative actions, exploit requires compromised switch connected to fabric.

  • 9.8 /10 Critical
    CVE-2026-85097 CISA KEVPoC publicNo auth

    Bricksforge WordPress - Unrestricted File Upload

    Bricksforge WordPress plugin <= 3.1.8.9 contains an unrestricted file upload vulnerability caused by insufficient validation of the 'temporaryFileUploads' URL field, letting unauthenticated attackers upload and execute arbitrary PHP code.

  • 9.8 /10 Critical
    CVE-2026-84272 No auth

    IBM Guardium Data Protection - Authentication Bypass

    IBM Guardium Data Protection 12.1 and 12.2.2 contain a missing authentication vulnerability in the edge-controller component, letting unauthenticated remote attackers execute arbitrary container images and control managed edge clusters.

  • 9.8 /10 Critical
    CVE-2026-84249 No auth

    IBM Guardium Data Protection - Authentication Bypass

    IBM Guardium Data Protection 12.2 and 12.2.2 contain an authentication bypass caused by missing authentication for critical management functions, letting remote attackers execute arbitrary management operations, exploit requires no special privileges.

  • 9.3 /10 Critical
    CVE-2026-84244 No auth

    IBM Guardium Data Protection - Stored XSS

    IBM Guardium Data Protection 12.2 contains a stored cross-site scripting caused by improper sanitization in the Quick Search results grid, letting unauthenticated attackers execute malicious scripts in authenticated users' browsers, exploit requires influencing monitored database traffic.

  • 9.8 /10 Critical
    CVE-2026-80381 No auth

    IBM Guardium Data Protection - SQL Injection

    IBM Guardium Data Protection 12.0, 12.1, and 12.2 contain a sql injection caused by improper input sanitization, letting remote attackers execute unauthorized SQL statements, exploit requires network access.