Critical CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10143
- Critical
- 1867
- CISA KEV
- 79
- Public PoC
- 365
Most common types
- Broken Access Control 1254
- Privilege Escalation 1186
- Remote Code Execution 1092
- Authentication Bypass 810
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 16 Oct 2026
Critical CVEs
Newest first · severity as published by the vendor or NVD · page 31 of 125
- 9.1 /10 CriticalCVE-2026-79842 No auth
HPE Intelligent Management Center - Authentication Bypass
HPE Intelligent Management Center (iMC) < 7.3 E0713 contains an authentication bypass caused by improper authentication checks, letting attackers gain unauthorized access, exploit requires no special privileges.
- 9.1 /10 CriticalCVE-2026-78663 No auth
HTTP/2 Server - Denial of Service
HTTP/2 server contains a flow control bypass caused by double refunding connection-level flow control for the same data, letting malicious clients bypass connection-level flow control limits, exploit requires malicious client to reset streams.
- 9.8 /10 CriticalCVE-2026-78406 No auth
IBM Security Verify Access & IBM Verify Identity Access - Remote Code Execution
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain an insecure deserialization vulnerability caused by deserialization of untrusted data, letting remote unauthenticated attackers execute arbitrary code.
- 9.8 /10 CriticalCVE-2026-78401 No auth
IBM Security Verify Access & IBM Verify Identity Access - Remote Code Execution
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain an insecure deserialization vulnerability caused by deserialization of untrusted data, letting remote unauthenticated attackers execute arbitrary code.
- 9.8 /10 CriticalCVE-2026-77900 No auth
Azure App Service - Authentication Bypass
Azure App Service contains a broken authentication caused by missing authentication for a critical function, letting unauthorized attackers execute code remotely, exploit requires no special privileges.
- 9.8 /10 CriticalCVE-2026-75875 No auth
IBM Guardium Data Protection - Remote Code Execution
IBM Guardium Data Protection 12.0, 12.1, and 12.2 contain a path traversal vulnerability that allows remote attackers to execute arbitrary code by accessing unintended file paths, exploit requires network access.
- 9.6 /10 CriticalCVE-2026-69435 Auth required
Azure SRE Agent - Broken Access Control
Azure SRE Agent contains a broken access control vulnerability caused by missing authorization checks, letting authorized attackers elevate privileges over a network, exploit requires attacker to be authorized.
- 9.8 /10 CriticalCVE-2026-56857 No auth
Windows - Path Traversal
Windows file system operations Root.Mkdir and Root.MkdirAll contain a path traversal vulnerability caused by improper handling of junction points, letting attackers create directories outside the root, exploit requires a junction pointing to an empty location.
- 9.1 /10 CriticalCVE-2026-19491 No auth
IBM Security Verify Access & IBM Verify Identity Access - Authentication Bypass
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain an authentication bypass caused by improper authentication, letting remote attackers bypass authentication, exploit requires network access.
- 9.1 /10 CriticalCVE-2026-19218 No auth
AKIN Software MyRezzta - Broken Authentication
AKIN Software MyRezzta 2.06.03 before 2.07.01 contains a weak password recovery mechanism caused by insecure password reset process, letting attackers exploit password recovery to gain unauthorized access, exploit requires no special privileges.
- 9.1 /10 CriticalCVE-2026-17609 No auth
WordPress Super Forms – Drag & Drop Form Builder - Arbitrary Directory Deletion
Super Forms – Drag & Drop Form Builder plugin for WordPress <= 6.3.316 contains an arbitrary directory deletion vulnerability caused by insufficient validation of JSON field declarations and a bypassable ABSPATH guard in submit_form, letting unauthenticated attackers recursively delete arbitrary directories, exploit requires 'Delete files from server after form submissions' setting enabled by admin.
- 9.1 /10 CriticalCVE-2026-16916 Auth required
IBM Security Verify Access - Remote Code Execution
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain a remote code execution caused by a protection mechanism failure, letting remote authenticated attackers execute arbitrary code.
- 9.1 /10 CriticalCVE-2026-16823 No auth
IBM Security Verify Access & IBM Verify Identity Access - Authentication Bypass
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 contain a broken authentication caused by improper authentication, letting remote attackers bypass security restrictions, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-16340 No auth
IBM DataPower Gateway - Remote Code Execution
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contain a remote code execution caused by an out-of-bounds write in the RFC2047 encoded-word parser, letting remote attackers execute arbitrary code, exploit requires network access.
- 9.8 /10 CriticalCVE-2026-15762 No auth
IBM DataPower Gateway - Remote Code Execution
IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 contain a buffer overflow caused by an out-of-bounds write, letting remote attackers execute arbitrary code remotely, exploit requires network access.